)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a", 0x9, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100), 0x0, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:47 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) r5 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a", 0x9, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100), 0x0, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:47 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) r5 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100), 0x0, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:47 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a", 0x9, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a", 0x9, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:47 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r5 = openat$nci(0xffffff9c, 0x0, 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a4580", 0xd, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a", 0x9, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:47 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r5 = openat$nci(0xffffff9c, 0x0, 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a", 0x9, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:47 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a4580", 0xd, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r5 = openat$nci(0xffffff9c, 0x0, 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, 0x0) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a4580", 0xd, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:47 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a4580", 0xd, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, 0x0) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a4580", 0xd, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:47 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, 0x0) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de1", 0xf, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a4580", 0xd, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:47 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de1", 0xf, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de1", 0xf, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:47 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r5 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a4580", 0xd, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de1", 0xf, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:47 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r5 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a4580", 0xd, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a4580", 0xd, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:47 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r5 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a4580", 0xd, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a4580", 0xd, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a4580", 0xd, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a4580", 0xd, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a4580", 0xd, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a4580", 0xd, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a4580", 0xd, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a4580", 0xd, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r5 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x0, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a4580", 0xd, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r5 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x0, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r5 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x0, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r5 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x0, 0x1fcf4d}) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r5 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x0, 0x1fcf4d}) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r0 = openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r5 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x0, 0x1fcf4d}) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r0 = openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r5 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24}) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r0 = openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r5 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r5 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, 0x0, 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, 0x0, 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, 0x0, 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r5 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r5, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r6, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r4, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r6}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r5, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r6, 0x0, 0xffffffffffffffff, 0x1}) r7 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r7, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r8, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r5 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r5, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r6, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r4, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r6}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r5, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r6, 0x0, 0xffffffffffffffff, 0x1}) r7 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r7, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r8, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r5 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r5, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r6, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r4, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r6}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r5, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r6, 0x0, 0xffffffffffffffff, 0x1}) r7 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r7, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r8, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, 0x0, 0x2, 0x0) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, 0x0, 0x2, 0x0) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, 0x0) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, 0x0, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r7 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r7, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r8, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, 0x0, 0x2, 0x0) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, 0x0) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, 0x0, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r7 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r7, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r8, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, 0x0) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, 0x0, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r7 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r7, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r8, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, 0x0) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, 0x0, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r7 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r7, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r8, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, 0x0) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, 0x0, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r7 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r7, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r8, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, 0x0, 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, 0x0, 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, 0x0, 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x0, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x0, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r5 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r5, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r6, 0x285f4, 0x8000, 0x1, 0x30a0}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) 08:33:49 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x0, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r5 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r5, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r6, 0x285f4, 0x8000, 0x1, 0x30a0}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, 0x0, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r5 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r5, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r6, 0x285f4, 0x8000, 0x1, 0x30a0}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, 0x0, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, 0x0, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r4, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r3 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r3, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r4, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, 0x0, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r3 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r3, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) 08:33:49 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r4, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, 0x0, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r3 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r3, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) 08:33:49 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r4, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r3 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r3, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, 0x0, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r3 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r3, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x0, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r3 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r3, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x0, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x0, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x0, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x0, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x0, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x0, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x0, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x0, 0x1fcf4d}) 08:33:49 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x0, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x0, 0x1fcf4d}) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x0, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x0, 0x1fcf4d}) 08:33:49 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24}) 08:33:50 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x0, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r9 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r8, r9, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24}) 08:33:50 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x0, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r9 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r8, r9, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24}) 08:33:50 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r6, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r6}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r8 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r7, r8, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24}) 08:33:50 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r6, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r6}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r8 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r7, r8, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24}) 08:33:50 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r6, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r6}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r8 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r7, r8, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24}) 08:33:50 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r9 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r8, r9, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r9 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r8, r9, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r3 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r3, 0x0) 08:33:50 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r9 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r8, r9, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r9 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r8, r9, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r9 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r8, r9, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r9 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r8, r9, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r9 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r8, r9, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 0: openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r5 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r5, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r7 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r6, r7, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 0: openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 0: openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r5 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r5, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r7 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r6, r7, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r6 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r5, r6, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 0: ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 0: ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r6 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r5, r6, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 0: ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r6 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r5, r6, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 0: r0 = openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r5 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r5, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r7 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r6, r7, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 0: r0 = openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r5 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r5, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r7 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r6, r7, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 0: r0 = openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 0: r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r6 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r5, r6, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc}) r1 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_NET_SET_BACKEND(r1, 0x4008af30, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 0: r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r6 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r5, r6, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 0: r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r6 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r5, r6, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) r4 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r6 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r5, r6, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) r4 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r6 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r5, r6, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) r4 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r6 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r5, r6, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 1: r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r6 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r5, r6, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 1: r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r6 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r5, r6, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, 0x0) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 1: r0 = openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r6 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r5, r6, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, 0x0) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r6 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r5, r6, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 1: openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, 0x0) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r6 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r5, r6, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 1: openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, 0x0) openat$nci(0xffffff9c, 0x0, 0x2, 0x0) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 1: openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, 0x0) openat$nci(0xffffff9c, 0x0, 0x2, 0x0) 08:33:51 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r6 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r5, r6, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 1: openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, 0x0) openat$nci(0xffffff9c, 0x0, 0x2, 0x0) 08:33:51 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r6 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r5, r6, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(0x0, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(0x0, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r3, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r5 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r4, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(0x0, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r3, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r5 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r4, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r3, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r5 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r4, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r3, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r5 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r4, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r3, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r5 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r4, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r3, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r5 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r4, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r3, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r5 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r4, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r3, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r5 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r4, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, &(0x7f00000000c0)={0xc}) r1 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r1, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r2 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r2, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r3, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, &(0x7f00000000c0)={0xc}) r1 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r1, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r2 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r2, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r3, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, &(0x7f00000000c0)={0xc}) r1 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r1, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r2 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r2, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r3, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 3: openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, &(0x7f00000000c0)={0xc}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r1 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r3 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r2, r3, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 3: openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, &(0x7f00000000c0)={0xc}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r1 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r3 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r2, r3, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 3: openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, &(0x7f00000000c0)={0xc}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r1 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r3 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r2, r3, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, 0x0, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), &(0x7f0000000780), {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, &(0x7f00000000c0)={0xc}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r1 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r3 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r2, r3, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, 0x0, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), &(0x7f0000000780), {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, &(0x7f00000000c0)={0xc}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r1 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r3 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r2, r3, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), &(0x7f0000000780), {}, 0x0, 0x0, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, 0x0, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r1 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r3 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r2, r3, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), &(0x7f0000000780), {}, 0x0, 0x0, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r5 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r5, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r6, 0x285f4, 0x8000, 0x1, 0x30a0}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) r0 = openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r1 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r3 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r2, r3, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), &(0x7f0000000780), {}, 0x0, 0x0, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) r0 = openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r1 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r3 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r2, r3, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), &(0x7f0000000780), {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), &(0x7f0000000780), {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, 0x0}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, 0x0, 0x0, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), &(0x7f0000000780), {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, 0x0}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, 0x0, 0x0, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), &(0x7f0000000780), {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, 0x0}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, 0x0, 0x0, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580), 0x0, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), &(0x7f0000000780), {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, &(0x7f0000000880)=[0x0], 0x1}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580), 0x0, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580), 0x0, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), &(0x7f0000000780), {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, &(0x7f0000000880)=[0x0], 0x1}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{0x0}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{0x0}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), &(0x7f0000000780), {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, &(0x7f0000000880)=[0x0], 0x1}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r0, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), &(0x7f0000000780), {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, &(0x7f0000000880)=[0x0], 0x1}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{0x0}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r0, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc}) socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), &(0x7f0000000780), {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, &(0x7f0000000880)=[0x0], 0x1}, 0x58) openat$nci(0xffffff9c, 0x0, 0x2, 0x0) 08:33:53 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r0, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), &(0x7f0000000780), {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, &(0x7f0000000880)=[0x0], 0x1}, 0x58) openat$nci(0xffffff9c, 0x0, 0x2, 0x0) 08:33:53 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), &(0x7f0000000780), {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, &(0x7f0000000880)=[0x0], 0x1}, 0x58) openat$nci(0xffffff9c, 0x0, 0x2, 0x0) 08:33:53 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 0: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 1: openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x0) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 1: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 0: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x0) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 1: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(0x0, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 0: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 1: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(0x0, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x0) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 0: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) 08:33:53 executing program 1: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(0x0, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 1: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 0: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 0: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 1: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 0: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 0: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 1: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, 0x0, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 0: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, 0x0, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 1: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 0: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, 0x0, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 1: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 0: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(0x0, 0x0) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 0: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 1: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), 0x0, &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(0x0, 0x0) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(0x0, 0x0) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 0: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 1: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), 0x0, &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 0: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 0: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 1: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), 0x0, 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 1: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), 0x0, 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 0: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 0: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:54 executing program 1: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), 0x0, 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 0: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) socket$can_raw(0x1d, 0x3, 0x1) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:54 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 1: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:54 executing program 0: socket$can_raw(0x1d, 0x3, 0x1) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 1: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), 0x0, 0x0, {}, 0x0, 0x0, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:54 executing program 0: socket$can_raw(0x1d, 0x3, 0x1) openat$nci(0xffffff9c, 0x0, 0x2, 0x0) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 0: socket$can_raw(0x1d, 0x3, 0x1) openat$nci(0xffffff9c, 0x0, 0x2, 0x0) 08:33:54 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 0: socket$can_raw(0x1d, 0x3, 0x1) openat$nci(0xffffff9c, 0x0, 0x2, 0x0) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 1: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:54 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x0, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 1: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:54 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x0, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 1: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) openat$nci(0xffffff9c, 0x0, 0x2, 0x0) 08:33:54 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x0, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 1: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) openat$nci(0xffffff9c, 0x0, 0x2, 0x0) 08:33:54 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x0, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 1: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) openat$nci(0xffffff9c, 0x0, 0x2, 0x0) 08:33:54 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x0, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 1: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x0, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x0, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 1: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x0, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {0xa}, 0x0, 0x0, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 0: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) openat$nci(0xffffff9c, 0x0, 0x2, 0x0) 08:33:54 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x0, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {0xa}, 0x0, 0x0, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 0: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) openat$nci(0xffffff9c, 0x0, 0x2, 0x0) 08:33:54 executing program 1: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {0xa}, 0x0, 0x0, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 0: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) openat$nci(0xffffff9c, 0x0, 0x2, 0x0) 08:33:54 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x0, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 1: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, 0x0, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 1: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:54 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 0: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, 0x0, 0x0}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 1: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:54 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 0: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, 0x0, 0x0}, 0x58) r1 = openat$nci(0xffffff9c, 0x0, 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 1: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:54 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, 0x0, 0x0}, 0x58) r1 = openat$nci(0xffffff9c, 0x0, 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 1: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:54 executing program 0: syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, 0x0, 0x0}, 0x58) r1 = openat$nci(0xffffff9c, 0x0, 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 1: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:54 executing program 0: syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, 0x0, 0x0}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 1: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:54 executing program 1: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:54 executing program 0: syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, 0x0, 0x0}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, 0x0) 08:33:54 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 1: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:54 executing program 0: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(0x0, 0x0) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, 0x0, 0x0}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, 0x0) 08:33:54 executing program 0: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(0x0, 0x0) 08:33:54 executing program 1: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:54 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 0: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(0x0, 0x0) 08:33:55 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 1: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:55 executing program 0: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 08:33:55 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x0, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 1: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:55 executing program 0: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 08:33:55 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 1: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:55 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x0, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 1: syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:55 executing program 0: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 08:33:55 executing program 1: syz_clone3(0x0, 0x0) 08:33:55 executing program 0: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 08:33:55 executing program 3: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 08:33:55 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x0, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 1: syz_clone3(0x0, 0x0) 08:33:55 executing program 1: syz_clone3(0x0, 0x0) 08:33:55 executing program 3: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 08:33:55 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, 0x0, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 1: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:55 executing program 0: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 08:33:55 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, 0x0, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 3: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 08:33:55 executing program 1: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:55 executing program 0: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 08:33:55 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, 0x0, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 3: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 08:33:55 executing program 1: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:55 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 1: syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:55 executing program 3: syz_clone3(0x0, 0x0) 08:33:55 executing program 0: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 08:33:55 executing program 3: syz_clone3(0x0, 0x0) 08:33:55 executing program 1: syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:55 executing program 0: syz_clone3(0x0, 0x0) 08:33:55 executing program 3: syz_clone3(0x0, 0x0) 08:33:55 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 1: syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:55 executing program 0: syz_clone3(0x0, 0x0) 08:33:55 executing program 1: syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:55 executing program 0: syz_clone3(0x0, 0x0) 08:33:55 executing program 3: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 08:33:55 executing program 1: syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, 0x0}, 0x58) 08:33:55 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 0: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:55 executing program 1: syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, 0x0}, 0x58) 08:33:55 executing program 3: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 08:33:55 executing program 1: syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, 0x0}, 0x58) 08:33:55 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(0x0, 0x0) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 0: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:55 executing program 1: syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, &(0x7f0000000880)=[0x0], 0x1}, 0x58) 08:33:55 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(0x0, 0x0) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 1: syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, &(0x7f0000000880)}, 0x58) 08:33:55 executing program 3: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 08:33:55 executing program 1: syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, &(0x7f0000000880)}, 0x58) 08:33:55 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(0x0, 0x0) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 0: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:55 executing program 3: syz_clone3(0x0, 0x0) 08:33:55 executing program 1: syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, &(0x7f0000000880)}, 0x58) 08:33:55 executing program 3: syz_clone3(0x0, 0x0) 08:33:55 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(0x0, 0x0) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 0: syz_clone3(0x0, 0x0) 08:33:55 executing program 3: syz_clone3(0x0, 0x0) 08:33:55 executing program 0: syz_clone3(0x0, 0x0) 08:33:55 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 0: syz_clone3(0x0, 0x0) 08:33:55 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 0: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:55 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 0: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:55 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 1: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:55 executing program 0: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:55 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 0: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:55 executing program 0: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, 0x0}, 0x58) 08:33:55 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 0: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, 0x0}, 0x58) 08:33:55 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 0: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, 0x0}, 0x58) 08:33:55 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) 08:33:55 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, 0x0, &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 0: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, &(0x7f0000000880)=[0x0], 0x1}, 0x58) 08:33:55 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) 08:33:55 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, 0x0, &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 0: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, &(0x7f0000000880)}, 0x58) 08:33:55 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) 08:33:55 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) 08:33:55 executing program 0: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, &(0x7f0000000880)}, 0x58) 08:33:55 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, 0x0, &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 0: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, &(0x7f0000000880)}, 0x58) 08:33:55 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, 0x0, &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:56 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:56 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:56 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:56 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) 08:33:56 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:56 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:56 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) 08:33:56 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:56 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) 08:33:56 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:56 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) 08:33:56 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) 08:33:56 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:56 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:56 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) 08:33:56 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:56 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:56 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) 08:33:56 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:56 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) 08:33:56 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, 0x0, 0x0, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:56 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:56 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, 0x0, 0x0, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:56 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:56 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) 08:33:56 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:56 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, 0x0, 0x0, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:56 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:56 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) 08:33:56 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) 08:33:56 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, 0x0, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:56 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:56 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) 08:33:56 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) 08:33:56 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, 0x0, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) [ 67.809325][T11471] ================================================================== [ 67.812556][T11471] BUG: KASAN: slab-use-after-free in __list_del_entry_valid_or_report+0x174/0x1b0 [ 67.815965][T11471] Read of size 8 at addr ffff88801b526008 by task syz-executor.0/11471 [ 67.818950][T11471] [ 67.819886][T11471] CPU: 1 PID: 11471 Comm: syz-executor.0 Not tainted 6.5.0-syzkaller-12053-g744a759492b5 #0 [ 67.824532][T11471] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 67.829776][T11471] Call Trace: [ 67.831335][T11471] [ 67.832720][T11471] dump_stack_lvl+0xd9/0x1b0 [ 67.834881][T11471] print_report+0xc4/0x620 [ 67.836982][T11471] ? __virt_addr_valid+0x5e/0x2d0 [ 67.839333][T11471] ? __phys_addr+0xc6/0x140 [ 67.841406][T11471] kasan_report+0xda/0x110 [ 67.843310][T11471] ? __list_del_entry_valid_or_report+0x174/0x1b0 [ 67.846202][T11471] ? __list_del_entry_valid_or_report+0x174/0x1b0 [ 67.849188][T11471] __list_del_entry_valid_or_report+0x174/0x1b0 [ 67.852076][T11471] nfc_llcp_unregister_device+0xc3/0x2c0 [ 67.854692][T11471] nfc_unregister_device+0x194/0x330 [ 67.857165][T11471] ? virtual_nci_open+0x10/0x10 [ 67.859447][T11471] virtual_ncidev_close+0x51/0xa0 [ 67.861747][T11471] __fput+0x3f7/0xa70 [ 67.863535][T11471] __fput_sync+0x47/0x50 [ 67.865478][T11471] __ia32_sys_close+0x87/0xf0 [ 67.867676][T11471] __do_fast_syscall_32+0x61/0xe0 [ 67.870080][T11471] do_fast_syscall_32+0x33/0x70 [ 67.872399][T11471] entry_SYSENTER_compat_after_hwframe+0x70/0x82 [ 67.875327][T11471] RIP: 0023:0xf7f7d579 [ 67.877258][T11471] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 [ 67.885985][T11471] RSP: 002b:00000000ff857c60 EFLAGS: 00000293 ORIG_RAX: 0000000000000006 [ 67.889686][T11471] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 0000000057143400 [ 67.893329][T11471] RDX: 0000000000000000 RSI: 00000000f7353ff4 RDI: 0000000000000000 [ 67.896994][T11471] RBP: 00000000f7200000 R08: 0000000000000000 R09: 0000000000000000 [ 67.900643][T11471] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 [ 67.904206][T11471] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 67.907246][T11471] [ 67.908444][T11471] [ 67.909329][T11471] Allocated by task 11465: [ 67.910968][T11471] kasan_save_stack+0x33/0x50 [ 67.912964][T11471] kasan_set_track+0x25/0x30 [ 67.915136][T11471] __kasan_kmalloc+0xa2/0xb0 [ 67.917297][T11471] nfc_llcp_register_device+0x47/0x9d0 [ 67.919814][T11471] nfc_register_device+0x6d/0x3c0 [ 67.922168][T11471] nci_register_device+0x7f4/0xb80 [ 67.924455][T11471] virtual_ncidev_open+0x147/0x220 [ 67.926337][T11471] misc_open+0x3da/0x4c0 [ 67.927888][T11471] chrdev_open+0x277/0x700 [ 67.929547][T11471] do_dentry_open+0x88b/0x1730 [ 67.931304][T11471] path_openat+0x19af/0x29c0 [ 67.933047][T11471] do_filp_open+0x1de/0x430 [ 67.934737][T11471] do_sys_openat2+0x176/0x1e0 [ 67.936498][T11471] __ia32_compat_sys_openat+0x16e/0x200 [ 67.938513][T11471] __do_fast_syscall_32+0x61/0xe0 [ 67.940384][T11471] do_fast_syscall_32+0x33/0x70 [ 67.942315][T11471] entry_SYSENTER_compat_after_hwframe+0x70/0x82 [ 67.944679][T11471] [ 67.945561][T11471] Freed by task 11464: [ 67.947051][T11471] kasan_save_stack+0x33/0x50 [ 67.948858][T11471] kasan_set_track+0x25/0x30 [ 67.950616][T11471] kasan_save_free_info+0x2b/0x40 [ 67.952711][T11471] ____kasan_slab_free+0x15b/0x1b0 [ 67.954601][T11471] slab_free_freelist_hook+0x114/0x1e0 [ 67.956602][T11471] __kmem_cache_free+0xb8/0x2f0 [ 67.958372][T11471] nfc_llcp_local_put.part.0+0x88/0xb0 [ 67.960354][T11471] nfc_llcp_unregister_device+0x1db/0x2c0 [ 67.962600][T11471] nfc_unregister_device+0x194/0x330 [ 67.964536][T11471] virtual_ncidev_close+0x51/0xa0 [ 67.966368][T11471] __fput+0x3f7/0xa70 [ 67.967832][T11471] __fput_sync+0x47/0x50 [ 67.969415][T11471] __ia32_sys_close+0x87/0xf0 [ 67.971124][T11471] __do_fast_syscall_32+0x61/0xe0 [ 67.973065][T11471] do_fast_syscall_32+0x33/0x70 [ 67.974843][T11471] entry_SYSENTER_compat_after_hwframe+0x70/0x82 [ 67.977156][T11471] [ 67.978037][T11471] Last potentially related work creation: [ 67.980097][T11471] kasan_save_stack+0x33/0x50 [ 67.981878][T11471] __kasan_record_aux_stack+0xbc/0xd0 [ 67.983988][T11471] insert_work+0x38/0x230 [ 67.985575][T11471] __queue_work+0x5d2/0x1060 [ 67.987262][T11471] queue_work_on+0xed/0x110 [ 67.988949][T11471] rfkill_register+0x67f/0xb00 [ 67.990703][T11471] nfc_register_device+0x11f/0x3c0 [ 67.992669][T11471] nci_register_device+0x7f4/0xb80 [ 67.994766][T11471] virtual_ncidev_open+0x147/0x220 [ 67.997152][T11471] misc_open+0x3da/0x4c0 [ 67.999021][T11471] chrdev_open+0x277/0x700 [ 68.000963][T11471] do_dentry_open+0x88b/0x1730 [ 68.003182][T11471] path_openat+0x19af/0x29c0 [ 68.005271][T11471] do_filp_open+0x1de/0x430 [ 68.007394][T11471] do_sys_openat2+0x176/0x1e0 [ 68.009432][T11471] __ia32_compat_sys_openat+0x16e/0x200 [ 68.011956][T11471] __do_fast_syscall_32+0x61/0xe0 [ 68.014123][T11471] do_fast_syscall_32+0x33/0x70 [ 68.016309][T11471] entry_SYSENTER_compat_after_hwframe+0x70/0x82 [ 68.019162][T11471] [ 68.020311][T11471] Second to last potentially related work creation: [ 68.023248][T11471] kasan_save_stack+0x33/0x50 [ 68.025424][T11471] __kasan_record_aux_stack+0xbc/0xd0 [ 68.027879][T11471] insert_work+0x38/0x230 [ 68.029897][T11471] __queue_work+0x5d2/0x1060 [ 68.032045][T11471] queue_work_on+0xed/0x110 [ 68.034286][T11471] rfkill_register+0x67f/0xb00 [ 68.036508][T11471] nfc_register_device+0x11f/0x3c0 [ 68.038865][T11471] nci_register_device+0x7f4/0xb80 [ 68.041251][T11471] virtual_ncidev_open+0x147/0x220 [ 68.043625][T11471] misc_open+0x3da/0x4c0 [ 68.045603][T11471] chrdev_open+0x277/0x700 [ 68.047686][T11471] do_dentry_open+0x88b/0x1730 [ 68.049926][T11471] path_openat+0x19af/0x29c0 [ 68.052071][T11471] do_filp_open+0x1de/0x430 [ 68.054188][T11471] do_sys_openat2+0x176/0x1e0 [ 68.056396][T11471] __ia32_compat_sys_openat+0x16e/0x200 [ 68.058949][T11471] __do_fast_syscall_32+0x61/0xe0 [ 68.061298][T11471] do_fast_syscall_32+0x33/0x70 [ 68.063561][T11471] entry_SYSENTER_compat_after_hwframe+0x70/0x82 [ 68.066519][T11471] [ 68.067625][T11471] The buggy address belongs to the object at ffff88801b526000 [ 68.067625][T11471] which belongs to the cache kmalloc-2k of size 2048 [ 68.074035][T11471] The buggy address is located 8 bytes inside of [ 68.074035][T11471] freed 2048-byte region [ffff88801b526000, ffff88801b526800) [ 68.079981][T11471] [ 68.081109][T11471] The buggy address belongs to the physical page: [ 68.084027][T11471] page:ffffea00006d4800 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88801b522000 pfn:0x1b520 [ 68.089189][T11471] head:ffffea00006d4800 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 68.093210][T11471] anon flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 68.097034][T11471] page_type: 0xffffffff() [ 68.099048][T11471] raw: 00fff00000000840 ffff888012c42f00 0000000000000000 dead000000000001 [ 68.102913][T11471] raw: ffff88801b522000 0000000080080007 00000001ffffffff 0000000000000000 [ 68.106804][T11471] page dumped because: kasan: bad access detected [ 68.109727][T11471] page_owner tracks the page as allocated [ 68.112313][T11471] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5173, tgid 5173 (syz-executor.1), ts 49022650615, free_ts 47818517009 [ 68.121961][T11471] post_alloc_hook+0x2cf/0x340 [ 68.124188][T11471] get_page_from_freelist+0xee0/0x2f20 [ 68.126695][T11471] __alloc_pages+0x1d0/0x4a0 [ 68.128856][T11471] alloc_pages+0x1a9/0x270 [ 68.130948][T11471] allocate_slab+0x251/0x380 [ 68.133114][T11471] ___slab_alloc+0x8be/0x1570 [ 68.135315][T11471] __slab_alloc.constprop.0+0x56/0xa0 [ 68.137807][T11471] __kmem_cache_alloc_node+0x137/0x350 [ 68.140350][T11471] kmalloc_trace+0x25/0xe0 [ 68.142335][T11471] rtnl_newlink+0x49/0xa0 [ 68.144256][T11471] rtnetlink_rcv_msg+0x439/0xd30 [ 68.146550][T11471] netlink_rcv_skb+0x16b/0x440 [ 68.148766][T11471] netlink_unicast+0x536/0x810 [ 68.150935][T11471] netlink_sendmsg+0x93c/0xe40 [ 68.153132][T11471] sock_sendmsg+0xd9/0x180 [ 68.155206][T11471] __sys_sendto+0x255/0x340 [ 68.157337][T11471] page last free stack trace: [ 68.159541][T11471] free_unref_page_prepare+0x476/0xa40 [ 68.162073][T11471] free_unref_page+0x33/0x3b0 [ 68.163783][T11471] __unfreeze_partials+0x21d/0x240 [ 68.165673][T11471] qlist_free_all+0x6a/0x170 [ 68.167371][T11471] kasan_quarantine_reduce+0x18b/0x1d0 [ 68.169440][T11471] __kasan_slab_alloc+0x65/0x90 [ 68.171227][T11471] __kmem_cache_alloc_node+0x19b/0x350 [ 68.173305][T11471] __kmalloc_node+0x52/0x110 [ 68.175181][T11471] kvmalloc_node+0x99/0x1a0 [ 68.177342][T11471] seq_read_iter+0x80b/0x1280 [ 68.179564][T11471] kernfs_fop_read_iter+0x4c8/0x680 [ 68.182040][T11471] vfs_read+0x4e0/0x930 [ 68.183998][T11471] ksys_read+0x12f/0x250 [ 68.186012][T11471] do_syscall_64+0x38/0xb0 [ 68.188154][T11471] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 68.190989][T11471] [ 68.192114][T11471] Memory state around the buggy address: [ 68.194721][T11471] ffff88801b525f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 68.198472][T11471] ffff88801b525f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 68.202221][T11471] >ffff88801b526000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 68.205871][T11471] ^ [ 68.207893][T11471] ffff88801b526080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 68.211659][T11471] ffff88801b526100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 68.215371][T11471] ================================================================== [ 68.220332][T11471] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 68.223781][T11471] CPU: 1 PID: 11471 Comm: syz-executor.0 Not tainted 6.5.0-syzkaller-12053-g744a759492b5 #0 [ 68.228450][T11471] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 68.233118][T11471] Call Trace: [ 68.234675][T11471] [ 68.236024][T11471] dump_stack_lvl+0xd9/0x1b0 [ 68.238164][T11471] panic+0x6a6/0x750 [ 68.239596][T11471] ? panic_smp_self_stop+0xa0/0xa0 [ 68.241499][T11471] ? trace_irq_enable.constprop.0+0xd0/0x100 [ 68.244059][T11471] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 68.246492][T11471] check_panic_on_warn+0xab/0xb0 [ 68.248345][T11471] end_report+0x108/0x150 [ 68.249953][T11471] kasan_report+0xea/0x110 [ 68.251640][T11471] ? __list_del_entry_valid_or_report+0x174/0x1b0 [ 68.254325][T11471] ? __list_del_entry_valid_or_report+0x174/0x1b0 [ 68.256708][T11471] __list_del_entry_valid_or_report+0x174/0x1b0 [ 68.258959][T11471] nfc_llcp_unregister_device+0xc3/0x2c0 [ 68.260997][T11471] nfc_unregister_device+0x194/0x330 [ 68.262947][T11471] ? virtual_nci_open+0x10/0x10 [ 68.264842][T11471] virtual_ncidev_close+0x51/0xa0 [ 68.266787][T11471] __fput+0x3f7/0xa70 [ 68.268263][T11471] __fput_sync+0x47/0x50 [ 68.269827][T11471] __ia32_sys_close+0x87/0xf0 [ 68.271546][T11471] __do_fast_syscall_32+0x61/0xe0 [ 68.273572][T11471] do_fast_syscall_32+0x33/0x70 [ 68.275374][T11471] entry_SYSENTER_compat_after_hwframe+0x70/0x82 [ 68.277684][T11471] RIP: 0023:0xf7f7d579 [ 68.279176][T11471] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 [ 68.286434][T11471] RSP: 002b:00000000ff857c60 EFLAGS: 00000293 ORIG_RAX: 0000000000000006 [ 68.289473][T11471] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 0000000057143400 [ 68.292552][T11471] RDX: 0000000000000000 RSI: 00000000f7353ff4 RDI: 0000000000000000 [ 68.295581][T11471] RBP: 00000000f7200000 R08: 0000000000000000 R09: 0000000000000000 [ 68.299072][T11471] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 [ 68.302082][T11471] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 68.305716][T11471] [ 68.308081][T11471] Kernel Offset: disabled [ 68.310145][T11471] Rebooting in 86400 seconds.. VM DIAGNOSIS: 08:33:56 Registers: info registers vcpu 0 CPU#0 RAX=ffff8880406492c0 RBX=ffff888060052200 RCX=0000000000000000 RDX=0000000080070006 RSI=ffff888060052200 RDI=ffffc9000608f660 RBP=ffffc9000608f688 RSP=ffffc9000608f5e0 R8 =0000000080070005 R9 =0000000000000000 R10=0000000000000000 R11=0000000000000000 R12=0000000080070005 R13=0000000000000001 R14=ffff888060056600 R15=ffffea0001801400 RIP=ffffffff81dd08be RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 00007fa3ccfaf280 ffffffff 00c00000 GS =0000 ffff88802c600000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=000000002ef21000 CR3=0000000060f8a000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000fffe0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=00000000b0340000 Opmask01=0000000000000000 Opmask02=00000000ffffbdff Opmask03=0000000000000000 Opmask04=00000000f7ffffff Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000001 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffcde1cb8b0 0000003000000018 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 2a2a2a2a2a2a2a2a 2a2a2a2a2a2a2a2a ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00000000ff000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffff00000000 ffffffff0000ff00 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00000000ff000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2525252525252525 2525252525252525 2525252525252525 2525252525252525 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 20676e6964616572 004b4f2034366f66 6e695f706f6f6c20 676e696461657200 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 05424b4c41444057 004b4f0511134a43 4b4c5f554a4a4905 424b4c4144405700 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00000000000002d1 0000000000000000 32706f6f6c2f6b63 6f6c622f6c617574 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000041 000000000031326c 6c696b66722f3031 7968702f31313230 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 493b3a2632483b3a 264c4b3b3a264f4b 3b3a26494b3b3a26 3b3d3b3a263f3c3b ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 383a263e3e383a26 3c3b383a264f3a38 3a26493a383a2648 3a383a264b3a383a ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 223032363d4d0037 0036340000343632 363d455300313d4e 0030003500323600 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2230320000300030 0030200000303030 3030302d00310038 0022003500303600 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=0000000000000030 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff849aa015 RDI=ffffffff92551140 RBP=ffffffff92551100 RSP=ffffc900238af800 R8 =0000000000000001 R9 =000000000000001f R10=0000000000000000 R11=502031203a555043 R12=0000000000000000 R13=0000000000000030 R14=ffffffff849a9fb0 R15=0000000000000000 RIP=ffffffff849aa03f RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] FS =0000 0000000000000000 ffffffff 00c00000 GS =0063 ffff88802c700000 ffffffff 00d0f300 DPL=3 DS [-WA] LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=000000002ed24000 CR3=0000000060da9000 CR4=00350ee0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000fffe0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000052 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffffffffffff ffffffff0f0e0d0c ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 2 CPU#2 RAX=0000000024ebefe6 RBX=0000002a24ebef8a RCX=0000000000000002 RDX=000000000000002a RSI=ffffffff8ae903a0 RDI=ffffffff8ae903e0 RBP=0000002a24ebd072 RSP=ffffc900005ffb70 R8 =0000000000000000 R9 =ffffed100fda8828 R10=ffff88807ed44147 R11=0000000000000000 R12=0000000000000002 R13=00000000000032c9 R14=ffffffff922fcb00 R15=ffffffff922fcb00 RIP=ffffffff8a320529 RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff88802c800000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000091000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe000008f000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00000000f737b028 CR3=0000000019b45000 CR4=00350ee0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000fffe0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000044000001 Opmask01=000000000000001f Opmask02=000000000000ffdf Opmask03=0000000000000000 Opmask04=00000000f7ffffff Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffcde1d0950 0000003000000018 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 2f2f2f2f2f2f2f2f 2f2f2f2f2f2f2f2f ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000ff00000000 00ff000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00ff000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffff000000000000 ffff000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 7373737373737353 7373737373737353 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 73730cd0bfcc6f03 73730cd0bfcc6f03 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2525252525252525 2525252525252525 2525252525252525 2525252525252525 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6d25203a7325206b 6e696c6d79732065 7461657263206f74 2064656c69614600 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 4800051f5600054e 4b4c49485c560540 5144405746054a51 054140494c444600 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000251 000000302f716d00 32706f6f6c2f6b63 6f6c622f6c617574 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000041 000000000031326c 6c696b66722f3031 7968702f31313230 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 493b3a2632483b3a 264c4b3b3a264f4b 3b3a26494b3b3a26 3b3d3b3a263f3c3b ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 383a263e3e383a26 3c3b383a264f3a38 3a26493a383a2648 3a383a264b3a383a ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 223032363d4d0037 0036340000343632 363d455300313d4e 0030003500323600 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2230320000300030 0030200000303030 3030302d00310038 0022003500303600 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 3 CPU#3 RAX=0000000004208060 RBX=ffff88801cff4800 RCX=0000000000000000 RDX=0000000000000000 RSI=ffffffff8a40c075 RDI=ffff88801cff4818 RBP=ffff88801cff482c RSP=ffffc90006ee79b0 R8 =0000000000000007 R9 =7fffffffffffffff R10=7fffffffffffffff R11=0000000000000800 R12=ffffc90006ee79f8 R13=dffffc0000000000 R14=7fffffffffffffff R15=ffff88801cff4800 RIP=ffffffff8a3f6daa RFL=00000202 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff88802c900000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe00000d8000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe00000d6000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=000000002ef22000 CR3=000000005bb5a000 CR4=00350ee0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000fffe0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000052 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffffffffffff ffffffff0f0e0d0c ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000