)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a", 0x9, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100), 0x0, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:47 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) r5 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a", 0x9, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100), 0x0, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:47 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) r5 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100), 0x0, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:47 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a", 0x9, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a", 0x9, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:47 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r5 = openat$nci(0xffffff9c, 0x0, 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a4580", 0xd, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a", 0x9, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:47 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r5 = openat$nci(0xffffff9c, 0x0, 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a", 0x9, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:47 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a4580", 0xd, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r5 = openat$nci(0xffffff9c, 0x0, 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, 0x0) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a4580", 0xd, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:47 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a4580", 0xd, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, 0x0) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a4580", 0xd, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:47 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, 0x0) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de1", 0xf, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a4580", 0xd, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:47 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de1", 0xf, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de1", 0xf, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:47 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r5 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a4580", 0xd, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de1", 0xf, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:47 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r5 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a4580", 0xd, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:47 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a4580", 0xd, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:47 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r5 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a4580", 0xd, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a4580", 0xd, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a4580", 0xd, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, 0x0) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a4580", 0xd, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a4580", 0xd, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a4580", 0xd, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a4580", 0xd, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a4580", 0xd, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r5 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x0, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a4580", 0xd, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r5 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x0, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r5 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x0, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r5 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x0, 0x1fcf4d}) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r5 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x0, 0x1fcf4d}) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r0 = openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r5 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x0, 0x1fcf4d}) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r0 = openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r5 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24}) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r0 = openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r5 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r5 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, 0x0, 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, 0x0, 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, 0x0, 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r5 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r5, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r6, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r4, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r6}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r5, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r6, 0x0, 0xffffffffffffffff, 0x1}) r7 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r7, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r8, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r5 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r5, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r6, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r4, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r6}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r5, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r6, 0x0, 0xffffffffffffffff, 0x1}) r7 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r7, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r8, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r5 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r5, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r6, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r4, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r6}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r5, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r6, 0x0, 0xffffffffffffffff, 0x1}) r7 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r7, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r8, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, 0x0, 0x2, 0x0) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, 0x0, 0x2, 0x0) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, 0x0) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, 0x0, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r7 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r7, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r8, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 3: openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, 0x0, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, 0x0, 0x2, 0x0) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, 0x0) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, 0x0, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r7 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r7, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r8, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:48 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, 0x0) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, 0x0, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r7 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r7, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r8, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:48 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, 0x0) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, 0x0, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r7 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r7, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r8, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, 0x0) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, 0x0, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r7 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r7, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r8, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, 0x0, 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, 0x0, 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, 0x0, 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x0, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x0, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r5 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r5, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r6, 0x285f4, 0x8000, 0x1, 0x30a0}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) 08:33:49 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x0, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r5 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r5, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r6, 0x285f4, 0x8000, 0x1, 0x30a0}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, 0x0, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) r5 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r5, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r6, 0x285f4, 0x8000, 0x1, 0x30a0}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, 0x0, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, 0x0, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r4, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r3 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r3, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r4, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, 0x0, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r3 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r3, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) 08:33:49 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r4, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, 0x0, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r3 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r3, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) 08:33:49 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r4, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r3 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r3, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, 0x0, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r3 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r3, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x0, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r3 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r3, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x0, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x0, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x0, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x0, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x0, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x0, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x0, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x0, 0x1fcf4d}) 08:33:49 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x0, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x0, 0x1fcf4d}) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:49 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x0, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:49 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x0, 0x1fcf4d}) 08:33:49 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24}) 08:33:50 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x0, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r9 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r8, r9, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24}) 08:33:50 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x0, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r9 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r8, r9, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24}) 08:33:50 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r6, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r6}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r8 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r7, r8, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24}) 08:33:50 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r6, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r6}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r8 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r7, r8, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24}) 08:33:50 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r6, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r6}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r8 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r7, r8, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r3, 0x0, 0x30003, 0x0, 0x0, 0x357f24}) 08:33:50 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r9 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r8, r9, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r9 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r8, r9, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r3 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r3, 0x0) 08:33:50 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r9 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r8, r9, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r9 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r8, r9, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r9 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r8, r9, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r9 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r8, r9, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r9 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r8, r9, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 0: openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r5 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r5, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r7 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r6, r7, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 0: openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 0: openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r5 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r5, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r7 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r6, r7, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r6 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r5, r6, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 0: ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 0: ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r6 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r5, r6, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 0: ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r6 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r5, r6, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 0: r0 = openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r5 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r5, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r7 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r6, r7, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 0: r0 = openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r5 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r5, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r7 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r6, r7, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r4, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r1, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800d", 0xe, 0x9}) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 0: r0 = openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 0: r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r6 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r5, r6, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000000c0)={0xc}) r1 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_NET_SET_BACKEND(r1, 0x4008af30, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 0: r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r6 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r5, r6, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 0: r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r6 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r5, r6, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:50 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:50 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) r4 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r6 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r5, r6, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) r4 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r6 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r5, r6, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 1: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) r4 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r6 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r5, r6, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 1: r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r6 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r5, r6, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 1: r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r6 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r5, r6, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, 0x0) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 1: r0 = openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r6 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r5, r6, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, 0x0) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r6 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r5, r6, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 1: openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, 0x0) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r6 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r5, r6, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 1: openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, 0x0) openat$nci(0xffffff9c, 0x0, 0x2, 0x0) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 1: openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, 0x0) openat$nci(0xffffff9c, 0x0, 0x2, 0x0) 08:33:51 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r6 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r5, r6, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 1: openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, 0x0) openat$nci(0xffffff9c, 0x0, 0x2, 0x0) 08:33:51 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r6 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r5, r6, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(0x0, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(0x0, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r3, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r5 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r4, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(0x0, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r3, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r5 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r4, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r3, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r5 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r4, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r3, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r5 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r4, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc}) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r3, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r5 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r4, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r3, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r5 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r4, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r3, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r5 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r4, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) r2 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r3, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r5 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r4, r5, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, 0x0, 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, &(0x7f00000000c0)={0xc}) r1 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r1, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r2 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r2, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r3, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, &(0x7f00000000c0)={0xc}) r1 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r1, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r2 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r2, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r3, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, &(0x7f00000000c0)={0xc}) r1 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r1, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r2 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r2, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r4 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r3, r4, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 3: openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, &(0x7f00000000c0)={0xc}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r1 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r3 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r2, r3, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 3: openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, &(0x7f00000000c0)={0xc}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r1 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r3 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r2, r3, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 3: openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, &(0x7f00000000c0)={0xc}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r1 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r3 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r2, r3, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, 0x0, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), &(0x7f0000000780), {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, &(0x7f00000000c0)={0xc}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r1 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r3 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r2, r3, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, 0x0, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), &(0x7f0000000780), {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, &(0x7f00000000c0)={0xc}) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r1 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r3 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r2, r3, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), &(0x7f0000000780), {}, 0x0, 0x0, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:51 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, 0x0, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:51 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) r0 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r1 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r3 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r2, r3, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), &(0x7f0000000780), {}, 0x0, 0x0, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r5 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r5, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r6, 0x285f4, 0x8000, 0x1, 0x30a0}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) r0 = openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r1 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r3 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r2, r3, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), &(0x7f0000000780), {}, 0x0, 0x0, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) r0 = openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r1 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r3 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r2, r3, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), &(0x7f0000000780), {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), &(0x7f0000000780), {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, 0x0}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, 0x0, 0x0, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), &(0x7f0000000780), {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, 0x0}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, 0x0, 0x0, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), &(0x7f0000000780), {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, 0x0}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, 0x0, 0x0, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, 0x0) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580), 0x0, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), &(0x7f0000000780), {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, &(0x7f0000000880)=[0x0], 0x1}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x575200, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580), 0x0, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580), 0x0, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, &(0x7f00000003c0)={0x8}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), &(0x7f0000000780), {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, &(0x7f0000000880)=[0x0], 0x1}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{0x0}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{0x0}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), &(0x7f0000000780), {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, &(0x7f0000000880)=[0x0], 0x1}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r0, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), &(0x7f0000000780), {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, &(0x7f0000000880)=[0x0], 0x1}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:52 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{0x0}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:52 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r0, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc}) socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), &(0x7f0000000780), {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, &(0x7f0000000880)=[0x0], 0x1}, 0x58) openat$nci(0xffffff9c, 0x0, 0x2, 0x0) 08:33:53 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r0, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), &(0x7f0000000780), {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, &(0x7f0000000880)=[0x0], 0x1}, 0x58) openat$nci(0xffffff9c, 0x0, 0x2, 0x0) 08:33:53 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 0: openat$iommufd(0xffffff9c, 0x0, 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), &(0x7f0000000780), {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, &(0x7f0000000880)=[0x0], 0x1}, 0x58) openat$nci(0xffffff9c, 0x0, 0x2, 0x0) 08:33:53 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 0: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 1: openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x0) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 1: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 0: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x0) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 1: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(0x0, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 0: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 1: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(0x0, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x0) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 0: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) 08:33:53 executing program 1: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(0x0, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 1: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 0: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 0: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 1: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 0: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 0: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 1: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, 0x0, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 0: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, 0x0, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 1: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 0: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, 0x0, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 1: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 0: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(0x0, 0x0) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 0: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 1: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), 0x0, &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(0x0, 0x0) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(0x0, 0x0) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 0: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 1: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), 0x0, &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 0: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 0: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 1: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), 0x0, 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:53 executing program 1: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), 0x0, 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:53 executing program 0: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r2 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r1, r2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, 0x0) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 0: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:54 executing program 1: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), 0x0, 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 0: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) socket$can_raw(0x1d, 0x3, 0x1) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:54 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 1: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:54 executing program 0: socket$can_raw(0x1d, 0x3, 0x1) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 1: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), 0x0, 0x0, {}, 0x0, 0x0, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:54 executing program 0: socket$can_raw(0x1d, 0x3, 0x1) openat$nci(0xffffff9c, 0x0, 0x2, 0x0) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 0: socket$can_raw(0x1d, 0x3, 0x1) openat$nci(0xffffff9c, 0x0, 0x2, 0x0) 08:33:54 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 0: socket$can_raw(0x1d, 0x3, 0x1) openat$nci(0xffffff9c, 0x0, 0x2, 0x0) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 1: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:54 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x0, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 1: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:54 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x0, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 1: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) openat$nci(0xffffff9c, 0x0, 0x2, 0x0) 08:33:54 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x0, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 1: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) openat$nci(0xffffff9c, 0x0, 0x2, 0x0) 08:33:54 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x0, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 1: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) openat$nci(0xffffff9c, 0x0, 0x2, 0x0) 08:33:54 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x0, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 1: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x0, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x0, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 1: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x0, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {0xa}, 0x0, 0x0, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 0: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) openat$nci(0xffffff9c, 0x0, 0x2, 0x0) 08:33:54 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x0, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {0xa}, 0x0, 0x0, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 0: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) openat$nci(0xffffff9c, 0x0, 0x2, 0x0) 08:33:54 executing program 1: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {0xa}, 0x0, 0x0, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 0: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) openat$nci(0xffffff9c, 0x0, 0x2, 0x0) 08:33:54 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x0, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 1: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, 0x0, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 1: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:54 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 0: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, 0x0, 0x0}, 0x58) r1 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 1: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:54 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 0: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, 0x0, 0x0}, 0x58) r1 = openat$nci(0xffffff9c, 0x0, 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 1: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:54 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, 0x0, 0x0}, 0x58) r1 = openat$nci(0xffffff9c, 0x0, 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 1: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:54 executing program 0: syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, 0x0, 0x0}, 0x58) r1 = openat$nci(0xffffff9c, 0x0, 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 1: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:54 executing program 0: syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, 0x0, 0x0}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 1: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:54 executing program 1: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:54 executing program 0: syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, 0x0, 0x0}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, 0x0) 08:33:54 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:54 executing program 1: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:54 executing program 0: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(0x0, 0x0) 08:33:54 executing program 3: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_DESTROY$ioas(0xffffffffffffffff, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) recvmsg$can_raw(0xffffffffffffffff, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, 0x0, 0x0}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, 0x0) 08:33:54 executing program 0: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(0x0, 0x0) 08:33:54 executing program 1: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000200)) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:54 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 0: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(0x0, 0x0) 08:33:55 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 1: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:55 executing program 0: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 08:33:55 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x0, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 1: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) openat$vnet(0xffffff9c, 0x0, 0x2, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:55 executing program 0: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 08:33:55 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 1: ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, 0x0) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:55 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x0, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 1: syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:55 executing program 0: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 08:33:55 executing program 1: syz_clone3(0x0, 0x0) 08:33:55 executing program 0: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 08:33:55 executing program 3: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 08:33:55 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x0, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 1: syz_clone3(0x0, 0x0) 08:33:55 executing program 1: syz_clone3(0x0, 0x0) 08:33:55 executing program 3: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 08:33:55 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, 0x0, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 1: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:55 executing program 0: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 08:33:55 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, 0x0, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 3: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 08:33:55 executing program 1: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:55 executing program 0: socket$can_raw(0x1d, 0x3, 0x1) syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 08:33:55 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, 0x0, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r9, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 3: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 08:33:55 executing program 1: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:55 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 1: syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:55 executing program 3: syz_clone3(0x0, 0x0) 08:33:55 executing program 0: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 08:33:55 executing program 3: syz_clone3(0x0, 0x0) 08:33:55 executing program 1: syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:55 executing program 0: syz_clone3(0x0, 0x0) 08:33:55 executing program 3: syz_clone3(0x0, 0x0) 08:33:55 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 1: syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:55 executing program 0: syz_clone3(0x0, 0x0) 08:33:55 executing program 1: syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:55 executing program 0: syz_clone3(0x0, 0x0) 08:33:55 executing program 3: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 08:33:55 executing program 1: syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, 0x0}, 0x58) 08:33:55 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 0: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:55 executing program 1: syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, 0x0}, 0x58) 08:33:55 executing program 3: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 08:33:55 executing program 1: syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, 0x0}, 0x58) 08:33:55 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(0x0, 0x0) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 0: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:55 executing program 1: syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, &(0x7f0000000880)=[0x0], 0x1}, 0x58) 08:33:55 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(0x0, 0x0) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 1: syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, &(0x7f0000000880)}, 0x58) 08:33:55 executing program 3: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 08:33:55 executing program 1: syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, &(0x7f0000000880)}, 0x58) 08:33:55 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(0x0, 0x0) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 0: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:55 executing program 3: syz_clone3(0x0, 0x0) 08:33:55 executing program 1: syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, &(0x7f0000000880)}, 0x58) 08:33:55 executing program 3: syz_clone3(0x0, 0x0) 08:33:55 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(0x0, 0x0) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 0: syz_clone3(0x0, 0x0) 08:33:55 executing program 3: syz_clone3(0x0, 0x0) 08:33:55 executing program 0: syz_clone3(0x0, 0x0) 08:33:55 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 0: syz_clone3(0x0, 0x0) 08:33:55 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 0: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:55 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 0: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:55 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 1: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:55 executing program 0: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:55 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 0: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, &(0x7f0000000880)=[0x0, 0x0], 0x2}, 0x58) 08:33:55 executing program 0: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, 0x0}, 0x58) 08:33:55 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 0: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, 0x0}, 0x58) 08:33:55 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 0: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, 0x0}, 0x58) 08:33:55 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) 08:33:55 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, 0x0, &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, 0x0, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r10 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(0xffffffffffffffff, r10, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 0: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, &(0x7f0000000880)=[0x0], 0x1}, 0x58) 08:33:55 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) 08:33:55 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, 0x0, &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 0: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, &(0x7f0000000880)}, 0x58) 08:33:55 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) 08:33:55 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) 08:33:55 executing program 0: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, &(0x7f0000000880)}, 0x58) 08:33:55 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, 0x0, &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:55 executing program 0: syz_clone3(&(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, {}, &(0x7f00000007c0)=""/16, 0x10, 0x0, &(0x7f0000000880)}, 0x58) 08:33:55 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, 0x0, &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:56 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:56 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:56 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:56 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) 08:33:56 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:56 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:56 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) 08:33:56 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:56 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) 08:33:56 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:56 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) 08:33:56 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) 08:33:56 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:56 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:56 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) 08:33:56 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:56 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:56 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) 08:33:56 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:56 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) 08:33:56 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, 0x0, 0x0, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:56 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:56 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, 0x0, 0x0, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:56 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:56 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) 08:33:56 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:56 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, 0x0, 0x0, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:56 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:56 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) 08:33:56 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) 08:33:56 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, 0x0, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) 08:33:56 executing program 1: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) 08:33:56 executing program 0: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), 0x0, {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) 08:33:56 executing program 3: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) syz_clone3(&(0x7f00000008c0)={0x0, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, &(0x7f0000000800)=""/104, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) 08:33:56 executing program 2: r0 = openat$iommufd(0xffffff9c, &(0x7f0000000000), 0x501080, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000040)={0x38}) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r2, 0x0, &(0x7f0000000100)="7ed860cdaaa5f4fb0a2b0a45800de10d6b", 0x11, 0x9}) r3 = openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f00000001c0)={0x0, 0x2}) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000200)) openat$vnet(0xffffff9c, &(0x7f0000000240), 0x2, 0x0) r5 = openat$ipvs(0xffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) eventfd(0x800) r6 = openat$iommufd(0xffffff9c, &(0x7f00000002c0), 0x575200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r6, 0x3b83, &(0x7f0000000340)={0x28, 0x4, r2, r7, 0x285f4, 0x8000, 0x1, 0x30a0}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000380)) ioctl$IOMMU_DESTROY$ioas(r1, 0x3b80, &(0x7f00000003c0)={0x8, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000400)={0x38, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) r8 = openat$ipvs(0xffffff9c, &(0x7f0000000480)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) recvmsg$can_raw(r8, &(0x7f0000000600)={&(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000540)=""/42, 0x2a}], 0x1, &(0x7f00000005c0)=""/44, 0x2c}, 0x2000) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000640)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000680)={0x38, 0x7, r1, 0x0, 0x1, 0x0, 0x8, 0x267206, 0x41d51}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(0xffffffffffffffff, 0x3b87, &(0x7f00000006c0)={0x18, 0x1, 0x1, 0x0, r9, 0x40}) syz_clone3(&(0x7f00000008c0)={0x2010000, &(0x7f0000000700)=0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780), {0xa}, &(0x7f00000007c0)=""/16, 0x10, 0x0, &(0x7f0000000880)=[0x0, 0x0], 0x2, {r1}}, 0x58) r11 = openat$nci(0xffffff9c, &(0x7f0000000940), 0x2, 0x0) pidfd_getfd(r10, r11, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000980)={0x38, 0x7, r5, 0x0, 0x30003, 0x0, 0x0, 0x357f24, 0x1fcf4d}) [ 67.809325][T11471] ==================================================================