0000040)={0x20, 0x0, 0x100, 0x70bd2d, 0x25dfdbfd, {{}, {@void, @void}}, ["", "", "", "", "", "", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x24008050}, 0x40840) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) sendmsg$NL80211_CMD_GET_SURVEY(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x100, 0x70bd2d, 0x25dfdbfd, {{}, {@void, @void}}, ["", "", "", "", "", "", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x24008050}, 0x40840) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) 20:26:52 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_SCSI_ID(r0, 0x2276, 0x0) 20:26:52 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000efffffff00000001"], 0x1c}}, 0x0) 20:26:52 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:26:52 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async, rerun: 32) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x2c0800, 0x0) (rerun: 32) write$vga_arbiter(r1, 0x0, 0x0) (async, rerun: 64) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), r1) (rerun: 64) syz_open_dev$sg(&(0x7f0000000000), 0x82, 0x40) 20:26:52 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) sendmsg$NL80211_CMD_GET_SURVEY(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x100, 0x70bd2d, 0x25dfdbfd, {{}, {@void, @void}}, ["", "", "", "", "", "", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x24008050}, 0x40840) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) 20:26:52 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_SCSI_ID(r0, 0x2276, 0x0) 20:26:52 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x1, 0x1fbc40) bpf$LINK_DETACH(0x22, &(0x7f0000000040), 0x4) (async) syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), 0xffffffffffffffff) (async) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) (async) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f0000000000)=0x1) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:26:52 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000f0ffffff00000001"], 0x1c}}, 0x0) 20:26:52 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:26:52 executing program 2: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0xb, 0x652000) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000080), 0x108, 0x181100) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000001c0), 0x6000, 0x0) ioctl$EVIOCGBITKEY(r3, 0x80404521, &(0x7f0000000200)=""/154) ioctl$SG_GET_COMMAND_Q(r2, 0x1275, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f00000000c0)=ANY=[@ANYBLOB="9d000000e936b7656d71d99ecd6f05a2b2d73d00278bb6ee7d79848301588d9fe0097c6ccfc7f4550ed5dabd9e3f3cad3d1b031aaa4650eb6f4836bd04e52c44e4908459fd637a7ca9eb6b05d840b795d9a7b978b7aaec1cdf815a31b0a0603908d6a425ae10fc74b63b70c9b6cdc16d6715169219e3bc7c92fbdd1610b05e1f14c79c6bc25929184c0c2108be8294f7a53f919c1190fe2d579fb383e5ab9f12c6dfbbe1c6e7207d33685f7a48fee21ed894fa333ebd7eb0e259ae74cc6f610b34f5555f65ed149a8a052858c1929f668132f3633bca837c05fdb9b57823de0454645ab3957e367c40629a8d7e40d5e971ab353460"]) 20:26:52 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x2c0800, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), r1) (async) syz_open_dev$sg(&(0x7f0000000000), 0x82, 0x40) 20:26:52 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000001200000001"], 0x1c}}, 0x0) 20:26:52 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000000)=0x3b) 20:26:52 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000002"], 0x1c}}, 0x0) 20:26:52 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x800, 0x881) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:26:52 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async, rerun: 64) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (rerun: 64) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:26:52 executing program 2: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) syz_open_dev$sg(&(0x7f0000000000), 0xb, 0x652000) (async) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) (async) r1 = syz_open_dev$sg(&(0x7f0000000080), 0x108, 0x181100) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) (async) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000001c0), 0x6000, 0x0) ioctl$EVIOCGBITKEY(r3, 0x80404521, &(0x7f0000000200)=""/154) (async) ioctl$SG_GET_COMMAND_Q(r2, 0x1275, 0x0) (async) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f00000000c0)=ANY=[@ANYBLOB="9d000000e936b7656d71d99ecd6f05a2b2d73d00278bb6ee7d79848301588d9fe0097c6ccfc7f4550ed5dabd9e3f3cad3d1b031aaa4650eb6f4836bd04e52c44e4908459fd637a7ca9eb6b05d840b795d9a7b978b7aaec1cdf815a31b0a0603908d6a425ae10fc74b63b70c9b6cdc16d6715169219e3bc7c92fbdd1610b05e1f14c79c6bc25929184c0c2108be8294f7a53f919c1190fe2d579fb383e5ab9f12c6dfbbe1c6e7207d33685f7a48fee21ed894fa333ebd7eb0e259ae74cc6f610b34f5555f65ed149a8a052858c1929f668132f3633bca837c05fdb9b57823de0454645ab3957e367c40629a8d7e40d5e971ab353460"]) 20:26:52 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000080)={0xef, 0xfffffffb, 0x4, "36277a4b2d0d7cc2466f3f44752f1d7003625760f835a71e589f52b5c0f4a84e8a9e1d46dbc5514bfdb22a59857a4dfdebdb631c38d35acd2d753ba2ace18cd66f1567226f31e82ed3634cd2bae788164915a53b8792be94d920c2f5fb4550e38d8507600747fd96060f6a2b4ab2723a4acec4f05bd1262eb43f6d9bf43c9aee59395c20eb598e78ee3e4960c46b284e0a640064e6de4a7feb318fe04dbf2f7539e5628575840fd60f7e583cc3f8348a1932609fafc686c2a7c15eca72c5bd58b5f81a5d49f518655ed692dbb80a6a5a351a01a3dbe0acc059254f3006423e7368d9a2d562dacc3596f92194ecc084"}) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SCSI_IOCTL_SYNC(r1, 0x4) 20:26:52 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x800, 0x881) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x800, 0x881) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) 20:26:52 executing program 2: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) syz_open_dev$sg(&(0x7f0000000000), 0xb, 0x652000) (async) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) (async) r1 = syz_open_dev$sg(&(0x7f0000000080), 0x108, 0x181100) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) (async) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000001c0), 0x6000, 0x0) ioctl$EVIOCGBITKEY(r3, 0x80404521, &(0x7f0000000200)=""/154) (async) ioctl$SG_GET_COMMAND_Q(r2, 0x1275, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f00000000c0)=ANY=[@ANYBLOB="9d000000e936b7656d71d99ecd6f05a2b2d73d00278bb6ee7d79848301588d9fe0097c6ccfc7f4550ed5dabd9e3f3cad3d1b031aaa4650eb6f4836bd04e52c44e4908459fd637a7ca9eb6b05d840b795d9a7b978b7aaec1cdf815a31b0a0603908d6a425ae10fc74b63b70c9b6cdc16d6715169219e3bc7c92fbdd1610b05e1f14c79c6bc25929184c0c2108be8294f7a53f919c1190fe2d579fb383e5ab9f12c6dfbbe1c6e7207d33685f7a48fee21ed894fa333ebd7eb0e259ae74cc6f610b34f5555f65ed149a8a052858c1929f668132f3633bca837c05fdb9b57823de0454645ab3957e367c40629a8d7e40d5e971ab353460"]) 20:26:52 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000008"], 0x1c}}, 0x0) 20:26:52 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000000)=0x3b) 20:26:52 executing program 1: unshare(0x20040000) r0 = socket(0xa, 0x6, 0x0) unshare(0x44000000) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x29, 0x8, 0x0, 0x0) ioctl$EVIOCSABS20(0xffffffffffffffff, 0x401845e0, &(0x7f0000000000)={0x3, 0x20, 0x7f, 0x5, 0x6, 0x57}) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x1274, 0x0) 20:26:52 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x800, 0x881) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:26:52 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000000000000a"], 0x1c}}, 0x0) 20:26:52 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000002"], 0x1c}}, 0x0) [ 2104.277196][T28593] program syz-executor.3 is using a deprecated SCSI ioctl, please convert it to SG_IO 20:26:52 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000000)=0x3b) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000000)=0x3b) (async) 20:26:52 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) r1 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_TTY(r1, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x10}, 0x10}}, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) io_uring_setup(0x590b, &(0x7f0000000140)={0x0, 0x9e69, 0x4, 0x1, 0x161, 0x0, r2}) sendmsg$AUDIT_USER_AVC(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, 0x453, 0x400, 0x70bd29, 0x25dfdbfd, "ba8fd24313869b173d69e1eb195ddc5c701cf3ed", ["", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x24000880) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) syz_io_uring_setup(0x7021, &(0x7f0000000240)={0x0, 0x4f94, 0x0, 0x1, 0x129, 0x0, r3}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f00000002c0), &(0x7f0000000300)) 20:26:52 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x1000000000000, 0x290240) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r0, 0x2) 20:26:52 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) r1 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_TTY(r1, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x10}, 0x10}}, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) io_uring_setup(0x590b, &(0x7f0000000140)={0x0, 0x9e69, 0x4, 0x1, 0x161, 0x0, r2}) sendmsg$AUDIT_USER_AVC(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, 0x453, 0x400, 0x70bd29, 0x25dfdbfd, "ba8fd24313869b173d69e1eb195ddc5c701cf3ed", ["", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x24000880) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) syz_io_uring_setup(0x7021, &(0x7f0000000240)={0x0, 0x4f94, 0x0, 0x1, 0x129, 0x0, r3}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f00000002c0), &(0x7f0000000300)) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) socket$nl_audit(0x10, 0x3, 0x9) (async) sendmsg$AUDIT_USER_TTY(r1, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x10}, 0x10}}, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r2, 0x0, 0x0) (async) io_uring_setup(0x590b, &(0x7f0000000140)={0x0, 0x9e69, 0x4, 0x1, 0x161, 0x0, r2}) (async) sendmsg$AUDIT_USER_AVC(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, 0x453, 0x400, 0x70bd29, 0x25dfdbfd, "ba8fd24313869b173d69e1eb195ddc5c701cf3ed", ["", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x24000880) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r3, 0x0, 0x0) (async) syz_io_uring_setup(0x7021, &(0x7f0000000240)={0x0, 0x4f94, 0x0, 0x1, 0x129, 0x0, r3}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f00000002c0), &(0x7f0000000300)) (async) 20:26:52 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000010"], 0x1c}}, 0x0) 20:26:52 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000002"], 0x1c}}, 0x0) 20:26:52 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x1000000000000, 0x290240) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r0, 0x2) 20:26:52 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000025"], 0x1c}}, 0x0) [ 2104.360243][ T24] audit: type=1107 audit(1643228812.277:2602): pid=28616 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t msg='C=i]\p' 20:26:52 executing program 1: unshare(0x20040000) (async) r0 = socket(0xa, 0x6, 0x0) unshare(0x44000000) (async) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x29, 0x8, 0x0, 0x0) ioctl$EVIOCSABS20(0xffffffffffffffff, 0x401845e0, &(0x7f0000000000)={0x3, 0x20, 0x7f, 0x5, 0x6, 0x57}) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x1274, 0x0) 20:26:52 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x1000000000000, 0x290240) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r0, 0x2) syz_open_dev$sg(&(0x7f0000000380), 0x1000000000000, 0x290240) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r0, 0x2) (async) 20:26:52 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000064"], 0x1c}}, 0x0) [ 2104.424815][ T24] audit: type=1107 audit(1643228812.347:2603): pid=28627 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t msg='C=i]\p' 20:26:52 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000002"], 0x1c}}, 0x0) 20:26:52 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) r1 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_TTY(r1, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x10}, 0x10}}, 0x0) (async) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) io_uring_setup(0x590b, &(0x7f0000000140)={0x0, 0x9e69, 0x4, 0x1, 0x161, 0x0, r2}) sendmsg$AUDIT_USER_AVC(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, 0x453, 0x400, 0x70bd29, 0x25dfdbfd, "ba8fd24313869b173d69e1eb195ddc5c701cf3ed", ["", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x24000880) (async) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) syz_io_uring_setup(0x7021, &(0x7f0000000240)={0x0, 0x4f94, 0x0, 0x1, 0x129, 0x0, r3}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f00000002c0), &(0x7f0000000300)) 20:26:52 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x640, 0x0) write$vga_arbiter(r1, 0x0, 0x0) write$cgroup_int(r1, &(0x7f0000000080)=0x3d41, 0x12) ioctl$SG_SET_KEEP_ORPHAN(r1, 0x2287, &(0x7f0000000000)=0x2) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:26:52 executing program 5: r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r1, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000540)={&(0x7f00000000c0)={0x24, r2, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x36}]}, 0x24}}, 0x8054) sendmsg$NL80211_CMD_GET_SURVEY(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="1c000000f8090a7c2397534869791a45ea7eba4ea40870be938d7ba1aba7d2dfa1e3975c743fce84836a58af460b6f703a27a8bc4d67047d268858588b51ea61774bd72ac0bfdf6379e9fa30c41fd14fe7b2968e1922bf0bd732e54a6642ac81b1cb2b9c38eeee4b333bc6c0eae20a9cb686c052281efadd8e02ae454faa04c686eb2f4e2a7c6499e88e6a64c27a9088425ad44999af383a9f9ff2360bb0fd87d45ec95bea77", @ANYRES16=r2, @ANYBLOB="20002dbd7000fbdbdf253200000017ff0300", @ANYRESDEC=r2, @ANYBLOB="fb17e79276ed7963e5a3000004847388e067"], 0x1c}, 0x1, 0x0, 0x0, 0x50041}, 0x1) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r4, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r5, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r6, 0x201, 0x0, 0x0, {{}, {@val={0x1}, @void}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x36}]}, 0x24}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FLUSH_PMKSA(r4, &(0x7f0000000500)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000340)={0x1c, r6, 0x200, 0x70bd2a, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r7}, @void}}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x46) write$vga_arbiter(r3, 0x0, 0x0) r8 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0xa4000, 0x0) r9 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000200)={&(0x7f00000001c0)='./file0\x00', 0x0, 0x10}, 0x10) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000240)={r3, r8, 0x0, r9}, 0x10) r10 = syz_open_dev$sg(&(0x7f0000000380), 0x1, 0x70bdc0) ioctl$SG_GET_COMMAND_Q(r10, 0x1267, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000280), r0) 20:26:52 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000007ffffff2"], 0x1c}}, 0x0) 20:26:52 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16, @ANYBLOB="0100000000000000000002"], 0x1c}}, 0x0) 20:26:52 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x640, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) write$cgroup_int(r1, &(0x7f0000000080)=0x3d41, 0x12) (async) ioctl$SG_SET_KEEP_ORPHAN(r1, 0x2287, &(0x7f0000000000)=0x2) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:26:52 executing program 2: openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/attr/sockcreate\x00', 0x2, 0x0) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x800, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_PMKSA(r1, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x50, 0x0, 0x2, 0x70bd25, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x200, 0x15}}}}, [@NL80211_ATTR_SSID={0xa, 0x34, @random="ba0aedc37fdb"}, @NL80211_ATTR_FILS_CACHE_ID={0x6, 0xfd, 0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @random="75ff29b79423"}, @NL80211_ATTR_FILS_CACHE_ID={0x6, 0xfd, 0xff}]}, 0x50}, 0x1, 0x0, 0x0, 0x4005}, 0x4) 20:26:52 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000007ffffff8"], 0x1c}}, 0x0) 20:26:52 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000007ffffff9"], 0x1c}}, 0x0) 20:26:52 executing program 1: unshare(0x20040000) r0 = socket(0xa, 0x6, 0x0) unshare(0x44000000) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x29, 0x8, 0x0, 0x0) ioctl$EVIOCSABS20(0xffffffffffffffff, 0x401845e0, &(0x7f0000000000)={0x3, 0x20, 0x7f, 0x5, 0x6, 0x57}) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x1274, 0x0) unshare(0x20040000) (async) socket(0xa, 0x6, 0x0) (async) unshare(0x44000000) (async) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x29, 0x8, 0x0, 0x0) (async) ioctl$EVIOCSABS20(0xffffffffffffffff, 0x401845e0, &(0x7f0000000000)={0x3, 0x20, 0x7f, 0x5, 0x6, 0x57}) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r1, 0x1274, 0x0) (async) 20:26:52 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16, @ANYBLOB="0100000000000000000002"], 0x1c}}, 0x0) 20:26:52 executing program 2: openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/attr/sockcreate\x00', 0x2, 0x0) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x800, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_PMKSA(r1, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x50, 0x0, 0x2, 0x70bd25, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x200, 0x15}}}}, [@NL80211_ATTR_SSID={0xa, 0x34, @random="ba0aedc37fdb"}, @NL80211_ATTR_FILS_CACHE_ID={0x6, 0xfd, 0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @random="75ff29b79423"}, @NL80211_ATTR_FILS_CACHE_ID={0x6, 0xfd, 0xff}]}, 0x50}, 0x1, 0x0, 0x0, 0x4005}, 0x4) openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/attr/sockcreate\x00', 0x2, 0x0) (async) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x800, 0x0) (async) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000), r1) (async) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan0\x00'}) (async) sendmsg$NL80211_CMD_SET_PMKSA(r1, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x50, 0x0, 0x2, 0x70bd25, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x200, 0x15}}}}, [@NL80211_ATTR_SSID={0xa, 0x34, @random="ba0aedc37fdb"}, @NL80211_ATTR_FILS_CACHE_ID={0x6, 0xfd, 0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @random="75ff29b79423"}, @NL80211_ATTR_FILS_CACHE_ID={0x6, 0xfd, 0xff}]}, 0x50}, 0x1, 0x0, 0x0, 0x4005}, 0x4) (async) 20:26:52 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x640, 0x0) write$vga_arbiter(r1, 0x0, 0x0) write$cgroup_int(r1, &(0x7f0000000080)=0x3d41, 0x12) ioctl$SG_SET_KEEP_ORPHAN(r1, 0x2287, &(0x7f0000000000)=0x2) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x640, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) write$cgroup_int(r1, &(0x7f0000000080)=0x3d41, 0x12) (async) ioctl$SG_SET_KEEP_ORPHAN(r1, 0x2287, &(0x7f0000000000)=0x2) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) 20:26:52 executing program 5: r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r1, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000540)={&(0x7f00000000c0)={0x24, r2, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x36}]}, 0x24}}, 0x8054) (async, rerun: 32) sendmsg$NL80211_CMD_GET_SURVEY(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="1c000000f8090a7c2397534869791a45ea7eba4ea40870be938d7ba1aba7d2dfa1e3975c743fce84836a58af460b6f703a27a8bc4d67047d268858588b51ea61774bd72ac0bfdf6379e9fa30c41fd14fe7b2968e1922bf0bd732e54a6642ac81b1cb2b9c38eeee4b333bc6c0eae20a9cb686c052281efadd8e02ae454faa04c686eb2f4e2a7c6499e88e6a64c27a9088425ad44999af383a9f9ff2360bb0fd87d45ec95bea77", @ANYRES16=r2, @ANYBLOB="20002dbd7000fbdbdf253200000017ff0300", @ANYRESDEC=r2, @ANYBLOB="fb17e79276ed7963e5a3000004847388e067"], 0x1c}, 0x1, 0x0, 0x0, 0x50041}, 0x1) (async, rerun: 32) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r4, 0x0, 0x0) (async, rerun: 64) r5 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r5, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r6, 0x201, 0x0, 0x0, {{}, {@val={0x1}, @void}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x36}]}, 0x24}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FLUSH_PMKSA(r4, &(0x7f0000000500)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000340)={0x1c, r6, 0x200, 0x70bd2a, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r7}, @void}}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x46) (async) write$vga_arbiter(r3, 0x0, 0x0) (async) r8 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0xa4000, 0x0) (async, rerun: 64) r9 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000200)={&(0x7f00000001c0)='./file0\x00', 0x0, 0x10}, 0x10) (rerun: 64) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000240)={r3, r8, 0x0, r9}, 0x10) (async) r10 = syz_open_dev$sg(&(0x7f0000000380), 0x1, 0x70bdc0) ioctl$SG_GET_COMMAND_Q(r10, 0x1267, 0x0) (async, rerun: 64) syz_genetlink_get_family_id$tipc(&(0x7f0000000280), r0) (rerun: 64) 20:26:52 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16, @ANYBLOB="0100000000000000000002"], 0x1c}}, 0x0) 20:26:52 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000007fffffff"], 0x1c}}, 0x0) 20:26:52 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000000)=0x2d) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f0000000040)=0x1) 20:26:52 executing program 2: openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/attr/sockcreate\x00', 0x2, 0x0) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x800, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_PMKSA(r1, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x50, 0x0, 0x2, 0x70bd25, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x200, 0x15}}}}, [@NL80211_ATTR_SSID={0xa, 0x34, @random="ba0aedc37fdb"}, @NL80211_ATTR_FILS_CACHE_ID={0x6, 0xfd, 0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @random="75ff29b79423"}, @NL80211_ATTR_FILS_CACHE_ID={0x6, 0xfd, 0xff}]}, 0x50}, 0x1, 0x0, 0x0, 0x4005}, 0x4) 20:26:52 executing program 3: r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r0, @ANYBLOB="0100000000000000000002"], 0x1c}}, 0x0) 20:26:52 executing program 3: r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r0, @ANYBLOB="0100000000000000000002"], 0x1c}}, 0x0) 20:26:52 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x400200) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:26:52 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000000)=0x2d) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f0000000040)=0x1) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000000)=0x2d) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f0000000040)=0x1) (async) 20:26:52 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) ioctl$SG_EMULATED_HOST(r0, 0x2203, &(0x7f0000000000)) 20:26:52 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000000ffffffff"], 0x1c}}, 0x0) 20:26:52 executing program 3: r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r0, @ANYBLOB="0100000000000000000002"], 0x1c}}, 0x0) 20:26:52 executing program 5: r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r1, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000540)={&(0x7f00000000c0)={0x24, r2, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x36}]}, 0x24}}, 0x8054) (async) sendmsg$NL80211_CMD_GET_SURVEY(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="1c000000f8090a7c2397534869791a45ea7eba4ea40870be938d7ba1aba7d2dfa1e3975c743fce84836a58af460b6f703a27a8bc4d67047d268858588b51ea61774bd72ac0bfdf6379e9fa30c41fd14fe7b2968e1922bf0bd732e54a6642ac81b1cb2b9c38eeee4b333bc6c0eae20a9cb686c052281efadd8e02ae454faa04c686eb2f4e2a7c6499e88e6a64c27a9088425ad44999af383a9f9ff2360bb0fd87d45ec95bea77", @ANYRES16=r2, @ANYBLOB="20002dbd7000fbdbdf253200000017ff0300", @ANYRESDEC=r2, @ANYBLOB="fb17e79276ed7963e5a3000004847388e067"], 0x1c}, 0x1, 0x0, 0x0, 0x50041}, 0x1) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async, rerun: 64) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (rerun: 64) write$vga_arbiter(r4, 0x0, 0x0) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (rerun: 32) sendmsg$NL80211_CMD_RADAR_DETECT(r5, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r6, 0x201, 0x0, 0x0, {{}, {@val={0x1}, @void}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x36}]}, 0x24}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FLUSH_PMKSA(r4, &(0x7f0000000500)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000340)={0x1c, r6, 0x200, 0x70bd2a, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r7}, @void}}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x46) (async) write$vga_arbiter(r3, 0x0, 0x0) (async) r8 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0xa4000, 0x0) (async) r9 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000200)={&(0x7f00000001c0)='./file0\x00', 0x0, 0x10}, 0x10) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000240)={r3, r8, 0x0, r9}, 0x10) (async, rerun: 32) r10 = syz_open_dev$sg(&(0x7f0000000380), 0x1, 0x70bdc0) (rerun: 32) ioctl$SG_GET_COMMAND_Q(r10, 0x1267, 0x0) (async, rerun: 64) syz_genetlink_get_family_id$tipc(&(0x7f0000000280), r0) (rerun: 64) 20:26:52 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000002"], 0x1c}}, 0x0) 20:26:52 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) ioctl$SG_EMULATED_HOST(r0, 0x2203, &(0x7f0000000000)) 20:26:52 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000000)=0x2d) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f0000000040)=0x1) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000000)=0x2d) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f0000000040)=0x1) (async) 20:26:52 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000002000000000001"], 0x1c}}, 0x0) 20:26:52 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000002"], 0x1c}}, 0x0) 20:26:52 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x1000, 0x12041) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x541001, 0x0) ioctl$SG_NEXT_CMD_LEN(r1, 0x2283, &(0x7f0000000040)=0x6b) 20:26:52 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x400200) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:26:52 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) ioctl$SG_EMULATED_HOST(r0, 0x2203, &(0x7f0000000000)) 20:26:52 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000002"], 0x1c}}, 0x0) 20:26:52 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x1000, 0x12041) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x541001, 0x0) ioctl$SG_NEXT_CMD_LEN(r1, 0x2283, &(0x7f0000000040)=0x6b) 20:26:52 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x5, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f00000003c0)=ANY=[@ANYBLOB="a20000000900000005000000ad56dbf09d350d9c28fe3a9c87be3d2800c9759a2aac104869be70d975ad20c078f416d7552e58f3236b980dadc71e86bc9c75844d23de53b8d6a2e98c39d2f1a74e0af5c6c61416eda2b099287e736f6096f02ab65b1b906991b81f1a023dbe90fc350b500bfe03cef055205ac2161b0f324a14a82207bd05ee3d427daa8e114d524ea95df7aba759100b11ad0a42a320d1f4eeb1f9f885d98761e7cfcc744e2e4e6d655d1d65e747daf09a53a5e77f4b9fd1b9a592e2e1e4a6fa77eb7e98262fc8819400000000dce2da92c6557670ea301360a47b192e686b53b84aa080f524038cfddef874ffbd0a8469c77f5a4851930b486b37622f8697f70fd7fe1b15494e99278889c25a3a7cfe7c4f2035df61406c796aef00323feecddd563f81b975e963fd9a1f2c3cbbdb71f14168326fd0756e203b09d5e1ce905d0164160f8bd74c16754c63d81ed93ded834ec7e2a4"]) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000000)=0x4) 20:26:52 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x46240) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:26:52 executing program 3: socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r0, @ANYBLOB="0100000000000000000002"], 0x1c}}, 0x0) 20:26:52 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x400200) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x400200) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) 20:26:52 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000003000000000001"], 0x1c}}, 0x0) 20:26:52 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x1000, 0x12041) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async, rerun: 64) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x541001, 0x0) (rerun: 64) ioctl$SG_NEXT_CMD_LEN(r1, 0x2283, &(0x7f0000000040)=0x6b) 20:26:52 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x5, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f00000003c0)=ANY=[@ANYBLOB="a20000000900000005000000ad56dbf09d350d9c28fe3a9c87be3d2800c9759a2aac104869be70d975ad20c078f416d7552e58f3236b980dadc71e86bc9c75844d23de53b8d6a2e98c39d2f1a74e0af5c6c61416eda2b099287e736f6096f02ab65b1b906991b81f1a023dbe90fc350b500bfe03cef055205ac2161b0f324a14a82207bd05ee3d427daa8e114d524ea95df7aba759100b11ad0a42a320d1f4eeb1f9f885d98761e7cfcc744e2e4e6d655d1d65e747daf09a53a5e77f4b9fd1b9a592e2e1e4a6fa77eb7e98262fc8819400000000dce2da92c6557670ea301360a47b192e686b53b84aa080f524038cfddef874ffbd0a8469c77f5a4851930b486b37622f8697f70fd7fe1b15494e99278889c25a3a7cfe7c4f2035df61406c796aef00323feecddd563f81b975e963fd9a1f2c3cbbdb71f14168326fd0756e203b09d5e1ce905d0164160f8bd74c16754c63d81ed93ded834ec7e2a4"]) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000000)=0x4) 20:26:52 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000004000000000001"], 0x1c}}, 0x0) 20:26:52 executing program 1: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x282140, 0x0) syz_open_dev$sg(&(0x7f00000000c0), 0x4, 0x101040) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:26:52 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x5, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f00000003c0)=ANY=[@ANYBLOB="a20000000900000005000000ad56dbf09d350d9c28fe3a9c87be3d2800c9759a2aac104869be70d975ad20c078f416d7552e58f3236b980dadc71e86bc9c75844d23de53b8d6a2e98c39d2f1a74e0af5c6c61416eda2b099287e736f6096f02ab65b1b906991b81f1a023dbe90fc350b500bfe03cef055205ac2161b0f324a14a82207bd05ee3d427daa8e114d524ea95df7aba759100b11ad0a42a320d1f4eeb1f9f885d98761e7cfcc744e2e4e6d655d1d65e747daf09a53a5e77f4b9fd1b9a592e2e1e4a6fa77eb7e98262fc8819400000000dce2da92c6557670ea301360a47b192e686b53b84aa080f524038cfddef874ffbd0a8469c77f5a4851930b486b37622f8697f70fd7fe1b15494e99278889c25a3a7cfe7c4f2035df61406c796aef00323feecddd563f81b975e963fd9a1f2c3cbbdb71f14168326fd0756e203b09d5e1ce905d0164160f8bd74c16754c63d81ed93ded834ec7e2a4"]) (async) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000000)=0x4) 20:26:52 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x46240) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x46240) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) 20:26:52 executing program 3: socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r0, @ANYBLOB="0100000000000000000002"], 0x1c}}, 0x0) 20:26:52 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x800) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000000)) 20:26:52 executing program 1: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x282140, 0x0) syz_open_dev$sg(&(0x7f00000000c0), 0x4, 0x101040) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r0, 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x282140, 0x0) (async) syz_open_dev$sg(&(0x7f00000000c0), 0x4, 0x101040) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) 20:26:52 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000005000000000001"], 0x1c}}, 0x0) 20:26:52 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x46240) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:26:52 executing program 1: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) (async, rerun: 64) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (rerun: 64) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x282140, 0x0) (async) syz_open_dev$sg(&(0x7f00000000c0), 0x4, 0x101040) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:26:52 executing program 3: socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r0, @ANYBLOB="0100000000000000000002"], 0x1c}}, 0x0) 20:26:52 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0xfffffffffffffffc, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) 20:26:52 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x800) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000000)) 20:26:52 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x6b9d, 0xd946349e020256c4) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SCSI_IOCTL_SYNC(r1, 0x4) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:26:52 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0xfffffffffffffffc, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) 20:26:52 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, 0x0, 0x0) 20:26:52 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000006000000000001"], 0x1c}}, 0x0) 20:26:52 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x800) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async, rerun: 32) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000000)) (rerun: 32) 20:26:52 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x6b9d, 0xd946349e020256c4) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_SYNC(r1, 0x4) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:26:52 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000007000000000001"], 0x1c}}, 0x0) 20:26:52 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x8, 0x20c1) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:26:52 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, 0x0, 0x0) 20:26:52 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0xfffffffffffffffc, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0xfffffffffffffffc, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) 20:26:52 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, 0x0, 0x0) 20:26:52 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x8, 0x20c1) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x8, 0x20c1) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) 20:26:53 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000008000000000001"], 0x1c}}, 0x0) 20:26:53 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x6b9d, 0xd946349e020256c4) (async, rerun: 32) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (rerun: 32) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_SYNC(r1, 0x4) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:26:53 executing program 2: ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x1275, 0x0) 20:26:53 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x8, 0x20c1) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x8, 0x20c1) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) 20:26:53 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) 20:26:53 executing program 2: ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x1275, 0x0) 20:26:53 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000009000000000001"], 0x1c}}, 0x0) 20:26:53 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000100), 0x7e, 0x200002) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000040)=""/127) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000000)) 20:26:53 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000000)=0x1) 20:26:53 executing program 2: ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x1275, 0x0) ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x1275, 0x0) (async) 20:26:53 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) 20:26:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000000)) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x14) sendmsg$WG_CMD_GET_DEVICE(r1, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x5c, 0x0, 0x10, 0x70bd27, 0x25dfdbff, {}, [@WGDEVICE_A_PRIVATE_KEY={0x24, 0x3, @b}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x7}, @WGDEVICE_A_IFINDEX={0x8, 0x1, r2}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg2\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20000801}, 0x40801) r3 = bpf$ITER_CREATE(0x21, &(0x7f0000000240)={r1}, 0x8) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f00000002c0)={'wg1\x00', 0x0}) sendmsg$ETHTOOL_MSG_RINGS_SET(r3, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000300)={&(0x7f00000003c0)={0xa4, 0x0, 0x100, 0x70bd2d, 0x25dfdbfd, {}, [@ETHTOOL_A_RINGS_RX_MINI={0x8, 0x7, 0xd1}, @ETHTOOL_A_RINGS_RX_MINI={0x8, 0x7, 0x6}, @ETHTOOL_A_RINGS_HEADER={0x54, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'tunl0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'gre0\x00'}]}, @ETHTOOL_A_RINGS_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @ETHTOOL_A_RINGS_TX={0x8, 0x9, 0xc9e}, @ETHTOOL_A_RINGS_TX={0x8, 0x9, 0x4}, @ETHTOOL_A_RINGS_RX_MINI={0x8, 0x7, 0x7}, @ETHTOOL_A_RINGS_RX_JUMBO={0x8, 0x8, 0x614d}]}, 0xa4}, 0x1, 0x0, 0x0, 0x1}, 0x800) 20:26:53 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) (async) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000000)=0x1) 20:26:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000000)) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x14) sendmsg$WG_CMD_GET_DEVICE(r1, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x5c, 0x0, 0x10, 0x70bd27, 0x25dfdbff, {}, [@WGDEVICE_A_PRIVATE_KEY={0x24, 0x3, @b}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x7}, @WGDEVICE_A_IFINDEX={0x8, 0x1, r2}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg2\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20000801}, 0x40801) r3 = bpf$ITER_CREATE(0x21, &(0x7f0000000240)={r1}, 0x8) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f00000002c0)={'wg1\x00', 0x0}) sendmsg$ETHTOOL_MSG_RINGS_SET(r3, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000300)={&(0x7f00000003c0)={0xa4, 0x0, 0x100, 0x70bd2d, 0x25dfdbfd, {}, [@ETHTOOL_A_RINGS_RX_MINI={0x8, 0x7, 0xd1}, @ETHTOOL_A_RINGS_RX_MINI={0x8, 0x7, 0x6}, @ETHTOOL_A_RINGS_HEADER={0x54, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'tunl0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'gre0\x00'}]}, @ETHTOOL_A_RINGS_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @ETHTOOL_A_RINGS_TX={0x8, 0x9, 0xc9e}, @ETHTOOL_A_RINGS_TX={0x8, 0x9, 0x4}, @ETHTOOL_A_RINGS_RX_MINI={0x8, 0x7, 0x7}, @ETHTOOL_A_RINGS_RX_JUMBO={0x8, 0x8, 0x614d}]}, 0xa4}, 0x1, 0x0, 0x0, 0x1}, 0x800) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000000)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x14) (async) sendmsg$WG_CMD_GET_DEVICE(r1, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x5c, 0x0, 0x10, 0x70bd27, 0x25dfdbff, {}, [@WGDEVICE_A_PRIVATE_KEY={0x24, 0x3, @b}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x7}, @WGDEVICE_A_IFINDEX={0x8, 0x1, r2}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg2\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20000801}, 0x40801) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000240)={r1}, 0x8) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f00000002c0)={'wg1\x00'}) (async) sendmsg$ETHTOOL_MSG_RINGS_SET(r3, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000300)={&(0x7f00000003c0)={0xa4, 0x0, 0x100, 0x70bd2d, 0x25dfdbfd, {}, [@ETHTOOL_A_RINGS_RX_MINI={0x8, 0x7, 0xd1}, @ETHTOOL_A_RINGS_RX_MINI={0x8, 0x7, 0x6}, @ETHTOOL_A_RINGS_HEADER={0x54, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'tunl0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'gre0\x00'}]}, @ETHTOOL_A_RINGS_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @ETHTOOL_A_RINGS_TX={0x8, 0x9, 0xc9e}, @ETHTOOL_A_RINGS_TX={0x8, 0x9, 0x4}, @ETHTOOL_A_RINGS_RX_MINI={0x8, 0x7, 0x7}, @ETHTOOL_A_RINGS_RX_JUMBO={0x8, 0x8, 0x614d}]}, 0xa4}, 0x1, 0x0, 0x0, 0x1}, 0x800) (async) 20:26:53 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000100), 0x7e, 0x200002) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000040)=""/127) (async) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000000)) 20:26:53 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(0xffffffffffffffff, 0x2) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x1275, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) 20:26:53 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000a000000000001"], 0x1c}}, 0x0) 20:26:53 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000100), 0x7e, 0x200002) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000040)=""/127) (async) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async, rerun: 32) ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000000)) (rerun: 32) 20:26:53 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) 20:26:53 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000000)=0x1) 20:26:53 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SCSI_IOCTL_TEST_UNIT_READY(0xffffffffffffffff, 0x2) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x1275, 0x0) (async) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) 20:26:53 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000b000000000001"], 0x1c}}, 0x0) 20:26:53 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x1c}}, 0x0) 20:26:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000000)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x14) sendmsg$WG_CMD_GET_DEVICE(r1, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x5c, 0x0, 0x10, 0x70bd27, 0x25dfdbff, {}, [@WGDEVICE_A_PRIVATE_KEY={0x24, 0x3, @b}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x7}, @WGDEVICE_A_IFINDEX={0x8, 0x1, r2}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg2\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20000801}, 0x40801) (async) r3 = bpf$ITER_CREATE(0x21, &(0x7f0000000240)={r1}, 0x8) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f00000002c0)={'wg1\x00', 0x0}) sendmsg$ETHTOOL_MSG_RINGS_SET(r3, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000300)={&(0x7f00000003c0)={0xa4, 0x0, 0x100, 0x70bd2d, 0x25dfdbfd, {}, [@ETHTOOL_A_RINGS_RX_MINI={0x8, 0x7, 0xd1}, @ETHTOOL_A_RINGS_RX_MINI={0x8, 0x7, 0x6}, @ETHTOOL_A_RINGS_HEADER={0x54, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'tunl0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'gre0\x00'}]}, @ETHTOOL_A_RINGS_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @ETHTOOL_A_RINGS_TX={0x8, 0x9, 0xc9e}, @ETHTOOL_A_RINGS_TX={0x8, 0x9, 0x4}, @ETHTOOL_A_RINGS_RX_MINI={0x8, 0x7, 0x7}, @ETHTOOL_A_RINGS_RX_JUMBO={0x8, 0x8, 0x614d}]}, 0xa4}, 0x1, 0x0, 0x0, 0x1}, 0x800) 20:26:53 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f00000001c0), 0x993, 0xc000) ioctl$SG_NEXT_CMD_LEN(r1, 0x2283, &(0x7f0000000200)=0x5) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) ioctl$SG_GET_REQUEST_TABLE(r2, 0x2286, &(0x7f0000000040)) 20:26:53 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r1, 0x2) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000000)) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) ioctl$IMGETDEVINFO(r2, 0x80044944, &(0x7f0000000080)={0x5687}) 20:26:53 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SCSI_IOCTL_TEST_UNIT_READY(0xffffffffffffffff, 0x2) (async, rerun: 64) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) (rerun: 64) ioctl$SG_GET_COMMAND_Q(r1, 0x1275, 0x0) (async, rerun: 64) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) (rerun: 64) 20:26:53 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x1c}}, 0x0) 20:26:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x1, 0xe0803) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f0000000040)=0x5) 20:26:53 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000c000000000001"], 0x1c}}, 0x0) 20:26:53 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r1, 0x2) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000000)) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) ioctl$IMGETDEVINFO(r2, 0x80044944, &(0x7f0000000080)={0x5687}) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r2, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r1, 0x2) (async) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000000)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) ioctl$IMGETDEVINFO(r2, 0x80044944, &(0x7f0000000080)={0x5687}) (async) 20:26:53 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f00000001c0), 0x993, 0xc000) ioctl$SG_NEXT_CMD_LEN(r1, 0x2283, &(0x7f0000000200)=0x5) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) ioctl$SG_GET_REQUEST_TABLE(r2, 0x2286, &(0x7f0000000040)) 20:26:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x1, 0xe0803) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f0000000040)=0x5) 20:26:53 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) sendmsg$IPVS_CMD_NEW_SERVICE(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x8c, 0x0, 0x400, 0x70bd28, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xffff}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x7}, @IPVS_CMD_ATTR_DEST={0x28, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0xa}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@loopback}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x4}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x10000}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}]}]}, 0x8c}, 0x1, 0x0, 0x0, 0x4000}, 0x41) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) 20:26:53 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x1c}}, 0x0) 20:26:53 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000d000000000001"], 0x1c}}, 0x0) 20:26:53 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) r1 = syz_open_dev$sg(&(0x7f00000001c0), 0x993, 0xc000) ioctl$SG_NEXT_CMD_LEN(r1, 0x2283, &(0x7f0000000200)=0x5) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) ioctl$SG_GET_REQUEST_TABLE(r2, 0x2286, &(0x7f0000000040)) 20:26:53 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r1, 0x2) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000000)) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) ioctl$IMGETDEVINFO(r2, 0x80044944, &(0x7f0000000080)={0x5687}) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r2, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r1, 0x2) (async) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000000)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) ioctl$IMGETDEVINFO(r2, 0x80044944, &(0x7f0000000080)={0x5687}) (async) 20:26:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x1, 0xe0803) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f0000000040)=0x5) 20:26:53 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1], 0x1c}}, 0x0) 20:26:53 executing program 5: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)={0x1000420800000}) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000000)={r0}, 0x8) r2 = getpid() ioctl$BINDER_GET_FROZEN_INFO(r1, 0xc00c620f, &(0x7f00000000c0)={r2}) r3 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r3, 0x1267, 0x0) 20:26:53 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000e000000000001"], 0x1c}}, 0x0) 20:26:53 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) sendmsg$IPVS_CMD_NEW_SERVICE(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x8c, 0x0, 0x400, 0x70bd28, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xffff}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x7}, @IPVS_CMD_ATTR_DEST={0x28, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0xa}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@loopback}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x4}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x10000}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}]}]}, 0x8c}, 0x1, 0x0, 0x0, 0x4000}, 0x41) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) (async) sendmsg$IPVS_CMD_NEW_SERVICE(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x8c, 0x0, 0x400, 0x70bd28, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xffff}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x7}, @IPVS_CMD_ATTR_DEST={0x28, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0xa}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@loopback}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x4}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x10000}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}]}]}, 0x8c}, 0x1, 0x0, 0x0, 0x4000}, 0x41) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) 20:26:53 executing program 1: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x90801) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:26:53 executing program 0: mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x6) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0xf5, 0x0, &(0x7f0000000040)="639cdf3423c36b4159f908333aa572021b9603e38a64c7f1f54911ace43d8f0e11d1a832a79d3f2714b4d661bd6f8ac1c9d96e0a828eec2801f9e14e9e290bf2b7728ab4b8dd7f17f71e4457566fcd8d5083c931b5402ca0239372bc0259858bc6337e329ef73b8a7525b1189e64e956d611d30d822963cc5f82b3971d2b1989392c3ff6f08ab6ffb7d8b96a6962cfecd6401d47cbd637cc0f9207ce43588c645e1d5fd3b32f02e106ea0200743d2786f9148ce0351092489e2987c96e2f10b00b5b3a3ce0ea6a9a72a76aca0a4ca0c39224fd5a7033b962178d1c1b11643df17d4811496f5474cd501b50cdd3ccfe459a608908b8"}) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) 20:26:53 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1], 0x1c}}, 0x0) 20:26:53 executing program 0: mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x6) (async) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0xf5, 0x0, &(0x7f0000000040)="639cdf3423c36b4159f908333aa572021b9603e38a64c7f1f54911ace43d8f0e11d1a832a79d3f2714b4d661bd6f8ac1c9d96e0a828eec2801f9e14e9e290bf2b7728ab4b8dd7f17f71e4457566fcd8d5083c931b5402ca0239372bc0259858bc6337e329ef73b8a7525b1189e64e956d611d30d822963cc5f82b3971d2b1989392c3ff6f08ab6ffb7d8b96a6962cfecd6401d47cbd637cc0f9207ce43588c645e1d5fd3b32f02e106ea0200743d2786f9148ce0351092489e2987c96e2f10b00b5b3a3ce0ea6a9a72a76aca0a4ca0c39224fd5a7033b962178d1c1b11643df17d4811496f5474cd501b50cdd3ccfe459a608908b8"}) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) 20:26:53 executing program 5: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) (async) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)={0x1000420800000}) (async) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000000)={r0}, 0x8) r2 = getpid() ioctl$BINDER_GET_FROZEN_INFO(r1, 0xc00c620f, &(0x7f00000000c0)={r2}) (async, rerun: 64) r3 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (rerun: 64) ioctl$SG_GET_COMMAND_Q(r3, 0x1267, 0x0) 20:26:53 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000f000000000001"], 0x1c}}, 0x0) 20:26:53 executing program 1: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x90801) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:26:53 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) sendmsg$IPVS_CMD_NEW_SERVICE(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x8c, 0x0, 0x400, 0x70bd28, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xffff}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x7}, @IPVS_CMD_ATTR_DEST={0x28, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0xa}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@loopback}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x4}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x10000}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}]}]}, 0x8c}, 0x1, 0x0, 0x0, 0x4000}, 0x41) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) 20:26:53 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1], 0x1c}}, 0x0) 20:26:53 executing program 0: mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x6) (async) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0xf5, 0x0, &(0x7f0000000040)="639cdf3423c36b4159f908333aa572021b9603e38a64c7f1f54911ace43d8f0e11d1a832a79d3f2714b4d661bd6f8ac1c9d96e0a828eec2801f9e14e9e290bf2b7728ab4b8dd7f17f71e4457566fcd8d5083c931b5402ca0239372bc0259858bc6337e329ef73b8a7525b1189e64e956d611d30d822963cc5f82b3971d2b1989392c3ff6f08ab6ffb7d8b96a6962cfecd6401d47cbd637cc0f9207ce43588c645e1d5fd3b32f02e106ea0200743d2786f9148ce0351092489e2987c96e2f10b00b5b3a3ce0ea6a9a72a76aca0a4ca0c39224fd5a7033b962178d1c1b11643df17d4811496f5474cd501b50cdd3ccfe459a608908b8"}) (async) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) 20:26:53 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000010000000000001"], 0x1c}}, 0x0) 20:26:53 executing program 1: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x90801) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x90801) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) 20:26:53 executing program 2: socket(0x2a, 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x6) socket(0x2b, 0xa, 0xfa34) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x503401) 20:26:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f0000000000)={0x3, 0x2, 0x401, "986f75"}) 20:26:53 executing program 5: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)={0x1000420800000}) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000000)={r0}, 0x8) r2 = getpid() ioctl$BINDER_GET_FROZEN_INFO(r1, 0xc00c620f, &(0x7f00000000c0)={r2}) r3 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r3, 0x1267, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r0, 0x0, 0x0) (async) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)={0x1000420800000}) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000000)={r0}, 0x8) (async) getpid() (async) ioctl$BINDER_GET_FROZEN_INFO(r1, 0xc00c620f, &(0x7f00000000c0)={r2}) (async) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r3, 0x1267, 0x0) (async) 20:26:53 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x1, 0x2800) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) ioctl$LOOP_CTL_ADD(0xffffffffffffffff, 0x4c80, 0x2) 20:26:53 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000011000000000001"], 0x1c}}, 0x0) 20:26:53 executing program 2: socket(0x2a, 0x0, 0x0) (async) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x6) socket(0x2b, 0xa, 0xfa34) (async, rerun: 64) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x503401) (rerun: 64) 20:26:53 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB], 0x1c}}, 0x0) 20:26:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f0000000000)={0x3, 0x2, 0x401, "986f75"}) 20:26:53 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000012000000000001"], 0x1c}}, 0x0) 20:26:53 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x1, 0x2800) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) ioctl$LOOP_CTL_ADD(0xffffffffffffffff, 0x4c80, 0x2) 20:26:53 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB], 0x1c}}, 0x0) 20:26:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f0000000000)={0x3, 0x2, 0x401, "986f75"}) 20:26:53 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000080), 0xfffffffffffffffe, 0x10000) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x2000, 0x0) r1 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f00000000c0), 0x4) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000040)={r1}, 0x8) ioctl$SCSI_IOCTL_START_UNIT(r2, 0x5) 20:26:53 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x1, 0x2800) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) ioctl$LOOP_CTL_ADD(0xffffffffffffffff, 0x4c80, 0x2) syz_open_dev$sg(&(0x7f0000000380), 0x1, 0x2800) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) ioctl$LOOP_CTL_ADD(0xffffffffffffffff, 0x4c80, 0x2) (async) 20:26:53 executing program 2: socket(0x2a, 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x6) (async, rerun: 32) socket(0x2b, 0xa, 0xfa34) (async, rerun: 32) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x503401) 20:26:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000000)) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x1274, 0x0) 20:26:53 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000080), 0xfffffffffffffffe, 0x10000) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x2000, 0x0) (async) r1 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f00000000c0), 0x4) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000040)={r1}, 0x8) ioctl$SCSI_IOCTL_START_UNIT(r2, 0x5) 20:26:53 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000025000000000001"], 0x1c}}, 0x0) 20:26:53 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB], 0x1c}}, 0x0) 20:26:53 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000"], 0x1c}}, 0x0) 20:26:53 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000080), 0xfffffffffffffffe, 0x10000) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x2000, 0x0) (async) r1 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f00000000c0), 0x4) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000040)={r1}, 0x8) ioctl$SCSI_IOCTL_START_UNIT(r2, 0x5) 20:26:53 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) ioctl$SCSI_IOCTL_GET_PCI(r0, 0x5387, &(0x7f0000000000)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) 20:26:53 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f0000000000)) 20:26:53 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000048000000000001"], 0x1c}}, 0x0) 20:26:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000000)) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x1274, 0x0) 20:26:53 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) ioctl$SCSI_IOCTL_GET_PCI(r0, 0x5387, &(0x7f0000000000)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) 20:26:53 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000"], 0x1c}}, 0x0) 20:26:53 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f0000000000)) 20:26:53 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000004c000000000001"], 0x1c}}, 0x0) 20:26:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000000)) (async) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x1274, 0x0) 20:26:53 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000"], 0x1c}}, 0x0) 20:26:53 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000060000000000001"], 0x1c}}, 0x0) 20:26:53 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f0000000000)) 20:26:53 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) ioctl$SCSI_IOCTL_GET_PCI(r0, 0x5387, &(0x7f0000000000)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) ioctl$SCSI_IOCTL_GET_PCI(r0, 0x5387, &(0x7f0000000000)) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) (async) 20:26:53 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x301100, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) r3 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x3f) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r4, 0x0, 0x0) ioctl$SG_SET_DEBUG(r4, 0x227e, &(0x7f0000000140)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x20, 0x0, &(0x7f0000000040)=[@release={0x40046306, 0x1}, @free_buffer={0x40086303, r3}, @free_buffer], 0x71, 0x0, &(0x7f0000000080)="90f6f269e67e44fd3be456b09efb222d391af73e789839c7bc1ec5d04fd2aadf4bf3e6b0feb0d77ef62bc53e6f8236cac97a48bc72b972f7298ec2d2802fea4771a4c168f39f7760068ec309b8a3ba16103660ed003d342ce02f1eac1080ddb7af720e20ff373b4c0a3cba5f29c6e64f87"}) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:26:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x8002) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:26:53 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x301100, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) (async) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) r3 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x3f) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r4, 0x0, 0x0) (async) ioctl$SG_SET_DEBUG(r4, 0x227e, &(0x7f0000000140)) (async) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x20, 0x0, &(0x7f0000000040)=[@release={0x40046306, 0x1}, @free_buffer={0x40086303, r3}, @free_buffer], 0x71, 0x0, &(0x7f0000000080)="90f6f269e67e44fd3be456b09efb222d391af73e789839c7bc1ec5d04fd2aadf4bf3e6b0feb0d77ef62bc53e6f8236cac97a48bc72b972f7298ec2d2802fea4771a4c168f39f7760068ec309b8a3ba16103660ed003d342ce02f1eac1080ddb7af720e20ff373b4c0a3cba5f29c6e64f87"}) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:26:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x8002) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x8002) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) 20:26:53 executing program 2: r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_TTY(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x10}, 0x10}}, 0x0) sendmsg$AUDIT_USER_TTY(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0xc0, 0x464, 0x200, 0x70bd28, 0x25dfdbfc, "6a20550d3a41756a1bbafc42a7be49bd1dee24a6c60c6db73bb7c0b9bda4e72d746a090f98df8e3206ad5e4a3e80ec508093306a0fd3ace048d769795315d37bc53edcaaaef643fbdcaa45b1ece53feff365c78d514af5ed354a5b2614d2a0620cec58912e2a2ed19217029bb1445394e83228356e9eea177fd7d35c7aef0e2355db44bf30430b0edb1cca73a30e238f4cd094b37f8e50cf39439f580cc7cf11b8be7dff5888ccb170102994e45d", ["", ""]}, 0xc0}}, 0x4000000) getsockname$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000240)=0x14) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x8000, 0xfa000) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = bpf$ITER_CREATE(0x21, &(0x7f00000002c0)={r2}, 0x8) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000340)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_RADAR_DETECT(r3, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x48, 0x0, 0x1, 0x70bd28, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0x7fffffff, 0x38}}}}, [@NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x1}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x5}]}, 0x48}, 0x1, 0x0, 0x0, 0x800}, 0x80) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r2, 0x1, &(0x7f0000000280)={0x2d, 0x0, 0x3ff, "56dfbffcd97e0b78146b51a90665f1369c8475b71ccd994a4c3f2441f6d33ae5cf74dd30eb8bedf7cc2ad7cd6a"}) ioctl$SG_GET_COMMAND_Q(r1, 0x1275, 0x0) ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f00000004c0)) 20:26:53 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000000000"], 0x1c}}, 0x0) 20:26:53 executing program 0: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x20000, 0x0) write$vga_arbiter(r0, 0x0, 0x0) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f0000000000)) 20:26:53 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000068000000000001"], 0x1c}}, 0x0) 20:26:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x8002) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:26:53 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x301100, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) (async) r3 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x3f) (async) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r4, 0x0, 0x0) (async, rerun: 64) ioctl$SG_SET_DEBUG(r4, 0x227e, &(0x7f0000000140)) (async, rerun: 64) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x20, 0x0, &(0x7f0000000040)=[@release={0x40046306, 0x1}, @free_buffer={0x40086303, r3}, @free_buffer], 0x71, 0x0, &(0x7f0000000080)="90f6f269e67e44fd3be456b09efb222d391af73e789839c7bc1ec5d04fd2aadf4bf3e6b0feb0d77ef62bc53e6f8236cac97a48bc72b972f7298ec2d2802fea4771a4c168f39f7760068ec309b8a3ba16103660ed003d342ce02f1eac1080ddb7af720e20ff373b4c0a3cba5f29c6e64f87"}) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:26:53 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000000000"], 0x1c}}, 0x0) 20:26:53 executing program 0: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x20000, 0x0) write$vga_arbiter(r0, 0x0, 0x0) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f0000000000)) 20:26:53 executing program 2: r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_TTY(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x10}, 0x10}}, 0x0) sendmsg$AUDIT_USER_TTY(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0xc0, 0x464, 0x200, 0x70bd28, 0x25dfdbfc, "6a20550d3a41756a1bbafc42a7be49bd1dee24a6c60c6db73bb7c0b9bda4e72d746a090f98df8e3206ad5e4a3e80ec508093306a0fd3ace048d769795315d37bc53edcaaaef643fbdcaa45b1ece53feff365c78d514af5ed354a5b2614d2a0620cec58912e2a2ed19217029bb1445394e83228356e9eea177fd7d35c7aef0e2355db44bf30430b0edb1cca73a30e238f4cd094b37f8e50cf39439f580cc7cf11b8be7dff5888ccb170102994e45d", ["", ""]}, 0xc0}}, 0x4000000) getsockname$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000240)=0x14) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x8000, 0xfa000) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = bpf$ITER_CREATE(0x21, &(0x7f00000002c0)={r2}, 0x8) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000340)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_RADAR_DETECT(r3, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x48, 0x0, 0x1, 0x70bd28, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0x7fffffff, 0x38}}}}, [@NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x1}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x5}]}, 0x48}, 0x1, 0x0, 0x0, 0x800}, 0x80) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r2, 0x1, &(0x7f0000000280)={0x2d, 0x0, 0x3ff, "56dfbffcd97e0b78146b51a90665f1369c8475b71ccd994a4c3f2441f6d33ae5cf74dd30eb8bedf7cc2ad7cd6a"}) ioctl$SG_GET_COMMAND_Q(r1, 0x1275, 0x0) ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f00000004c0)) socket$nl_audit(0x10, 0x3, 0x9) (async) sendmsg$AUDIT_USER_TTY(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x10}, 0x10}}, 0x0) (async) sendmsg$AUDIT_USER_TTY(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0xc0, 0x464, 0x200, 0x70bd28, 0x25dfdbfc, "6a20550d3a41756a1bbafc42a7be49bd1dee24a6c60c6db73bb7c0b9bda4e72d746a090f98df8e3206ad5e4a3e80ec508093306a0fd3ace048d769795315d37bc53edcaaaef643fbdcaa45b1ece53feff365c78d514af5ed354a5b2614d2a0620cec58912e2a2ed19217029bb1445394e83228356e9eea177fd7d35c7aef0e2355db44bf30430b0edb1cca73a30e238f4cd094b37f8e50cf39439f580cc7cf11b8be7dff5888ccb170102994e45d", ["", ""]}, 0xc0}}, 0x4000000) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000240)=0x14) (async) syz_open_dev$sg(&(0x7f0000000380), 0x8000, 0xfa000) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) bpf$ITER_CREATE(0x21, &(0x7f00000002c0)={r2}, 0x8) (async) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000340)={'wlan0\x00'}) (async) sendmsg$NL80211_CMD_RADAR_DETECT(r3, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x48, 0x0, 0x1, 0x70bd28, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0x7fffffff, 0x38}}}}, [@NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x1}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x5}]}, 0x48}, 0x1, 0x0, 0x0, 0x800}, 0x80) (async) write$vga_arbiter(r2, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_SEND_COMMAND(r2, 0x1, &(0x7f0000000280)={0x2d, 0x0, 0x3ff, "56dfbffcd97e0b78146b51a90665f1369c8475b71ccd994a4c3f2441f6d33ae5cf74dd30eb8bedf7cc2ad7cd6a"}) (async) ioctl$SG_GET_COMMAND_Q(r1, 0x1275, 0x0) (async) ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f00000004c0)) (async) 20:26:53 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000006c000000000001"], 0x1c}}, 0x0) 20:26:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x3ff, 0x450600) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:26:53 executing program 5: r0 = syz_open_dev$sg(&(0x7f00000000c0), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0xd5585d26310fc6f, 0x0) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000080)) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) ioctl$SCSI_IOCTL_START_UNIT(r2, 0x5) 20:26:53 executing program 0: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async, rerun: 32) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x20000, 0x0) (rerun: 32) write$vga_arbiter(r0, 0x0, 0x0) (async) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f0000000000)) 20:26:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x3ff, 0x450600) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:26:53 executing program 5: r0 = syz_open_dev$sg(&(0x7f00000000c0), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0xd5585d26310fc6f, 0x0) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000080)) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) ioctl$SCSI_IOCTL_START_UNIT(r2, 0x5) syz_open_dev$sg(&(0x7f00000000c0), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0xd5585d26310fc6f, 0x0) (async) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000080)) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) (async) ioctl$SCSI_IOCTL_START_UNIT(r2, 0x5) (async) 20:26:53 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0xfffffffffffffffc, 0x80500) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000000)) 20:26:53 executing program 2: r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_TTY(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x10}, 0x10}}, 0x0) sendmsg$AUDIT_USER_TTY(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0xc0, 0x464, 0x200, 0x70bd28, 0x25dfdbfc, "6a20550d3a41756a1bbafc42a7be49bd1dee24a6c60c6db73bb7c0b9bda4e72d746a090f98df8e3206ad5e4a3e80ec508093306a0fd3ace048d769795315d37bc53edcaaaef643fbdcaa45b1ece53feff365c78d514af5ed354a5b2614d2a0620cec58912e2a2ed19217029bb1445394e83228356e9eea177fd7d35c7aef0e2355db44bf30430b0edb1cca73a30e238f4cd094b37f8e50cf39439f580cc7cf11b8be7dff5888ccb170102994e45d", ["", ""]}, 0xc0}}, 0x4000000) getsockname$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000240)=0x14) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x8000, 0xfa000) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = bpf$ITER_CREATE(0x21, &(0x7f00000002c0)={r2}, 0x8) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000340)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_RADAR_DETECT(r3, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x48, 0x0, 0x1, 0x70bd28, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0x7fffffff, 0x38}}}}, [@NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x1}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x5}]}, 0x48}, 0x1, 0x0, 0x0, 0x800}, 0x80) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r2, 0x1, &(0x7f0000000280)={0x2d, 0x0, 0x3ff, "56dfbffcd97e0b78146b51a90665f1369c8475b71ccd994a4c3f2441f6d33ae5cf74dd30eb8bedf7cc2ad7cd6a"}) ioctl$SG_GET_COMMAND_Q(r1, 0x1275, 0x0) ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f00000004c0)) socket$nl_audit(0x10, 0x3, 0x9) (async) sendmsg$AUDIT_USER_TTY(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x10}, 0x10}}, 0x0) (async) sendmsg$AUDIT_USER_TTY(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0xc0, 0x464, 0x200, 0x70bd28, 0x25dfdbfc, "6a20550d3a41756a1bbafc42a7be49bd1dee24a6c60c6db73bb7c0b9bda4e72d746a090f98df8e3206ad5e4a3e80ec508093306a0fd3ace048d769795315d37bc53edcaaaef643fbdcaa45b1ece53feff365c78d514af5ed354a5b2614d2a0620cec58912e2a2ed19217029bb1445394e83228356e9eea177fd7d35c7aef0e2355db44bf30430b0edb1cca73a30e238f4cd094b37f8e50cf39439f580cc7cf11b8be7dff5888ccb170102994e45d", ["", ""]}, 0xc0}}, 0x4000000) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000240)=0x14) (async) syz_open_dev$sg(&(0x7f0000000380), 0x8000, 0xfa000) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) bpf$ITER_CREATE(0x21, &(0x7f00000002c0)={r2}, 0x8) (async) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000340)={'wlan0\x00'}) (async) sendmsg$NL80211_CMD_RADAR_DETECT(r3, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x48, 0x0, 0x1, 0x70bd28, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0x7fffffff, 0x38}}}}, [@NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x1}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x5}]}, 0x48}, 0x1, 0x0, 0x0, 0x800}, 0x80) (async) write$vga_arbiter(r2, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_SEND_COMMAND(r2, 0x1, &(0x7f0000000280)={0x2d, 0x0, 0x3ff, "56dfbffcd97e0b78146b51a90665f1369c8475b71ccd994a4c3f2441f6d33ae5cf74dd30eb8bedf7cc2ad7cd6a"}) (async) ioctl$SG_GET_COMMAND_Q(r1, 0x1275, 0x0) (async) ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f00000004c0)) (async) 20:26:53 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000000000"], 0x1c}}, 0x0) 20:26:53 executing program 5: r0 = syz_open_dev$sg(&(0x7f00000000c0), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0xd5585d26310fc6f, 0x0) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000080)) (async) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) ioctl$SCSI_IOCTL_START_UNIT(r2, 0x5) 20:26:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x3ff, 0x450600) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:26:53 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000000000000"], 0x1c}}, 0x0) [ 2105.876109][T29172] __nla_validate_parse: 79 callbacks suppressed [ 2105.876126][T29172] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:26:53 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000074000000000001"], 0x1c}}, 0x0) 20:26:53 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) ioctl$SG_GET_COMMAND_Q(r1, 0x2270, &(0x7f0000000040)) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x800, 0x0) write$vga_arbiter(r2, 0x0, 0x0) sendmsg$TIPC_CMD_SET_NETID(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, 0x0, 0x1, 0x70bd26, 0x25dfdbff, {{}, {}, {0x8, 0x2, 0xeb}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x80d0}, 0x4080) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) 20:26:53 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0xfffffffffffffffc, 0x80500) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000040), 0xfffffffffffffffc, 0x80500) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000000)) (async) 20:26:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0xfffffffffffffffc, 0x400) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:26:53 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x80c80) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:26:53 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) ioctl$SG_GET_COMMAND_Q(r1, 0x2270, &(0x7f0000000040)) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x800, 0x0) write$vga_arbiter(r2, 0x0, 0x0) sendmsg$TIPC_CMD_SET_NETID(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, 0x0, 0x1, 0x70bd26, 0x25dfdbff, {{}, {}, {0x8, 0x2, 0xeb}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x80d0}, 0x4080) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) (async) ioctl$SG_GET_COMMAND_Q(r1, 0x2270, &(0x7f0000000040)) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x800, 0x0) (async) write$vga_arbiter(r2, 0x0, 0x0) (async) sendmsg$TIPC_CMD_SET_NETID(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, 0x0, 0x1, 0x70bd26, 0x25dfdbff, {{}, {}, {0x8, 0x2, 0xeb}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x80d0}, 0x4080) (async) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) (async) 20:26:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0xfffffffffffffffc, 0x400) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:26:53 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000000000000"], 0x1c}}, 0x0) 20:26:53 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x80c80) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:26:53 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0xfffffffffffffffc, 0x80500) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000000)) 20:26:53 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000007a000000000001"], 0x1c}}, 0x0) [ 2105.950404][T29204] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:26:53 executing program 0: r0 = socket(0xa, 0x6, 0x0) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0xc, 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x1276, 0x0) 20:26:53 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x80c80) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:26:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0xfffffffffffffffc, 0x400) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0xfffffffffffffffc, 0x400) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) 20:26:53 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000000000000"], 0x1c}}, 0x0) 20:26:53 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) ioctl$SG_GET_COMMAND_Q(r1, 0x2270, &(0x7f0000000040)) (async) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x800, 0x0) write$vga_arbiter(r2, 0x0, 0x0) (async) sendmsg$TIPC_CMD_SET_NETID(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, 0x0, 0x1, 0x70bd26, 0x25dfdbff, {{}, {}, {0x8, 0x2, 0xeb}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x80d0}, 0x4080) (async) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) 20:26:53 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYBLOB="0100000000000000000002"], 0x1c}}, 0x0) [ 2106.018090][T29232] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:26:54 executing program 5: ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(0xffffffffffffffff, 0x40046210, &(0x7f0000000000)) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:26:54 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000030000000001"], 0x1c}}, 0x0) 20:26:54 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r0, 0x2) write$vga_arbiter(r1, 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) ioctl$SG_GET_RESERVED_SIZE(r2, 0x2272, &(0x7f0000000000)) ioctl$SG_GET_RESERVED_SIZE(r3, 0x2272, &(0x7f0000000080)) 20:26:54 executing program 0: r0 = socket(0xa, 0x6, 0x0) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0xc, 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x1276, 0x0) 20:26:54 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) sendmsg$AUDIT_USER_TTY(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x10}, 0x10}}, 0x0) sendmsg$AUDIT_ADD_RULE(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000240)={&(0x7f00000003c0)={0x478, 0x3f3, 0x20, 0x70bd27, 0x25dfdbfc, {0x2, 0x2, 0x40, [0x1, 0x4, 0x3, 0x6, 0x1, 0x5ebbdee8, 0xcb, 0x4, 0x2, 0x20, 0xedbd, 0x5, 0xff, 0x3, 0x100, 0xfffffff9, 0x8, 0x8, 0x4, 0x3, 0x8, 0x5, 0x5, 0x3, 0x3, 0x3f, 0x4f66, 0x200, 0x7, 0x1, 0x1, 0x1e, 0x6, 0x7fff, 0x8, 0x0, 0x10001, 0x6, 0x1, 0x6cda, 0x3ff, 0x2, 0x5, 0x6, 0x800, 0x9, 0x5, 0x6, 0x0, 0x7ff, 0x0, 0x3, 0x7fff, 0x3, 0x100, 0xa9f7, 0x7, 0x71, 0xffff, 0x5, 0x100, 0x80000000, 0x100000, 0x40], [0x8, 0xfffffffc, 0x1, 0x3ff, 0x65, 0x43, 0x2528, 0x4, 0xa3d0, 0x4, 0x3, 0x4, 0x5, 0x401, 0x8001, 0x95d, 0x2, 0x9, 0x62c, 0x8, 0x2c5, 0x7ff, 0x298f, 0x0, 0x8, 0x200, 0xfffe0000, 0x8, 0x7f, 0x4, 0x8, 0x6, 0x1, 0x8, 0x4fd, 0x800, 0xfffffabd, 0x1f, 0x7b42, 0x9, 0xea, 0x0, 0x3aa, 0x2, 0x9, 0x3f, 0x4, 0x4, 0x0, 0x200, 0x3, 0xffffffff, 0xb35c, 0x1, 0xfff, 0x8, 0x9, 0xfff, 0x7fffffff, 0x5, 0x351, 0x8, 0x7, 0x5], [0x0, 0x3, 0xffff, 0x4, 0x8f9, 0x5, 0x100, 0xa5, 0x0, 0xfffffff9, 0x8, 0xc900, 0x40, 0x6, 0x1, 0x8, 0xd75fe21e, 0x2, 0xd79, 0x7, 0x1000, 0x7, 0x7, 0xfffff800, 0x4, 0x8, 0x1, 0x7, 0x505e, 0x6, 0x91, 0xffff, 0x3, 0x9, 0x6, 0x10000, 0x4, 0x5, 0x8, 0x0, 0x8001, 0x9, 0x9, 0x8, 0x8, 0x7, 0x3, 0x0, 0x6, 0x0, 0x4, 0xfffffffb, 0x5, 0x9, 0x3, 0x9bd, 0x0, 0x2, 0x4, 0x3ff, 0x1, 0xffffc000, 0x6, 0x2], [0x2809a632, 0x8, 0x7fffffff, 0x1d, 0x6, 0x3, 0x1, 0x9, 0xd4, 0x7, 0x1000, 0x37, 0x1000, 0x5, 0xcd, 0x4, 0x10001, 0x8, 0x2, 0x47, 0x1, 0x3, 0x9, 0x4, 0x6, 0xdd, 0x6, 0x6, 0xfffffffd, 0xb40, 0x7, 0x0, 0x6, 0xd3, 0x5423, 0x0, 0xa9a, 0x6, 0x1, 0x3, 0x4, 0x6, 0x8, 0x0, 0x9a1, 0x6, 0x1, 0x5, 0x80, 0x1000, 0x6a34, 0xf5d, 0x400, 0x1eef, 0x0, 0x8, 0x9, 0x5, 0xd72, 0x58, 0x0, 0x2, 0x1ff, 0x4], 0x55, ['.)\xcb/@&/]\x00', '/dev/sg#\x00', './binderfs2/binder0\x00', './binderfs2/binder0\x00', '/dev/hwrng\x00', '\\[\x00', '!\x00', '^@@]&:#\',&\x00']}, ["", "", "", "", "", "", "", ""]}, 0x478}, 0x1, 0x0, 0x0, 0x4000}, 0x80) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f00000001c0)=0x1) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100), 0x82400, 0x0) write$vga_arbiter(r1, 0x0, 0x0) r2 = getpid() prlimit64(r2, 0x3, 0x0, &(0x7f0000000000)) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs2/binder0\x00', 0xc02, 0x0) r4 = getpid() prlimit64(r4, 0x0, 0x0, &(0x7f0000000140)) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r5, 0x0, 0x0) r6 = getpid() r7 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000180), r7) ioctl$BINDER_GET_FROZEN_INFO(r5, 0xc00c620f, &(0x7f0000000080)={r6}) 20:26:54 executing program 0: r0 = socket(0xa, 0x6, 0x0) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0xc, 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x1276, 0x0) socket(0xa, 0x6, 0x0) (async) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0xc, 0x0, 0x0) (async) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r1, 0x1276, 0x0) (async) 20:26:54 executing program 5: ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(0xffffffffffffffff, 0x40046210, &(0x7f0000000000)) (async) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:26:54 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r0, 0x2) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) (async) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) (async) ioctl$SG_GET_RESERVED_SIZE(r2, 0x2272, &(0x7f0000000000)) ioctl$SG_GET_RESERVED_SIZE(r3, 0x2272, &(0x7f0000000080)) 20:26:54 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) sendmsg$AUDIT_USER_TTY(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x10}, 0x10}}, 0x0) sendmsg$AUDIT_ADD_RULE(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000240)={&(0x7f00000003c0)={0x478, 0x3f3, 0x20, 0x70bd27, 0x25dfdbfc, {0x2, 0x2, 0x40, [0x1, 0x4, 0x3, 0x6, 0x1, 0x5ebbdee8, 0xcb, 0x4, 0x2, 0x20, 0xedbd, 0x5, 0xff, 0x3, 0x100, 0xfffffff9, 0x8, 0x8, 0x4, 0x3, 0x8, 0x5, 0x5, 0x3, 0x3, 0x3f, 0x4f66, 0x200, 0x7, 0x1, 0x1, 0x1e, 0x6, 0x7fff, 0x8, 0x0, 0x10001, 0x6, 0x1, 0x6cda, 0x3ff, 0x2, 0x5, 0x6, 0x800, 0x9, 0x5, 0x6, 0x0, 0x7ff, 0x0, 0x3, 0x7fff, 0x3, 0x100, 0xa9f7, 0x7, 0x71, 0xffff, 0x5, 0x100, 0x80000000, 0x100000, 0x40], [0x8, 0xfffffffc, 0x1, 0x3ff, 0x65, 0x43, 0x2528, 0x4, 0xa3d0, 0x4, 0x3, 0x4, 0x5, 0x401, 0x8001, 0x95d, 0x2, 0x9, 0x62c, 0x8, 0x2c5, 0x7ff, 0x298f, 0x0, 0x8, 0x200, 0xfffe0000, 0x8, 0x7f, 0x4, 0x8, 0x6, 0x1, 0x8, 0x4fd, 0x800, 0xfffffabd, 0x1f, 0x7b42, 0x9, 0xea, 0x0, 0x3aa, 0x2, 0x9, 0x3f, 0x4, 0x4, 0x0, 0x200, 0x3, 0xffffffff, 0xb35c, 0x1, 0xfff, 0x8, 0x9, 0xfff, 0x7fffffff, 0x5, 0x351, 0x8, 0x7, 0x5], [0x0, 0x3, 0xffff, 0x4, 0x8f9, 0x5, 0x100, 0xa5, 0x0, 0xfffffff9, 0x8, 0xc900, 0x40, 0x6, 0x1, 0x8, 0xd75fe21e, 0x2, 0xd79, 0x7, 0x1000, 0x7, 0x7, 0xfffff800, 0x4, 0x8, 0x1, 0x7, 0x505e, 0x6, 0x91, 0xffff, 0x3, 0x9, 0x6, 0x10000, 0x4, 0x5, 0x8, 0x0, 0x8001, 0x9, 0x9, 0x8, 0x8, 0x7, 0x3, 0x0, 0x6, 0x0, 0x4, 0xfffffffb, 0x5, 0x9, 0x3, 0x9bd, 0x0, 0x2, 0x4, 0x3ff, 0x1, 0xffffc000, 0x6, 0x2], [0x2809a632, 0x8, 0x7fffffff, 0x1d, 0x6, 0x3, 0x1, 0x9, 0xd4, 0x7, 0x1000, 0x37, 0x1000, 0x5, 0xcd, 0x4, 0x10001, 0x8, 0x2, 0x47, 0x1, 0x3, 0x9, 0x4, 0x6, 0xdd, 0x6, 0x6, 0xfffffffd, 0xb40, 0x7, 0x0, 0x6, 0xd3, 0x5423, 0x0, 0xa9a, 0x6, 0x1, 0x3, 0x4, 0x6, 0x8, 0x0, 0x9a1, 0x6, 0x1, 0x5, 0x80, 0x1000, 0x6a34, 0xf5d, 0x400, 0x1eef, 0x0, 0x8, 0x9, 0x5, 0xd72, 0x58, 0x0, 0x2, 0x1ff, 0x4], 0x55, ['.)\xcb/@&/]\x00', '/dev/sg#\x00', './binderfs2/binder0\x00', './binderfs2/binder0\x00', '/dev/hwrng\x00', '\\[\x00', '!\x00', '^@@]&:#\',&\x00']}, ["", "", "", "", "", "", "", ""]}, 0x478}, 0x1, 0x0, 0x0, 0x4000}, 0x80) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f00000001c0)=0x1) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100), 0x82400, 0x0) write$vga_arbiter(r1, 0x0, 0x0) r2 = getpid() prlimit64(r2, 0x3, 0x0, &(0x7f0000000000)) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs2/binder0\x00', 0xc02, 0x0) r4 = getpid() prlimit64(r4, 0x0, 0x0, &(0x7f0000000140)) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r5, 0x0, 0x0) r6 = getpid() r7 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000180), r7) ioctl$BINDER_GET_FROZEN_INFO(r5, 0xc00c620f, &(0x7f0000000080)={r6}) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) sendmsg$AUDIT_USER_TTY(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x10}, 0x10}}, 0x0) (async) sendmsg$AUDIT_ADD_RULE(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000240)={&(0x7f00000003c0)={0x478, 0x3f3, 0x20, 0x70bd27, 0x25dfdbfc, {0x2, 0x2, 0x40, [0x1, 0x4, 0x3, 0x6, 0x1, 0x5ebbdee8, 0xcb, 0x4, 0x2, 0x20, 0xedbd, 0x5, 0xff, 0x3, 0x100, 0xfffffff9, 0x8, 0x8, 0x4, 0x3, 0x8, 0x5, 0x5, 0x3, 0x3, 0x3f, 0x4f66, 0x200, 0x7, 0x1, 0x1, 0x1e, 0x6, 0x7fff, 0x8, 0x0, 0x10001, 0x6, 0x1, 0x6cda, 0x3ff, 0x2, 0x5, 0x6, 0x800, 0x9, 0x5, 0x6, 0x0, 0x7ff, 0x0, 0x3, 0x7fff, 0x3, 0x100, 0xa9f7, 0x7, 0x71, 0xffff, 0x5, 0x100, 0x80000000, 0x100000, 0x40], [0x8, 0xfffffffc, 0x1, 0x3ff, 0x65, 0x43, 0x2528, 0x4, 0xa3d0, 0x4, 0x3, 0x4, 0x5, 0x401, 0x8001, 0x95d, 0x2, 0x9, 0x62c, 0x8, 0x2c5, 0x7ff, 0x298f, 0x0, 0x8, 0x200, 0xfffe0000, 0x8, 0x7f, 0x4, 0x8, 0x6, 0x1, 0x8, 0x4fd, 0x800, 0xfffffabd, 0x1f, 0x7b42, 0x9, 0xea, 0x0, 0x3aa, 0x2, 0x9, 0x3f, 0x4, 0x4, 0x0, 0x200, 0x3, 0xffffffff, 0xb35c, 0x1, 0xfff, 0x8, 0x9, 0xfff, 0x7fffffff, 0x5, 0x351, 0x8, 0x7, 0x5], [0x0, 0x3, 0xffff, 0x4, 0x8f9, 0x5, 0x100, 0xa5, 0x0, 0xfffffff9, 0x8, 0xc900, 0x40, 0x6, 0x1, 0x8, 0xd75fe21e, 0x2, 0xd79, 0x7, 0x1000, 0x7, 0x7, 0xfffff800, 0x4, 0x8, 0x1, 0x7, 0x505e, 0x6, 0x91, 0xffff, 0x3, 0x9, 0x6, 0x10000, 0x4, 0x5, 0x8, 0x0, 0x8001, 0x9, 0x9, 0x8, 0x8, 0x7, 0x3, 0x0, 0x6, 0x0, 0x4, 0xfffffffb, 0x5, 0x9, 0x3, 0x9bd, 0x0, 0x2, 0x4, 0x3ff, 0x1, 0xffffc000, 0x6, 0x2], [0x2809a632, 0x8, 0x7fffffff, 0x1d, 0x6, 0x3, 0x1, 0x9, 0xd4, 0x7, 0x1000, 0x37, 0x1000, 0x5, 0xcd, 0x4, 0x10001, 0x8, 0x2, 0x47, 0x1, 0x3, 0x9, 0x4, 0x6, 0xdd, 0x6, 0x6, 0xfffffffd, 0xb40, 0x7, 0x0, 0x6, 0xd3, 0x5423, 0x0, 0xa9a, 0x6, 0x1, 0x3, 0x4, 0x6, 0x8, 0x0, 0x9a1, 0x6, 0x1, 0x5, 0x80, 0x1000, 0x6a34, 0xf5d, 0x400, 0x1eef, 0x0, 0x8, 0x9, 0x5, 0xd72, 0x58, 0x0, 0x2, 0x1ff, 0x4], 0x55, ['.)\xcb/@&/]\x00', '/dev/sg#\x00', './binderfs2/binder0\x00', './binderfs2/binder0\x00', '/dev/hwrng\x00', '\\[\x00', '!\x00', '^@@]&:#\',&\x00']}, ["", "", "", "", "", "", "", ""]}, 0x478}, 0x1, 0x0, 0x0, 0x4000}, 0x80) (async) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f00000001c0)=0x1) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100), 0x82400, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) getpid() (async) prlimit64(r2, 0x3, 0x0, &(0x7f0000000000)) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r3, 0x0, 0x0) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs2/binder0\x00', 0xc02, 0x0) (async) getpid() (async) prlimit64(r4, 0x0, 0x0, &(0x7f0000000140)) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r5, 0x0, 0x0) (async) getpid() (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ipvs(&(0x7f0000000180), r7) (async) ioctl$BINDER_GET_FROZEN_INFO(r5, 0xc00c620f, &(0x7f0000000080)={r6}) (async) 20:26:54 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYBLOB="0100000000000000000002"], 0x1c}}, 0x0) 20:26:54 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff, 0xc}, 0x10) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000040)={r1}, 0x8) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) sendmsg$AUDIT_GET(r2, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x10, 0x3e8, 0x100, 0x70bd27, 0x25dfdbff, "", [""]}, 0x10}, 0x1, 0x0, 0x0, 0x8000}, 0x10) [ 2106.118815][T29258] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:26:54 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff, 0xc}, 0x10) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000040)={r1}, 0x8) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) sendmsg$AUDIT_GET(r2, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x10, 0x3e8, 0x100, 0x70bd27, 0x25dfdbff, "", [""]}, 0x10}, 0x1, 0x0, 0x0, 0x8000}, 0x10) 20:26:54 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r0, 0x2) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) ioctl$SG_GET_RESERVED_SIZE(r2, 0x2272, &(0x7f0000000000)) (async) ioctl$SG_GET_RESERVED_SIZE(r3, 0x2272, &(0x7f0000000080)) 20:26:54 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000050000000001"], 0x1c}}, 0x0) 20:26:54 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYBLOB="0100000000000000000002"], 0x1c}}, 0x0) 20:26:54 executing program 5: ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(0xffffffffffffffff, 0x40046210, &(0x7f0000000000)) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(0xffffffffffffffff, 0x40046210, &(0x7f0000000000)) (async) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) 20:26:54 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) sendmsg$AUDIT_USER_TTY(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x10}, 0x10}}, 0x0) (async) sendmsg$AUDIT_ADD_RULE(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000240)={&(0x7f00000003c0)={0x478, 0x3f3, 0x20, 0x70bd27, 0x25dfdbfc, {0x2, 0x2, 0x40, [0x1, 0x4, 0x3, 0x6, 0x1, 0x5ebbdee8, 0xcb, 0x4, 0x2, 0x20, 0xedbd, 0x5, 0xff, 0x3, 0x100, 0xfffffff9, 0x8, 0x8, 0x4, 0x3, 0x8, 0x5, 0x5, 0x3, 0x3, 0x3f, 0x4f66, 0x200, 0x7, 0x1, 0x1, 0x1e, 0x6, 0x7fff, 0x8, 0x0, 0x10001, 0x6, 0x1, 0x6cda, 0x3ff, 0x2, 0x5, 0x6, 0x800, 0x9, 0x5, 0x6, 0x0, 0x7ff, 0x0, 0x3, 0x7fff, 0x3, 0x100, 0xa9f7, 0x7, 0x71, 0xffff, 0x5, 0x100, 0x80000000, 0x100000, 0x40], [0x8, 0xfffffffc, 0x1, 0x3ff, 0x65, 0x43, 0x2528, 0x4, 0xa3d0, 0x4, 0x3, 0x4, 0x5, 0x401, 0x8001, 0x95d, 0x2, 0x9, 0x62c, 0x8, 0x2c5, 0x7ff, 0x298f, 0x0, 0x8, 0x200, 0xfffe0000, 0x8, 0x7f, 0x4, 0x8, 0x6, 0x1, 0x8, 0x4fd, 0x800, 0xfffffabd, 0x1f, 0x7b42, 0x9, 0xea, 0x0, 0x3aa, 0x2, 0x9, 0x3f, 0x4, 0x4, 0x0, 0x200, 0x3, 0xffffffff, 0xb35c, 0x1, 0xfff, 0x8, 0x9, 0xfff, 0x7fffffff, 0x5, 0x351, 0x8, 0x7, 0x5], [0x0, 0x3, 0xffff, 0x4, 0x8f9, 0x5, 0x100, 0xa5, 0x0, 0xfffffff9, 0x8, 0xc900, 0x40, 0x6, 0x1, 0x8, 0xd75fe21e, 0x2, 0xd79, 0x7, 0x1000, 0x7, 0x7, 0xfffff800, 0x4, 0x8, 0x1, 0x7, 0x505e, 0x6, 0x91, 0xffff, 0x3, 0x9, 0x6, 0x10000, 0x4, 0x5, 0x8, 0x0, 0x8001, 0x9, 0x9, 0x8, 0x8, 0x7, 0x3, 0x0, 0x6, 0x0, 0x4, 0xfffffffb, 0x5, 0x9, 0x3, 0x9bd, 0x0, 0x2, 0x4, 0x3ff, 0x1, 0xffffc000, 0x6, 0x2], [0x2809a632, 0x8, 0x7fffffff, 0x1d, 0x6, 0x3, 0x1, 0x9, 0xd4, 0x7, 0x1000, 0x37, 0x1000, 0x5, 0xcd, 0x4, 0x10001, 0x8, 0x2, 0x47, 0x1, 0x3, 0x9, 0x4, 0x6, 0xdd, 0x6, 0x6, 0xfffffffd, 0xb40, 0x7, 0x0, 0x6, 0xd3, 0x5423, 0x0, 0xa9a, 0x6, 0x1, 0x3, 0x4, 0x6, 0x8, 0x0, 0x9a1, 0x6, 0x1, 0x5, 0x80, 0x1000, 0x6a34, 0xf5d, 0x400, 0x1eef, 0x0, 0x8, 0x9, 0x5, 0xd72, 0x58, 0x0, 0x2, 0x1ff, 0x4], 0x55, ['.)\xcb/@&/]\x00', '/dev/sg#\x00', './binderfs2/binder0\x00', './binderfs2/binder0\x00', '/dev/hwrng\x00', '\\[\x00', '!\x00', '^@@]&:#\',&\x00']}, ["", "", "", "", "", "", "", ""]}, 0x478}, 0x1, 0x0, 0x0, 0x4000}, 0x80) (async) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f00000001c0)=0x1) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100), 0x82400, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) r2 = getpid() prlimit64(r2, 0x3, 0x0, &(0x7f0000000000)) (async) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs2/binder0\x00', 0xc02, 0x0) (async) r4 = getpid() prlimit64(r4, 0x0, 0x0, &(0x7f0000000140)) (async) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r5, 0x0, 0x0) (async) r6 = getpid() (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000180), r7) ioctl$BINDER_GET_FROZEN_INFO(r5, 0xc00c620f, &(0x7f0000000080)={r6}) 20:26:54 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff, 0xc}, 0x10) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000040)={r1}, 0x8) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) sendmsg$AUDIT_GET(r2, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x10, 0x3e8, 0x100, 0x70bd27, 0x25dfdbff, "", [""]}, 0x10}, 0x1, 0x0, 0x0, 0x8000}, 0x10) 20:26:54 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16, @ANYBLOB="0100000000000000000002"], 0x1c}}, 0x0) 20:26:54 executing program 5: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$EVIOCGBITKEY(r0, 0x80404521, &(0x7f00000000c0)=""/74) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_NEXT_CMD_LEN(r1, 0x2283, &(0x7f0000000000)=0xaf) syz_io_uring_setup(0x309b, &(0x7f0000000140)={0x0, 0x9ea8, 0x1, 0x2, 0x18f, 0x0, r1}, &(0x7f0000fed000/0x10000)=nil, &(0x7f0000c00000/0x400000)=nil, &(0x7f00000001c0), &(0x7f0000000200)) 20:26:54 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x20c800) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f0000000080), &(0x7f00000000c0)=0x4) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) 20:26:54 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000080)) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x8000, 0x410000) ioctl$SG_SET_KEEP_ORPHAN(r2, 0x2287, &(0x7f0000000040)=0xffff) 20:26:54 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x80a00) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:26:54 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16, @ANYBLOB="0100000000000000000002"], 0x1c}}, 0x0) 20:26:54 executing program 5: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$EVIOCGBITKEY(r0, 0x80404521, &(0x7f00000000c0)=""/74) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_NEXT_CMD_LEN(r1, 0x2283, &(0x7f0000000000)=0xaf) (async) syz_io_uring_setup(0x309b, &(0x7f0000000140)={0x0, 0x9ea8, 0x1, 0x2, 0x18f, 0x0, r1}, &(0x7f0000fed000/0x10000)=nil, &(0x7f0000c00000/0x400000)=nil, &(0x7f00000001c0), &(0x7f0000000200)) [ 2106.254955][T29319] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:26:54 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000060000000001"], 0x1c}}, 0x0) 20:26:54 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000080)) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x8000, 0x410000) ioctl$SG_SET_KEEP_ORPHAN(r2, 0x2287, &(0x7f0000000040)=0xffff) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000080)) (async) syz_open_dev$sg(&(0x7f0000000000), 0x8000, 0x410000) (async) ioctl$SG_SET_KEEP_ORPHAN(r2, 0x2287, &(0x7f0000000040)=0xffff) (async) 20:26:54 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x20c800) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f0000000080), &(0x7f00000000c0)=0x4) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x20c800) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) (async) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f0000000080), &(0x7f00000000c0)=0x4) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) 20:26:54 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16, @ANYBLOB="0100000000000000000002"], 0x1c}}, 0x0) 20:26:54 executing program 5: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$EVIOCGBITKEY(r0, 0x80404521, &(0x7f00000000c0)=""/74) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_NEXT_CMD_LEN(r1, 0x2283, &(0x7f0000000000)=0xaf) syz_io_uring_setup(0x309b, &(0x7f0000000140)={0x0, 0x9ea8, 0x1, 0x2, 0x18f, 0x0, r1}, &(0x7f0000fed000/0x10000)=nil, &(0x7f0000c00000/0x400000)=nil, &(0x7f00000001c0), &(0x7f0000000200)) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$EVIOCGBITKEY(r0, 0x80404521, &(0x7f00000000c0)=""/74) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_NEXT_CMD_LEN(r1, 0x2283, &(0x7f0000000000)=0xaf) (async) syz_io_uring_setup(0x309b, &(0x7f0000000140)={0x0, 0x9ea8, 0x1, 0x2, 0x18f, 0x0, r1}, &(0x7f0000fed000/0x10000)=nil, &(0x7f0000c00000/0x400000)=nil, &(0x7f00000001c0), &(0x7f0000000200)) (async) 20:26:54 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x80a00) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:26:54 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000080)) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x8000, 0x410000) ioctl$SG_SET_KEEP_ORPHAN(r2, 0x2287, &(0x7f0000000040)=0xffff) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000080)) (async) syz_open_dev$sg(&(0x7f0000000000), 0x8000, 0x410000) (async) ioctl$SG_SET_KEEP_ORPHAN(r2, 0x2287, &(0x7f0000000040)=0xffff) (async) 20:26:54 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYRES16=r1, @ANYBLOB="0100000000000000000002"], 0x1c}}, 0x0) 20:26:54 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x80a00) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x80a00) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) 20:26:54 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x20c800) (async) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f0000000080), &(0x7f00000000c0)=0x4) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) 20:26:54 executing program 5: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x214000, 0x0) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000040)=0xac) r1 = syz_open_dev$sg(&(0x7f0000000080), 0xfffffffffffffffe, 0x480) ioctl$SG_GET_KEEP_ORPHAN(r1, 0x2288, &(0x7f00000000c0)) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r1, 0x2) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SCSI_IOCTL_GET_PCI(r2, 0x5387, &(0x7f0000000100)) ioctl$SG_GET_COMMAND_Q(r1, 0x1267, 0x0) ioctl$EVIOCGREP(r0, 0x80084503, &(0x7f0000000140)=""/159) 20:26:54 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) [ 2106.349477][T29353] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:26:54 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000070000000001"], 0x1c}}, 0x0) 20:26:54 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYRES16=r1, @ANYBLOB="0100000000000000000002"], 0x1c}}, 0x0) 20:26:54 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) (async) 20:26:54 executing program 0: socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) sendmsg$NL80211_CMD_RADAR_DETECT(r1, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r0, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_SET_PMKSA(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x44, r0, 0x10, 0x70bd28, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_PMKID={0x14, 0x55, "c596efc225b0b491557679ac45116825"}, @NL80211_ATTR_PMK_LIFETIME={0x8, 0x11f, 0x8001}, @NL80211_ATTR_PMK={0x14, 0xfe, "7d91ebaf04c40e02628002b750021990"}]}, 0x44}}, 0x1) r2 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r2, 0x1276, 0x0) 20:26:54 executing program 5: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x214000, 0x0) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000040)=0xac) (async) r1 = syz_open_dev$sg(&(0x7f0000000080), 0xfffffffffffffffe, 0x480) ioctl$SG_GET_KEEP_ORPHAN(r1, 0x2288, &(0x7f00000000c0)) (async) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r1, 0x2) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_GET_PCI(r2, 0x5387, &(0x7f0000000100)) (async) ioctl$SG_GET_COMMAND_Q(r1, 0x1267, 0x0) (async) ioctl$EVIOCGREP(r0, 0x80084503, &(0x7f0000000140)=""/159) 20:26:54 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) io_uring_register$IORING_UNREGISTER_BUFFERS(r1, 0x1, 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) 20:26:54 executing program 0: socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) sendmsg$NL80211_CMD_RADAR_DETECT(r1, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r0, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_SET_PMKSA(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x44, r0, 0x10, 0x70bd28, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_PMKID={0x14, 0x55, "c596efc225b0b491557679ac45116825"}, @NL80211_ATTR_PMK_LIFETIME={0x8, 0x11f, 0x8001}, @NL80211_ATTR_PMK={0x14, 0xfe, "7d91ebaf04c40e02628002b750021990"}]}, 0x44}}, 0x1) r2 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r2, 0x1276, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) sendmsg$NL80211_CMD_RADAR_DETECT(r1, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r0, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}}, 0x0) (async) sendmsg$NL80211_CMD_SET_PMKSA(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x44, r0, 0x10, 0x70bd28, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_PMKID={0x14, 0x55, "c596efc225b0b491557679ac45116825"}, @NL80211_ATTR_PMK_LIFETIME={0x8, 0x11f, 0x8001}, @NL80211_ATTR_PMK={0x14, 0xfe, "7d91ebaf04c40e02628002b750021990"}]}, 0x44}}, 0x1) (async) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r2, 0x1276, 0x0) (async) 20:26:54 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYRES16=r1, @ANYBLOB="0100000000000000000002"], 0x1c}}, 0x0) 20:26:54 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) (async) 20:26:54 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) io_uring_register$IORING_UNREGISTER_BUFFERS(r1, 0x1, 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) io_uring_register$IORING_UNREGISTER_BUFFERS(r1, 0x1, 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) 20:26:54 executing program 5: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x214000, 0x0) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000040)=0xac) (async) r1 = syz_open_dev$sg(&(0x7f0000000080), 0xfffffffffffffffe, 0x480) ioctl$SG_GET_KEEP_ORPHAN(r1, 0x2288, &(0x7f00000000c0)) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r1, 0x2) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SCSI_IOCTL_GET_PCI(r2, 0x5387, &(0x7f0000000100)) (async) ioctl$SG_GET_COMMAND_Q(r1, 0x1267, 0x0) (async, rerun: 64) ioctl$EVIOCGREP(r0, 0x80084503, &(0x7f0000000140)=""/159) (rerun: 64) [ 2106.449621][T29390] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:26:54 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000090000000001"], 0x1c}}, 0x0) 20:26:54 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) prctl$PR_MCE_KILL(0x15, 0x0, 0x0) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000000)=0x9b) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x240, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_KEEP_ORPHAN(r1, 0x2288, &(0x7f0000000040)) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:26:54 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0xfffffffffffffffd, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:26:54 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB="0100000000000000000002"], 0x1c}}, 0x0) 20:26:54 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) io_uring_register$IORING_UNREGISTER_BUFFERS(r1, 0x1, 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) io_uring_register$IORING_UNREGISTER_BUFFERS(r1, 0x1, 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) 20:26:54 executing program 0: socket$nl_generic(0x10, 0x3, 0x10) (async) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) sendmsg$NL80211_CMD_RADAR_DETECT(r1, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r0, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}}, 0x0) (async) sendmsg$NL80211_CMD_SET_PMKSA(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x44, r0, 0x10, 0x70bd28, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_PMKID={0x14, 0x55, "c596efc225b0b491557679ac45116825"}, @NL80211_ATTR_PMK_LIFETIME={0x8, 0x11f, 0x8001}, @NL80211_ATTR_PMK={0x14, 0xfe, "7d91ebaf04c40e02628002b750021990"}]}, 0x44}}, 0x1) r2 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r2, 0x1276, 0x0) 20:26:54 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) prctl$PR_MCE_KILL(0x15, 0x0, 0x0) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000000)=0x9b) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x240, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_GET_KEEP_ORPHAN(r1, 0x2288, &(0x7f0000000040)) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:26:54 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0xfffffffffffffffd, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0xfffffffffffffffd, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) 20:26:54 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB="0100000000000000000002"], 0x1c}}, 0x0) 20:26:54 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x400000, 0x0) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f0000000040)) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) 20:26:54 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000a0000000001"], 0x1c}}, 0x0) [ 2106.537302][T29427] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:26:54 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) prctl$PR_MCE_KILL(0x15, 0x0, 0x0) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000000)=0x9b) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x240, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_KEEP_ORPHAN(r1, 0x2288, &(0x7f0000000040)) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) prctl$PR_MCE_KILL(0x15, 0x0, 0x0) (async) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000000)=0x9b) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x240, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_GET_KEEP_ORPHAN(r1, 0x2288, &(0x7f0000000040)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) 20:26:54 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB="0100000000000000000002"], 0x1c}}, 0x0) 20:26:54 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r1 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_TTY(r1, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x10}, 0x10}}, 0x0) sendmsg$AUDIT_SET_FEATURE(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x20, 0x3fa, 0x200, 0x70bd28, 0x25dfdbff, {0x1, 0x0, 0x1, 0x1}, ["", "", "", "", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x800) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r2, 0x2) 20:26:54 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0xfffffffffffffffd, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:26:54 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x400000, 0x0) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f0000000040)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) 20:26:54 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x1, 0xd1c9664ed0af5900) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:26:54 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c00", @ANYRES16=r1, @ANYBLOB="0100000000000000000002"], 0x1c}}, 0x0) 20:26:54 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000b0000000001"], 0x1c}}, 0x0) [ 2106.612593][T29456] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:26:54 executing program 5: sendmsg$AUDIT_GET(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10008}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x3e8, 0x1, 0x70bd2a, 0x25dfdbfe, "", ["", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x81}, 0x40010) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000100), 0x8) sendmsg$AUDIT_TTY_SET(r1, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x18, 0x3f9, 0x100, 0x70bd29, 0x25dfdbfe, {0x1}, [""]}, 0x18}, 0x1, 0x0, 0x0, 0x4000000}, 0x10) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:26:54 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r1 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_TTY(r1, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x10}, 0x10}}, 0x0) sendmsg$AUDIT_SET_FEATURE(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x20, 0x3fa, 0x200, 0x70bd28, 0x25dfdbff, {0x1, 0x0, 0x1, 0x1}, ["", "", "", "", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x800) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r2, 0x2) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) socket$nl_audit(0x10, 0x3, 0x9) (async) sendmsg$AUDIT_USER_TTY(r1, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x10}, 0x10}}, 0x0) (async) sendmsg$AUDIT_SET_FEATURE(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x20, 0x3fa, 0x200, 0x70bd28, 0x25dfdbff, {0x1, 0x0, 0x1, 0x1}, ["", "", "", "", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x800) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r2, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r2, 0x2) (async) 20:26:54 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x400000, 0x0) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f0000000040)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) 20:26:54 executing program 5: sendmsg$AUDIT_GET(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10008}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x3e8, 0x1, 0x70bd2a, 0x25dfdbfe, "", ["", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x81}, 0x40010) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000100), 0x8) sendmsg$AUDIT_TTY_SET(r1, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x18, 0x3f9, 0x100, 0x70bd29, 0x25dfdbfe, {0x1}, [""]}, 0x18}, 0x1, 0x0, 0x0, 0x4000000}, 0x10) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) sendmsg$AUDIT_GET(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10008}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x3e8, 0x1, 0x70bd2a, 0x25dfdbfe, "", ["", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x81}, 0x40010) (async) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000100), 0x8) (async) sendmsg$AUDIT_TTY_SET(r1, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x18, 0x3f9, 0x100, 0x70bd29, 0x25dfdbfe, {0x1}, [""]}, 0x18}, 0x1, 0x0, 0x0, 0x4000000}, 0x10) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) 20:26:54 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c00", @ANYRES16=r1, @ANYBLOB="0100000000000000000002"], 0x1c}}, 0x0) 20:26:54 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c00", @ANYRES16=r1, @ANYBLOB="0100000000000000000002"], 0x1c}}, 0x0) 20:26:54 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x1, 0xd1c9664ed0af5900) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x1, 0xd1c9664ed0af5900) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) 20:26:54 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r1 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_TTY(r1, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x10}, 0x10}}, 0x0) sendmsg$AUDIT_SET_FEATURE(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x20, 0x3fa, 0x200, 0x70bd28, 0x25dfdbff, {0x1, 0x0, 0x1, 0x1}, ["", "", "", "", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x800) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r2, 0x2) 20:26:54 executing program 2: ioctl$SG_SET_DEBUG(0xffffffffffffffff, 0x227e, &(0x7f0000000000)) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) 20:26:54 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000c0000000001"], 0x1c}}, 0x0) 20:26:54 executing program 2: ioctl$SG_SET_DEBUG(0xffffffffffffffff, 0x227e, &(0x7f0000000000)) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) ioctl$SG_SET_DEBUG(0xffffffffffffffff, 0x227e, &(0x7f0000000000)) (async) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) 20:26:54 executing program 5: sendmsg$AUDIT_GET(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10008}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x3e8, 0x1, 0x70bd2a, 0x25dfdbfe, "", ["", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x81}, 0x40010) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000100), 0x8) sendmsg$AUDIT_TTY_SET(r1, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x18, 0x3f9, 0x100, 0x70bd29, 0x25dfdbfe, {0x1}, [""]}, 0x18}, 0x1, 0x0, 0x0, 0x4000000}, 0x10) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) sendmsg$AUDIT_GET(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10008}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x3e8, 0x1, 0x70bd2a, 0x25dfdbfe, "", ["", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x81}, 0x40010) (async) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000100), 0x8) (async) sendmsg$AUDIT_TTY_SET(r1, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x18, 0x3f9, 0x100, 0x70bd29, 0x25dfdbfe, {0x1}, [""]}, 0x18}, 0x1, 0x0, 0x0, 0x4000000}, 0x10) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) [ 2106.696290][T29493] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:26:54 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x1, 0xd1c9664ed0af5900) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:26:54 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c0000", @ANYRES16=r1, @ANYBLOB="0100000000000000000002"], 0x1c}}, 0x0) 20:26:54 executing program 0: sendmsg$AUDIT_LIST_RULES(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x3f5, 0x400, 0x70bd2b, 0x25dfdbfb, "", ["", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x4000}, 0x40041) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:26:54 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000d0000000001"], 0x1c}}, 0x0) 20:26:54 executing program 2: ioctl$SG_SET_DEBUG(0xffffffffffffffff, 0x227e, &(0x7f0000000000)) (async) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) 20:26:54 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f0000000000)) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:26:54 executing program 0: sendmsg$AUDIT_LIST_RULES(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x3f5, 0x400, 0x70bd2b, 0x25dfdbfb, "", ["", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x4000}, 0x40041) (async) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:26:54 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c0000", @ANYRES16=r1, @ANYBLOB="0100000000000000000002"], 0x1c}}, 0x0) 20:26:54 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x20000) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x2) sendmsg$AUDIT_GET_FEATURE(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x10, 0x3fb, 0x2, 0x70bd2a, 0x25dfdbfc, "", ["", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x4048801}, 0x20000000) 20:26:54 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000260d0000000001"], 0x1c}}, 0x0) 20:26:54 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f0000000000)) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:26:54 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f0000000000)={0x59, 0xa7dc, 0x90, "c3ce4220184191e043baed0a83ebb4acd50cba82e92915ed1ca47aeac562130bdfd1f6f27db28d8fb6eb6a982d39b9f966ad40cb00bb8285a0319eaaa5c2344cac27acee2e973a7e1230becd94b33504ef5d5fa817fafebae1"}) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f00000000c0)=0x1) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000100)) 20:26:54 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x20000) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x2) sendmsg$AUDIT_GET_FEATURE(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x10, 0x3fb, 0x2, 0x70bd2a, 0x25dfdbfc, "", ["", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x4048801}, 0x20000000) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x20000) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x2) (async) sendmsg$AUDIT_GET_FEATURE(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x10, 0x3fb, 0x2, 0x70bd2a, 0x25dfdbfc, "", ["", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x4048801}, 0x20000000) (async) 20:26:54 executing program 0: sendmsg$AUDIT_LIST_RULES(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x3f5, 0x400, 0x70bd2b, 0x25dfdbfb, "", ["", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x4000}, 0x40041) (async) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:26:54 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000e0000000001"], 0x1c}}, 0x0) 20:26:54 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f0000000000)) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:26:54 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c0000", @ANYRES16=r1, @ANYBLOB="0100000000000000000002"], 0x1c}}, 0x0) 20:26:54 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x20000) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async, rerun: 64) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x2) (async, rerun: 64) sendmsg$AUDIT_GET_FEATURE(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x10, 0x3fb, 0x2, 0x70bd2a, 0x25dfdbfc, "", ["", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x4048801}, 0x20000000) 20:26:54 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r0, 0x2) sendmsg$AUDIT_GET_FEATURE(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)={0x10, 0x3fb, 0x100, 0x70bd26, 0x25dfdbfe, "", ["", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x20040011}, 0x4000) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r2) ioctl$SG_GET_COMMAND_Q(r0, 0x2270, &(0x7f0000000000)) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:26:54 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_RESERVED_SIZE(r1, 0x2272, &(0x7f0000000000)) 20:26:54 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000000000000"], 0x1c}}, 0x0) 20:26:54 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f0000000000)={0x59, 0xa7dc, 0x90, "c3ce4220184191e043baed0a83ebb4acd50cba82e92915ed1ca47aeac562130bdfd1f6f27db28d8fb6eb6a982d39b9f966ad40cb00bb8285a0319eaaa5c2344cac27acee2e973a7e1230becd94b33504ef5d5fa817fafebae1"}) (async, rerun: 64) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f00000000c0)=0x1) (async, rerun: 64) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000100)) 20:26:54 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_RESERVED_SIZE(r1, 0x2272, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_GET_RESERVED_SIZE(r1, 0x2272, &(0x7f0000000000)) (async) 20:26:54 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000f0000000001"], 0x1c}}, 0x0) 20:26:54 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x800) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000000)) 20:26:54 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x7, 0x2) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r4, 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r4, 0x227d, &(0x7f0000000200)) r5 = syz_open_dev$sg(&(0x7f0000000080), 0x8da, 0x92f35affcdeb55e0) ioctl$SG_GET_SCSI_ID(r5, 0x2276, &(0x7f0000000140)) r6 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/thread-self/attr/sockcreate\x00', 0x2, 0x0) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f00000001c0)=0xdb) write$selinux_attr(r6, &(0x7f0000000180)='system_u:object_r:udev_helper_exec_t:s0\x00', 0x28) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f0000000100)=0x1) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:26:54 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f0000000000)={0x59, 0xa7dc, 0x90, "c3ce4220184191e043baed0a83ebb4acd50cba82e92915ed1ca47aeac562130bdfd1f6f27db28d8fb6eb6a982d39b9f966ad40cb00bb8285a0319eaaa5c2344cac27acee2e973a7e1230becd94b33504ef5d5fa817fafebae1"}) (async) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f00000000c0)=0x1) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000100)) 20:26:54 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r0, 0x2) sendmsg$AUDIT_GET_FEATURE(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)={0x10, 0x3fb, 0x100, 0x70bd26, 0x25dfdbfe, "", ["", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x20040011}, 0x4000) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) (async) syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r2) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x2270, &(0x7f0000000000)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:26:54 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000110000000001"], 0x1c}}, 0x0) 20:26:54 executing program 3: openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/attr/sockcreate\x00', 0x2, 0x0) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x800, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_PMKSA(r1, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x50, 0x0, 0x2, 0x70bd25, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x200, 0x15}}}}, [@NL80211_ATTR_SSID={0xa, 0x34, @random="ba0aedc37fdb"}, @NL80211_ATTR_FILS_CACHE_ID={0x6, 0xfd, 0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @random="75ff29b79423"}, @NL80211_ATTR_FILS_CACHE_ID={0x6, 0xfd, 0xff}]}, 0x50}, 0x1, 0x0, 0x0, 0x4005}, 0x4) 20:26:54 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0xffffffffffffffff, 0x0) (async) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x7, 0x2) (async) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r4, 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r4, 0x227d, &(0x7f0000000200)) (async) r5 = syz_open_dev$sg(&(0x7f0000000080), 0x8da, 0x92f35affcdeb55e0) ioctl$SG_GET_SCSI_ID(r5, 0x2276, &(0x7f0000000140)) (async) r6 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/thread-self/attr/sockcreate\x00', 0x2, 0x0) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f00000001c0)=0xdb) (async) write$selinux_attr(r6, &(0x7f0000000180)='system_u:object_r:udev_helper_exec_t:s0\x00', 0x28) (async) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f0000000100)=0x1) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:26:54 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_GET_RESERVED_SIZE(r1, 0x2272, &(0x7f0000000000)) 20:26:54 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0xf8a42) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x101, 0x200100) 20:26:54 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r0, 0x2) sendmsg$AUDIT_GET_FEATURE(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)={0x10, 0x3fb, 0x100, 0x70bd26, 0x25dfdbfe, "", ["", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x20040011}, 0x4000) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r2) ioctl$SG_GET_COMMAND_Q(r0, 0x2270, &(0x7f0000000000)) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r0, 0x2) (async) sendmsg$AUDIT_GET_FEATURE(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)={0x10, 0x3fb, 0x100, 0x70bd26, 0x25dfdbfe, "", ["", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x20040011}, 0x4000) (async) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r2, 0x0, 0x0) (async) syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r2) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x2270, &(0x7f0000000000)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) 20:26:54 executing program 3: unshare(0x20040000) r0 = socket(0xa, 0x6, 0x0) unshare(0x44000000) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x29, 0x8, 0x0, 0x0) ioctl$EVIOCSABS20(0xffffffffffffffff, 0x401845e0, &(0x7f0000000000)={0x3, 0x20, 0x7f, 0x5, 0x6, 0x57}) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x1274, 0x0) 20:26:54 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000120000000001"], 0x1c}}, 0x0) 20:26:54 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x7, 0x2) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r4, 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r4, 0x227d, &(0x7f0000000200)) r5 = syz_open_dev$sg(&(0x7f0000000080), 0x8da, 0x92f35affcdeb55e0) ioctl$SG_GET_SCSI_ID(r5, 0x2276, &(0x7f0000000140)) r6 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/thread-self/attr/sockcreate\x00', 0x2, 0x0) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f00000001c0)=0xdb) write$selinux_attr(r6, &(0x7f0000000180)='system_u:object_r:udev_helper_exec_t:s0\x00', 0x28) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f0000000100)=0x1) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0xffffffffffffffff, 0x0) (async) syz_open_dev$sg(&(0x7f0000000040), 0x7, 0x2) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r2, 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r3, 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r4, 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r4, 0x227d, &(0x7f0000000200)) (async) syz_open_dev$sg(&(0x7f0000000080), 0x8da, 0x92f35affcdeb55e0) (async) ioctl$SG_GET_SCSI_ID(r5, 0x2276, &(0x7f0000000140)) (async) openat$selinux_attr(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/thread-self/attr/sockcreate\x00', 0x2, 0x0) (async) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f00000001c0)=0xdb) (async) write$selinux_attr(r6, &(0x7f0000000180)='system_u:object_r:udev_helper_exec_t:s0\x00', 0x28) (async) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f0000000100)=0x1) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) 20:26:54 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_EMULATED_HOST(r0, 0x2203, &(0x7f00000000c0)) ioctl$SG_SET_KEEP_ORPHAN(r1, 0x2287, &(0x7f0000000000)=0xfffffffd) 20:26:54 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x2, 0x1) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) ioctl$SG_GET_RESERVED_SIZE(r0, 0x2272, &(0x7f0000000000)) ioctl$SG_EMULATED_HOST(r0, 0x2203, &(0x7f0000000040)) 20:26:54 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000250000000001"], 0x1c}}, 0x0) 20:26:54 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0xf8a42) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) syz_open_dev$sg(&(0x7f0000000000), 0x101, 0x200100) 20:26:54 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_EMULATED_HOST(r0, 0x2203, &(0x7f00000000c0)) (async) ioctl$SG_SET_KEEP_ORPHAN(r1, 0x2287, &(0x7f0000000000)=0xfffffffd) 20:26:54 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async, rerun: 64) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (rerun: 64) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_EMULATED_HOST(r0, 0x2203, &(0x7f00000000c0)) ioctl$SG_SET_KEEP_ORPHAN(r1, 0x2287, &(0x7f0000000000)=0xfffffffd) 20:26:55 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0xf8a42) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x101, 0x200100) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0xf8a42) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) syz_open_dev$sg(&(0x7f0000000000), 0x101, 0x200100) (async) 20:26:55 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x2, 0x1) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) ioctl$SG_GET_RESERVED_SIZE(r0, 0x2272, &(0x7f0000000000)) ioctl$SG_EMULATED_HOST(r0, 0x2203, &(0x7f0000000040)) syz_open_dev$sg(&(0x7f0000000380), 0x2, 0x1) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) ioctl$SG_GET_RESERVED_SIZE(r0, 0x2272, &(0x7f0000000000)) (async) ioctl$SG_EMULATED_HOST(r0, 0x2203, &(0x7f0000000040)) (async) 20:26:55 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000d260000000001"], 0x1c}}, 0x0) 20:26:55 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0xa000) ioctl$SG_GET_RESERVED_SIZE(r0, 0x2272, &(0x7f0000000000)) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000040), 0xfffffffffffff580, 0x4c840) syz_open_dev$sg(&(0x7f0000000080), 0x3, 0x103000) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f0000000140)) ioctl$SG_SET_DEBUG(0xffffffffffffffff, 0x227e, &(0x7f0000000100)) syz_open_dev$sg(&(0x7f00000000c0), 0x52, 0x28000) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) 20:26:55 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f0000000000)) 20:26:55 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f0000000040)={0x44, 0x6d, 0x2, "76e2bdc7c6cb3c2fc3c3113d0d7eb1b9dc2f4921d42e57eb937f0a919ab79979a962f65b5c95d8e19afa0cdd4aaca705e047787e71d7d07a5352b8eb457f1d1271524a34"}) 20:26:55 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000480000000001"], 0x1c}}, 0x0) 20:26:55 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x2, 0x1) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) ioctl$SG_GET_RESERVED_SIZE(r0, 0x2272, &(0x7f0000000000)) ioctl$SG_EMULATED_HOST(r0, 0x2203, &(0x7f0000000040)) 20:26:55 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x100) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) 20:26:55 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0xa000) ioctl$SG_GET_RESERVED_SIZE(r0, 0x2272, &(0x7f0000000000)) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000040), 0xfffffffffffff580, 0x4c840) syz_open_dev$sg(&(0x7f0000000080), 0x3, 0x103000) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f0000000140)) ioctl$SG_SET_DEBUG(0xffffffffffffffff, 0x227e, &(0x7f0000000100)) syz_open_dev$sg(&(0x7f00000000c0), 0x52, 0x28000) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) 20:26:55 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f0000000040)={0x44, 0x6d, 0x2, "76e2bdc7c6cb3c2fc3c3113d0d7eb1b9dc2f4921d42e57eb937f0a919ab79979a962f65b5c95d8e19afa0cdd4aaca705e047787e71d7d07a5352b8eb457f1d1271524a34"}) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f0000000040)={0x44, 0x6d, 0x2, "76e2bdc7c6cb3c2fc3c3113d0d7eb1b9dc2f4921d42e57eb937f0a919ab79979a962f65b5c95d8e19afa0cdd4aaca705e047787e71d7d07a5352b8eb457f1d1271524a34"}) (async) 20:26:55 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f0000000000)) 20:26:55 executing program 0: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000080)={r1}, 0x8) write$vga_arbiter(r0, 0x0, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000000)=0xfffff001) openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0), 0x20000, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x200, 0x0) write$vga_arbiter(r4, 0x0, 0x0) ioctl$SG_GET_REQUEST_TABLE(r4, 0x2286, &(0x7f0000000140)) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000300), 0x55982, 0x0) ioctl$SG_SET_COMMAND_Q(r5, 0x2271, &(0x7f0000000340)) r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r6, 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0xfffffffffffffffb) ioctl$SG_SET_KEEP_ORPHAN(r2, 0x2287, &(0x7f00000002c0)=0x9) 20:26:55 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000004c0000000001"], 0x1c}}, 0x0) 20:26:55 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0xa000) ioctl$SG_GET_RESERVED_SIZE(r0, 0x2272, &(0x7f0000000000)) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000040), 0xfffffffffffff580, 0x4c840) syz_open_dev$sg(&(0x7f0000000080), 0x3, 0x103000) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f0000000140)) ioctl$SG_SET_DEBUG(0xffffffffffffffff, 0x227e, &(0x7f0000000100)) syz_open_dev$sg(&(0x7f00000000c0), 0x52, 0x28000) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) 20:26:55 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x100) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) 20:26:55 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f0000000000)) (async) 20:26:55 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000600000000001"], 0x1c}}, 0x0) 20:26:55 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f0000000040)={0x44, 0x6d, 0x2, "76e2bdc7c6cb3c2fc3c3113d0d7eb1b9dc2f4921d42e57eb937f0a919ab79979a962f65b5c95d8e19afa0cdd4aaca705e047787e71d7d07a5352b8eb457f1d1271524a34"}) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f0000000040)={0x44, 0x6d, 0x2, "76e2bdc7c6cb3c2fc3c3113d0d7eb1b9dc2f4921d42e57eb937f0a919ab79979a962f65b5c95d8e19afa0cdd4aaca705e047787e71d7d07a5352b8eb457f1d1271524a34"}) (async) 20:26:55 executing program 0: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000080)={r1}, 0x8) write$vga_arbiter(r0, 0x0, 0x0) (async) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000000)=0xfffff001) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0), 0x20000, 0x0) (async) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x200, 0x0) write$vga_arbiter(r4, 0x0, 0x0) ioctl$SG_GET_REQUEST_TABLE(r4, 0x2286, &(0x7f0000000140)) (async) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000300), 0x55982, 0x0) ioctl$SG_SET_COMMAND_Q(r5, 0x2271, &(0x7f0000000340)) (async) r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r6, 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0xfffffffffffffffb) ioctl$SG_SET_KEEP_ORPHAN(r2, 0x2287, &(0x7f00000002c0)=0x9) 20:26:55 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x100) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x100) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) 20:26:55 executing program 1: openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0xc0500, 0x0) syz_open_dev$sg(&(0x7f0000000040), 0xffffffff, 0x103480) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0xa000, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) r1 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_TTY(r1, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x10}, 0x10}}, 0x0) sendmsg$AUDIT_SET_FEATURE(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x20, 0x3fa, 0x1, 0x70bd2b, 0x25dfdbfe, {0x1, 0x0, 0x1, 0x1}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x800}, 0x88020) 20:26:55 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0xa000) ioctl$SG_GET_RESERVED_SIZE(r0, 0x2272, &(0x7f0000000000)) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) syz_open_dev$sg(&(0x7f0000000040), 0xfffffffffffff580, 0x4c840) syz_open_dev$sg(&(0x7f0000000080), 0x3, 0x103000) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f0000000140)) ioctl$SG_SET_DEBUG(0xffffffffffffffff, 0x227e, &(0x7f0000000100)) syz_open_dev$sg(&(0x7f00000000c0), 0x52, 0x28000) 20:26:55 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_GET_PCI(0xffffffffffffffff, 0x5387, &(0x7f0000000180)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$BINDER_CTL_ADD(r1, 0xc1086201, &(0x7f00000003c0)={'custom0\x00'}) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_GET_WPAN_PHY(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="04002bbd7000fddbdf250100000008000300", @ANYRES32=0x0, @ANYBLOB="08000300", @ANYRES32=0x0, @ANYBLOB="08000300", @ANYRES32=0x0, @ANYBLOB="08000300", @ANYRES32=0x0, @ANYBLOB="0800011aefc8de00000c000600030000000020c25b51a196f349c59d3d31f911300c361f7b15838ccda47f241fda8fcb1d7b97ab2cf18d51604398e85543eb50629b83d48afd893d026e6ac15e30773d696ad1aa4f0206f24da1fffded78ea87b2489df1771d000000000000", @ANYRES32=0x0, @ANYBLOB="0c0006000300000003000000"], 0x5c}, 0x1, 0x0, 0x0, 0x40080}, 0x10) 20:26:55 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000680000000001"], 0x1c}}, 0x0) 20:26:55 executing program 0: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000080)={r1}, 0x8) write$vga_arbiter(r0, 0x0, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000000)=0xfffff001) (async, rerun: 64) openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0), 0x20000, 0x0) (async, rerun: 64) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) (async) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x200, 0x0) write$vga_arbiter(r4, 0x0, 0x0) (async) ioctl$SG_GET_REQUEST_TABLE(r4, 0x2286, &(0x7f0000000140)) (async) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000300), 0x55982, 0x0) ioctl$SG_SET_COMMAND_Q(r5, 0x2271, &(0x7f0000000340)) (async) r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r6, 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0xfffffffffffffffb) (async) ioctl$SG_SET_KEEP_ORPHAN(r2, 0x2287, &(0x7f00000002c0)=0x9) 20:26:55 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000006c0000000001"], 0x1c}}, 0x0) 20:26:55 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0xa000) ioctl$SG_GET_RESERVED_SIZE(r0, 0x2272, &(0x7f0000000000)) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) syz_open_dev$sg(&(0x7f0000000040), 0xfffffffffffff580, 0x4c840) syz_open_dev$sg(&(0x7f0000000080), 0x3, 0x103000) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f0000000140)) ioctl$SG_SET_DEBUG(0xffffffffffffffff, 0x227e, &(0x7f0000000100)) 20:26:55 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SCSI_IOCTL_GET_PCI(0xffffffffffffffff, 0x5387, &(0x7f0000000180)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$BINDER_CTL_ADD(r1, 0xc1086201, &(0x7f00000003c0)={'custom0\x00'}) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_GET_WPAN_PHY(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="04002bbd7000fddbdf250100000008000300", @ANYRES32=0x0, @ANYBLOB="08000300", @ANYRES32=0x0, @ANYBLOB="08000300", @ANYRES32=0x0, @ANYBLOB="08000300", @ANYRES32=0x0, @ANYBLOB="0800011aefc8de00000c000600030000000020c25b51a196f349c59d3d31f911300c361f7b15838ccda47f241fda8fcb1d7b97ab2cf18d51604398e85543eb50629b83d48afd893d026e6ac15e30773d696ad1aa4f0206f24da1fffded78ea87b2489df1771d000000000000", @ANYRES32=0x0, @ANYBLOB="0c0006000300000003000000"], 0x5c}, 0x1, 0x0, 0x0, 0x40080}, 0x10) 20:26:55 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000100), 0x8, 0x80000) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000140)) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x5, 0x40000) ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f0000000040)) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) setsockopt$bt_hci_HCI_FILTER(0xffffffffffffffff, 0x0, 0x2, &(0x7f00000000c0)={0x40, [0xd9, 0x8]}, 0x10) 20:26:55 executing program 1: openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0xc0500, 0x0) syz_open_dev$sg(&(0x7f0000000040), 0xffffffff, 0x103480) (async) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0xa000, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) r1 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_TTY(r1, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x10}, 0x10}}, 0x0) (async) sendmsg$AUDIT_SET_FEATURE(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x20, 0x3fa, 0x1, 0x70bd2b, 0x25dfdbfe, {0x1, 0x0, 0x1, 0x1}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x800}, 0x88020) 20:26:55 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SCSI_IOCTL_SYNC(r1, 0x4) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000000)=0x46) 20:26:55 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000100), 0x8, 0x80000) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000140)) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x5, 0x40000) ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f0000000040)) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) setsockopt$bt_hci_HCI_FILTER(0xffffffffffffffff, 0x0, 0x2, &(0x7f00000000c0)={0x40, [0xd9, 0x8]}, 0x10) syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) (async) syz_open_dev$sg(&(0x7f0000000100), 0x8, 0x80000) (async) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000140)) (async) syz_open_dev$sg(&(0x7f0000000000), 0x5, 0x40000) (async) ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f0000000040)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) setsockopt$bt_hci_HCI_FILTER(0xffffffffffffffff, 0x0, 0x2, &(0x7f00000000c0)={0x40, [0xd9, 0x8]}, 0x10) (async) 20:26:55 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0xa000) ioctl$SG_GET_RESERVED_SIZE(r0, 0x2272, &(0x7f0000000000)) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) syz_open_dev$sg(&(0x7f0000000040), 0xfffffffffffff580, 0x4c840) syz_open_dev$sg(&(0x7f0000000080), 0x3, 0x103000) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f0000000140)) 20:26:55 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_GET_PCI(0xffffffffffffffff, 0x5387, &(0x7f0000000180)) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$BINDER_CTL_ADD(r1, 0xc1086201, &(0x7f00000003c0)={'custom0\x00'}) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_GET_WPAN_PHY(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="04002bbd7000fddbdf250100000008000300", @ANYRES32=0x0, @ANYBLOB="08000300", @ANYRES32=0x0, @ANYBLOB="08000300", @ANYRES32=0x0, @ANYBLOB="08000300", @ANYRES32=0x0, @ANYBLOB="0800011aefc8de00000c000600030000000020c25b51a196f349c59d3d31f911300c361f7b15838ccda47f241fda8fcb1d7b97ab2cf18d51604398e85543eb50629b83d48afd893d026e6ac15e30773d696ad1aa4f0206f24da1fffded78ea87b2489df1771d000000000000", @ANYRES32=0x0, @ANYBLOB="0c0006000300000003000000"], 0x5c}, 0x1, 0x0, 0x0, 0x40080}, 0x10) 20:26:55 executing program 1: openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0xc0500, 0x0) syz_open_dev$sg(&(0x7f0000000040), 0xffffffff, 0x103480) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0xa000, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) r1 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_TTY(r1, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x10}, 0x10}}, 0x0) sendmsg$AUDIT_SET_FEATURE(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x20, 0x3fa, 0x1, 0x70bd2b, 0x25dfdbfe, {0x1, 0x0, 0x1, 0x1}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x800}, 0x88020) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0xc0500, 0x0) (async) syz_open_dev$sg(&(0x7f0000000040), 0xffffffff, 0x103480) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0xa000, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) socket$nl_audit(0x10, 0x3, 0x9) (async) sendmsg$AUDIT_USER_TTY(r1, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x10}, 0x10}}, 0x0) (async) sendmsg$AUDIT_SET_FEATURE(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x20, 0x3fa, 0x1, 0x70bd2b, 0x25dfdbfe, {0x1, 0x0, 0x1, 0x1}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x800}, 0x88020) (async) 20:26:55 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SCSI_IOCTL_SYNC(r1, 0x4) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000000)=0x46) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_SYNC(r1, 0x4) (async) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000000)=0x46) (async) 20:26:55 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000740000000001"], 0x1c}}, 0x0) 20:26:55 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000100), 0x8, 0x80000) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000140)) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x5, 0x40000) ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f0000000040)) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) setsockopt$bt_hci_HCI_FILTER(0xffffffffffffffff, 0x0, 0x2, &(0x7f00000000c0)={0x40, [0xd9, 0x8]}, 0x10) syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) (async) syz_open_dev$sg(&(0x7f0000000100), 0x8, 0x80000) (async) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000140)) (async) syz_open_dev$sg(&(0x7f0000000000), 0x5, 0x40000) (async) ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f0000000040)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) setsockopt$bt_hci_HCI_FILTER(0xffffffffffffffff, 0x0, 0x2, &(0x7f00000000c0)={0x40, [0xd9, 0x8]}, 0x10) (async) 20:26:55 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_TIMEOUT(r1, 0x2202, 0x0) 20:26:55 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0xa000) ioctl$SG_GET_RESERVED_SIZE(r0, 0x2272, &(0x7f0000000000)) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) syz_open_dev$sg(&(0x7f0000000040), 0xfffffffffffff580, 0x4c840) syz_open_dev$sg(&(0x7f0000000080), 0x3, 0x103000) 20:26:55 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SCSI_IOCTL_SYNC(r1, 0x4) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000000)=0x46) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_SYNC(r1, 0x4) (async) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000000)=0x46) (async) 20:26:55 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_RESERVED_SIZE(r0, 0x2272, &(0x7f0000000000)) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:26:55 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000007a0000000001"], 0x1c}}, 0x0) 20:26:55 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0xa000) ioctl$SG_GET_RESERVED_SIZE(r0, 0x2272, &(0x7f0000000000)) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) syz_open_dev$sg(&(0x7f0000000040), 0xfffffffffffff580, 0x4c840) 20:26:55 executing program 2: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) 20:26:55 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_TIMEOUT(r1, 0x2202, 0x0) 20:26:55 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_RESERVED_SIZE(r0, 0x2272, &(0x7f0000000000)) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_RESERVED_SIZE(r0, 0x2272, &(0x7f0000000000)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) 20:26:55 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000300000001"], 0x1c}}, 0x0) 20:26:55 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0xa000) ioctl$SG_GET_RESERVED_SIZE(r0, 0x2272, &(0x7f0000000000)) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) 20:26:55 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_TIMEOUT(r1, 0x2202, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_GET_TIMEOUT(r1, 0x2202, 0x0) (async) 20:26:55 executing program 2: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) 20:26:55 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_RESERVED_SIZE(r0, 0x2272, &(0x7f0000000000)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:26:55 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$EVIOCSMASK(r1, 0x40104593, &(0x7f0000000200)={0x5, 0x4a, &(0x7f0000000240)="9f6df12a41aec8496084f3656a2172eeff07649e29d66b32bf2e470decc65efedbb0ab2d662891cf2fdbc4666b1bdbe790f7f956206a7054f134e132ee1cb1d25910caa464822dd3562e"}) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r2, 0x1, &(0x7f00000002c0)={0x56, 0x0, 0x1, "64165759e08e8d3e38515c39bf631ab96ab737d7fcf5ef3c4516e226517c60d61aaaf404e5ea314713cc5f1d1ee78ceed9b6f0b5c5339b38be427ee1f8282c03a8276a496af76776295c1d0ac7833748079f545723a9"}) write$vga_arbiter(r2, 0x0, 0x0) write$nbd(r2, &(0x7f0000000080)={0x67446698, 0x0, 0x0, 0x1, 0x1, "b4ce54f1af156a443e39717668cbf8edc74445f10fc85277005d49843b3ab804d52d38db07841018cd43185905e8588990f0810a8705af4eb3d7198f664f4d9cc923d3512672b987958afa48eff464f6b46ad47c4a360334e9207eb3dfeb174a78d43a66744e94c2e7b49d2de4b90cb7bb46408203f738866c8689f24e13cf7106827651c6755a440a4088c2e488705070475279d2b222425d1806cb1f74d5d81f338c29d45f4144515652f5bb7b99ee24f4507e7b33b53f63a5cd0eaa56a398901c6bf7c332423dfc077dc57c52dab328ab2253fe2d10b1c42e64a1340e6f38b350e133835a413e492ddaa2838120f69a83"}, 0x102) ioctl$EVIOCGABS3F(r2, 0x8018457f, &(0x7f00000001c0)=""/14) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:26:55 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0xa000) ioctl$SG_GET_RESERVED_SIZE(r0, 0x2272, &(0x7f0000000000)) 20:26:55 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$EVIOCSMASK(r1, 0x40104593, &(0x7f0000000200)={0x5, 0x4a, &(0x7f0000000240)="9f6df12a41aec8496084f3656a2172eeff07649e29d66b32bf2e470decc65efedbb0ab2d662891cf2fdbc4666b1bdbe790f7f956206a7054f134e132ee1cb1d25910caa464822dd3562e"}) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r2, 0x1, &(0x7f00000002c0)={0x56, 0x0, 0x1, "64165759e08e8d3e38515c39bf631ab96ab737d7fcf5ef3c4516e226517c60d61aaaf404e5ea314713cc5f1d1ee78ceed9b6f0b5c5339b38be427ee1f8282c03a8276a496af76776295c1d0ac7833748079f545723a9"}) write$vga_arbiter(r2, 0x0, 0x0) write$nbd(r2, &(0x7f0000000080)={0x67446698, 0x0, 0x0, 0x1, 0x1, "b4ce54f1af156a443e39717668cbf8edc74445f10fc85277005d49843b3ab804d52d38db07841018cd43185905e8588990f0810a8705af4eb3d7198f664f4d9cc923d3512672b987958afa48eff464f6b46ad47c4a360334e9207eb3dfeb174a78d43a66744e94c2e7b49d2de4b90cb7bb46408203f738866c8689f24e13cf7106827651c6755a440a4088c2e488705070475279d2b222425d1806cb1f74d5d81f338c29d45f4144515652f5bb7b99ee24f4507e7b33b53f63a5cd0eaa56a398901c6bf7c332423dfc077dc57c52dab328ab2253fe2d10b1c42e64a1340e6f38b350e133835a413e492ddaa2838120f69a83"}, 0x102) ioctl$EVIOCGABS3F(r2, 0x8018457f, &(0x7f00000001c0)=""/14) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$EVIOCSMASK(r1, 0x40104593, &(0x7f0000000200)={0x5, 0x4a, &(0x7f0000000240)="9f6df12a41aec8496084f3656a2172eeff07649e29d66b32bf2e470decc65efedbb0ab2d662891cf2fdbc4666b1bdbe790f7f956206a7054f134e132ee1cb1d25910caa464822dd3562e"}) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$SCSI_IOCTL_SEND_COMMAND(r2, 0x1, &(0x7f00000002c0)={0x56, 0x0, 0x1, "64165759e08e8d3e38515c39bf631ab96ab737d7fcf5ef3c4516e226517c60d61aaaf404e5ea314713cc5f1d1ee78ceed9b6f0b5c5339b38be427ee1f8282c03a8276a496af76776295c1d0ac7833748079f545723a9"}) (async) write$vga_arbiter(r2, 0x0, 0x0) (async) write$nbd(r2, &(0x7f0000000080)={0x67446698, 0x0, 0x0, 0x1, 0x1, "b4ce54f1af156a443e39717668cbf8edc74445f10fc85277005d49843b3ab804d52d38db07841018cd43185905e8588990f0810a8705af4eb3d7198f664f4d9cc923d3512672b987958afa48eff464f6b46ad47c4a360334e9207eb3dfeb174a78d43a66744e94c2e7b49d2de4b90cb7bb46408203f738866c8689f24e13cf7106827651c6755a440a4088c2e488705070475279d2b222425d1806cb1f74d5d81f338c29d45f4144515652f5bb7b99ee24f4507e7b33b53f63a5cd0eaa56a398901c6bf7c332423dfc077dc57c52dab328ab2253fe2d10b1c42e64a1340e6f38b350e133835a413e492ddaa2838120f69a83"}, 0x102) (async) ioctl$EVIOCGABS3F(r2, 0x8018457f, &(0x7f00000001c0)=""/14) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) 20:26:55 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000400300000001"], 0x1c}}, 0x0) 20:26:55 executing program 5: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r0 = syz_open_dev$sg(&(0x7f0000000000), 0x40, 0x101000) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:26:55 executing program 2: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) 20:26:55 executing program 1: bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:26:55 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000034000000001"], 0x1c}}, 0x0) 20:26:55 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) socket$packet(0x11, 0x2, 0x300) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) 20:26:55 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$EVIOCSMASK(r1, 0x40104593, &(0x7f0000000200)={0x5, 0x4a, &(0x7f0000000240)="9f6df12a41aec8496084f3656a2172eeff07649e29d66b32bf2e470decc65efedbb0ab2d662891cf2fdbc4666b1bdbe790f7f956206a7054f134e132ee1cb1d25910caa464822dd3562e"}) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r2, 0x1, &(0x7f00000002c0)={0x56, 0x0, 0x1, "64165759e08e8d3e38515c39bf631ab96ab737d7fcf5ef3c4516e226517c60d61aaaf404e5ea314713cc5f1d1ee78ceed9b6f0b5c5339b38be427ee1f8282c03a8276a496af76776295c1d0ac7833748079f545723a9"}) (async) write$vga_arbiter(r2, 0x0, 0x0) (async) write$nbd(r2, &(0x7f0000000080)={0x67446698, 0x0, 0x0, 0x1, 0x1, "b4ce54f1af156a443e39717668cbf8edc74445f10fc85277005d49843b3ab804d52d38db07841018cd43185905e8588990f0810a8705af4eb3d7198f664f4d9cc923d3512672b987958afa48eff464f6b46ad47c4a360334e9207eb3dfeb174a78d43a66744e94c2e7b49d2de4b90cb7bb46408203f738866c8689f24e13cf7106827651c6755a440a4088c2e488705070475279d2b222425d1806cb1f74d5d81f338c29d45f4144515652f5bb7b99ee24f4507e7b33b53f63a5cd0eaa56a398901c6bf7c332423dfc077dc57c52dab328ab2253fe2d10b1c42e64a1340e6f38b350e133835a413e492ddaa2838120f69a83"}, 0x102) ioctl$EVIOCGABS3F(r2, 0x8018457f, &(0x7f00000001c0)=""/14) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:26:55 executing program 1: bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:26:55 executing program 5: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r0 = syz_open_dev$sg(&(0x7f0000000000), 0x40, 0x101000) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) syz_open_dev$sg(&(0x7f0000000000), 0x40, 0x101000) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) 20:26:55 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000001000001"], 0x1c}}, 0x0) 20:26:55 executing program 3: ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000000)) 20:26:55 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x9, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x2270, &(0x7f0000000040)) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r2 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$PTP_ENABLE_PPS(r2, 0x40043d04, 0x0) ioctl$PTP_CLOCK_GETCAPS(r2, 0x80503d01, &(0x7f0000000080)) 20:26:55 executing program 3: ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000000)) 20:26:55 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000002000001"], 0x1c}}, 0x0) 20:26:55 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) socket$packet(0x11, 0x2, 0x300) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) 20:26:55 executing program 1: bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) (async) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) 20:26:55 executing program 5: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r0 = syz_open_dev$sg(&(0x7f0000000000), 0x40, 0x101000) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) syz_open_dev$sg(&(0x7f0000000000), 0x40, 0x101000) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) 20:26:55 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x9, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x2270, &(0x7f0000000040)) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r2 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$PTP_ENABLE_PPS(r2, 0x40043d04, 0x0) ioctl$PTP_CLOCK_GETCAPS(r2, 0x80503d01, &(0x7f0000000080)) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) syz_open_dev$sg(&(0x7f0000000000), 0x9, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r1, 0x2270, &(0x7f0000000040)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$PTP_ENABLE_PPS(r2, 0x40043d04, 0x0) (async) ioctl$PTP_CLOCK_GETCAPS(r2, 0x80503d01, &(0x7f0000000080)) (async) 20:26:55 executing program 3: ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000000)) 20:26:55 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000080)) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) ioctl$SG_GET_RESERVED_SIZE(r2, 0x2272, &(0x7f0000000040)) 20:26:55 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x9, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x2270, &(0x7f0000000040)) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r2 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$PTP_ENABLE_PPS(r2, 0x40043d04, 0x0) ioctl$PTP_CLOCK_GETCAPS(r2, 0x80503d01, &(0x7f0000000080)) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) syz_open_dev$sg(&(0x7f0000000000), 0x9, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r1, 0x2270, &(0x7f0000000040)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$PTP_ENABLE_PPS(r2, 0x40043d04, 0x0) (async) ioctl$PTP_CLOCK_GETCAPS(r2, 0x80503d01, &(0x7f0000000080)) (async) 20:26:55 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000140), 0x90900, 0x0) r1 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x0) ioctl$PTP_PIN_GETFUNC2(r1, 0xc0603d0f, &(0x7f00000001c0)={'\x00', 0x1, 0x1, 0x80}) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) write$vga_arbiter(r2, 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000080), 0x55, 0x202800) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$PTP_EXTTS_REQUEST(r3, 0x40103d02, &(0x7f0000000240)={0x3ff, 0x4}) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$PTP_ENABLE_PPS(r4, 0x40043d04, 0x0) ioctl$PTP_CLOCK_GETCAPS(r4, 0x80503d01, &(0x7f0000000280)) write$vga_arbiter(r3, 0x0, 0x0) ioctl$EVIOCGMASK(r3, 0x80104592, &(0x7f0000000100)={0x4, 0x32, &(0x7f00000000c0)="ddc534e88318ce79ddb7f523d1c6b50ecc3f97ee5e5bd12cfc70e89d30b7b10f96fea082506c7c20fdf71df8a0cda5fd1448"}) 20:26:55 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) socket$packet(0x11, 0x2, 0x300) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) 20:26:55 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000003000001"], 0x1c}}, 0x0) 20:26:55 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async, rerun: 64) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000080)) (rerun: 64) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) ioctl$SG_GET_RESERVED_SIZE(r2, 0x2272, &(0x7f0000000040)) 20:26:55 executing program 3: r0 = syz_open_dev$sg(0x0, 0x0, 0xa000) ioctl$SG_GET_RESERVED_SIZE(r0, 0x2272, &(0x7f0000000000)) 20:26:55 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000000)) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) 20:26:55 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000004000001"], 0x1c}}, 0x0) 20:26:55 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000140), 0x90900, 0x0) (async) r1 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x0) (async) ioctl$PTP_PIN_GETFUNC2(r1, 0xc0603d0f, &(0x7f00000001c0)={'\x00', 0x1, 0x1, 0x80}) (async) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) write$vga_arbiter(r2, 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000080), 0x55, 0x202800) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$PTP_EXTTS_REQUEST(r3, 0x40103d02, &(0x7f0000000240)={0x3ff, 0x4}) (async) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$PTP_ENABLE_PPS(r4, 0x40043d04, 0x0) (async) ioctl$PTP_CLOCK_GETCAPS(r4, 0x80503d01, &(0x7f0000000280)) (async) write$vga_arbiter(r3, 0x0, 0x0) (async) ioctl$EVIOCGMASK(r3, 0x80104592, &(0x7f0000000100)={0x4, 0x32, &(0x7f00000000c0)="ddc534e88318ce79ddb7f523d1c6b50ecc3f97ee5e5bd12cfc70e89d30b7b10f96fea082506c7c20fdf71df8a0cda5fd1448"}) 20:26:55 executing program 3: r0 = syz_open_dev$sg(0x0, 0x0, 0xa000) ioctl$SG_GET_RESERVED_SIZE(r0, 0x2272, &(0x7f0000000000)) 20:26:55 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000080)) (async) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) ioctl$SG_GET_RESERVED_SIZE(r2, 0x2272, &(0x7f0000000040)) 20:26:55 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x12800) clock_settime(0x7, &(0x7f0000000100)) ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000000)=""/138) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'wpan0\x00'}) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f00000004c0)={'wpan1\x00', 0x0}) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r5, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) sendmsg$NL802154_CMD_SET_ACKREQ_DEFAULT(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x30, r1, 0x100, 0x70bd2a, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x30}, 0x1, 0x0, 0x0, 0x2246408367513e55}, 0x20000000) r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r6, 0x0, 0x0) ioctl$SCSI_IOCTL_GET_PCI(r6, 0x5387, &(0x7f00000000c0)) r7 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140), 0xc0000, 0x0) ioctl$EVIOCREVOKE(r7, 0x40044591, &(0x7f0000000180)=0x5) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r8 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_TTY(r8, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x10}, 0x10}}, 0x0) sendmsg$AUDIT_SIGNAL_INFO(r8, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2040}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x10, 0x3f2, 0x200, 0x70bd2b, 0x25dfdbfc, "", ["", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x20040000}, 0x4004000) 20:26:55 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000000)) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) 20:26:55 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000005000001"], 0x1c}}, 0x0) 20:26:55 executing program 3: r0 = syz_open_dev$sg(0x0, 0x0, 0xa000) ioctl$SG_GET_RESERVED_SIZE(r0, 0x2272, &(0x7f0000000000)) 20:26:55 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x12800) clock_settime(0x7, &(0x7f0000000100)) (async) ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000000)=""/138) (async) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'wpan0\x00'}) (async) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f00000004c0)={'wpan1\x00', 0x0}) (async) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) (rerun: 32) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r5, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) (async, rerun: 32) sendmsg$NL802154_CMD_SET_ACKREQ_DEFAULT(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x30, r1, 0x100, 0x70bd2a, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x30}, 0x1, 0x0, 0x0, 0x2246408367513e55}, 0x20000000) (async, rerun: 32) r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r6, 0x0, 0x0) ioctl$SCSI_IOCTL_GET_PCI(r6, 0x5387, &(0x7f00000000c0)) r7 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140), 0xc0000, 0x0) ioctl$EVIOCREVOKE(r7, 0x40044591, &(0x7f0000000180)=0x5) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r8 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_TTY(r8, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x10}, 0x10}}, 0x0) sendmsg$AUDIT_SIGNAL_INFO(r8, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2040}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x10, 0x3f2, 0x200, 0x70bd2b, 0x25dfdbfc, "", ["", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x20040000}, 0x4004000) 20:26:55 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x80000) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r1, 0x2) 20:26:55 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000140), 0x90900, 0x0) r1 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x0) ioctl$PTP_PIN_GETFUNC2(r1, 0xc0603d0f, &(0x7f00000001c0)={'\x00', 0x1, 0x1, 0x80}) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) write$vga_arbiter(r2, 0x0, 0x0) (async) syz_open_dev$sg(&(0x7f0000000080), 0x55, 0x202800) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$PTP_EXTTS_REQUEST(r3, 0x40103d02, &(0x7f0000000240)={0x3ff, 0x4}) (async) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$PTP_ENABLE_PPS(r4, 0x40043d04, 0x0) (async) ioctl$PTP_CLOCK_GETCAPS(r4, 0x80503d01, &(0x7f0000000280)) (async) write$vga_arbiter(r3, 0x0, 0x0) (async) ioctl$EVIOCGMASK(r3, 0x80104592, &(0x7f0000000100)={0x4, 0x32, &(0x7f00000000c0)="ddc534e88318ce79ddb7f523d1c6b50ecc3f97ee5e5bd12cfc70e89d30b7b10f96fea082506c7c20fdf71df8a0cda5fd1448"}) 20:26:55 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async, rerun: 64) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (rerun: 64) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000000)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) 20:26:55 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000006000001"], 0x1c}}, 0x0) 20:26:55 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x80000) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r1, 0x2) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x80000) (async) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r1, 0x2) (async) 20:26:55 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_RESERVED_SIZE(r0, 0x2272, &(0x7f0000000000)) 20:26:55 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x80000) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x10402, 0x0) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000040)) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SG_GET_SCSI_ID(r2, 0x2276, &(0x7f00000001c0)) 20:26:55 executing program 3: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000000)) 20:26:55 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000007000001"], 0x1c}}, 0x0) 20:26:55 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x80000) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r1, 0x2) 20:26:55 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x80000) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x10402, 0x0) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000040)) (async) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SG_GET_SCSI_ID(r2, 0x2276, &(0x7f00000001c0)) 20:26:55 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x12800) (async) clock_settime(0x7, &(0x7f0000000100)) (async, rerun: 64) ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000000)=""/138) (async, rerun: 64) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'wpan0\x00'}) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f00000004c0)={'wpan1\x00', 0x0}) (async, rerun: 32) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r5, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) sendmsg$NL802154_CMD_SET_ACKREQ_DEFAULT(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x30, r1, 0x100, 0x70bd2a, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x30}, 0x1, 0x0, 0x0, 0x2246408367513e55}, 0x20000000) r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r6, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_GET_PCI(r6, 0x5387, &(0x7f00000000c0)) r7 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140), 0xc0000, 0x0) ioctl$EVIOCREVOKE(r7, 0x40044591, &(0x7f0000000180)=0x5) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r8 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_TTY(r8, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x10}, 0x10}}, 0x0) (async) sendmsg$AUDIT_SIGNAL_INFO(r8, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2040}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x10, 0x3f2, 0x200, 0x70bd2b, 0x25dfdbfc, "", ["", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x20040000}, 0x4004000) 20:26:55 executing program 2: sendmsg$AUDIT_SET_FEATURE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x20, 0x3fa, 0x400, 0x70bd26, 0x25dfdbfb, {0x1, 0x1, 0x1}, ["", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x4}, 0x10) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000000)=0x1) 20:26:55 executing program 3: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000000)) 20:26:55 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000008000001"], 0x1c}}, 0x0) 20:26:55 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x80000) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x10402, 0x0) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000040)) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) (async) ioctl$SG_GET_SCSI_ID(r2, 0x2276, &(0x7f00000001c0)) 20:26:55 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x7a5c00000000000, 0x400800) syz_open_dev$sg(&(0x7f0000000040), 0x7fff, 0x480200) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:26:55 executing program 3: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000000)) 20:26:55 executing program 2: sendmsg$AUDIT_SET_FEATURE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x20, 0x3fa, 0x400, 0x70bd26, 0x25dfdbfb, {0x1, 0x1, 0x1}, ["", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x4}, 0x10) (async) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000000)=0x1) 20:26:55 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0xfffffffffffffffd, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:26:55 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f0000000040)=0x2e, 0x4) 20:26:55 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x7a5c00000000000, 0x400800) syz_open_dev$sg(&(0x7f0000000040), 0x7fff, 0x480200) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) syz_open_dev$sg(&(0x7f0000000000), 0x7a5c00000000000, 0x400800) (async) syz_open_dev$sg(&(0x7f0000000040), 0x7fff, 0x480200) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) 20:26:55 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000009000001"], 0x1c}}, 0x0) 20:26:55 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000000a000001"], 0x1c}}, 0x0) 20:26:55 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_RESERVED_SIZE(r0, 0x2272, 0x0) 20:26:55 executing program 2: sendmsg$AUDIT_SET_FEATURE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x20, 0x3fa, 0x400, 0x70bd26, 0x25dfdbfb, {0x1, 0x1, 0x1}, ["", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x4}, 0x10) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000000)=0x1) sendmsg$AUDIT_SET_FEATURE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x20, 0x3fa, 0x400, 0x70bd26, 0x25dfdbfb, {0x1, 0x1, 0x1}, ["", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x4}, 0x10) (async) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000000)=0x1) (async) 20:26:55 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f0000000040)=0x2e, 0x4) 20:26:55 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x7a5c00000000000, 0x400800) syz_open_dev$sg(&(0x7f0000000040), 0x7fff, 0x480200) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) syz_open_dev$sg(&(0x7f0000000000), 0x7a5c00000000000, 0x400800) (async) syz_open_dev$sg(&(0x7f0000000040), 0x7fff, 0x480200) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) 20:26:55 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000000b000001"], 0x1c}}, 0x0) 20:26:55 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_RESERVED_SIZE(r0, 0x2272, 0x0) 20:26:55 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0xfffffffffffffffd, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:26:55 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x7ff, 0x48401) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) 20:26:55 executing program 1: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x40, 0x0) clock_gettime(0x0, &(0x7f00000000c0)={0x0, 0x0}) write$evdev(r0, &(0x7f0000000100)=[{{0x77359400}, 0x3, 0x20, 0x8}, {{r1, r2/1000+60000}, 0x2, 0x40, 0x7}, {{0x0, 0xea60}, 0x1, 0x80, 0x7f}, {{}, 0x16, 0x1, 0xffffffff}], 0x60) ioctl$PTP_PIN_GETFUNC2(0xffffffffffffffff, 0xc0603d0f, &(0x7f0000000000)={'\x00', 0x1000, 0x2, 0x5}) r3 = syz_open_dev$sg(&(0x7f0000000380), 0x4, 0x78900) ioctl$SG_GET_COMMAND_Q(r3, 0x1274, 0x0) 20:26:55 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x7ff, 0x48401) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x7ff, 0x48401) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) 20:26:55 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0xfffffffffffffffd, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) syz_open_dev$sg(&(0x7f0000000000), 0xfffffffffffffffd, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) 20:26:55 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f0000000040)=0x2e, 0x4) 20:26:55 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_RESERVED_SIZE(r0, 0x2272, 0x0) 20:26:55 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000000c000001"], 0x1c}}, 0x0) 20:26:56 executing program 1: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x40, 0x0) clock_gettime(0x0, &(0x7f00000000c0)={0x0, 0x0}) write$evdev(r0, &(0x7f0000000100)=[{{0x77359400}, 0x3, 0x20, 0x8}, {{r1, r2/1000+60000}, 0x2, 0x40, 0x7}, {{0x0, 0xea60}, 0x1, 0x80, 0x7f}, {{}, 0x16, 0x1, 0xffffffff}], 0x60) ioctl$PTP_PIN_GETFUNC2(0xffffffffffffffff, 0xc0603d0f, &(0x7f0000000000)={'\x00', 0x1000, 0x2, 0x5}) r3 = syz_open_dev$sg(&(0x7f0000000380), 0x4, 0x78900) ioctl$SG_GET_COMMAND_Q(r3, 0x1274, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x40, 0x0) (async) clock_gettime(0x0, &(0x7f00000000c0)) (async) write$evdev(r0, &(0x7f0000000100)=[{{0x77359400}, 0x3, 0x20, 0x8}, {{r1, r2/1000+60000}, 0x2, 0x40, 0x7}, {{0x0, 0xea60}, 0x1, 0x80, 0x7f}, {{}, 0x16, 0x1, 0xffffffff}], 0x60) (async) ioctl$PTP_PIN_GETFUNC2(0xffffffffffffffff, 0xc0603d0f, &(0x7f0000000000)={'\x00', 0x1000, 0x2, 0x5}) (async) syz_open_dev$sg(&(0x7f0000000380), 0x4, 0x78900) (async) ioctl$SG_GET_COMMAND_Q(r3, 0x1274, 0x0) (async) 20:26:56 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000000d000001"], 0x1c}}, 0x0) 20:26:56 executing program 0: r0 = syz_open_dev$sg(&(0x7f00000000c0), 0x3, 0x14200) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000080)) r2 = socket(0xa, 0x6, 0x0) setsockopt$bt_hci_HCI_TIME_STAMP(r2, 0x10d, 0x5, 0x0, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x401, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r3, 0x2287, &(0x7f0000000000)=0x7fffffff) 20:26:56 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000000)=0x62) 20:26:56 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x7ff, 0x48401) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x7ff, 0x48401) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) 20:26:56 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x2200, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r1, 0x2) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000080)) r2 = syz_open_dev$sg(&(0x7f0000000000), 0xa, 0x82) ioctl$SG_SET_RESERVED_SIZE(r2, 0x2275, &(0x7f0000000040)=0x9) r3 = syz_open_dev$sg(&(0x7f0000000080), 0x4a, 0x8000) ioctl$SCSI_IOCTL_DOORLOCK(r3, 0x5380) 20:26:56 executing program 1: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x40, 0x0) clock_gettime(0x0, &(0x7f00000000c0)={0x0, 0x0}) write$evdev(r0, &(0x7f0000000100)=[{{0x77359400}, 0x3, 0x20, 0x8}, {{r1, r2/1000+60000}, 0x2, 0x40, 0x7}, {{0x0, 0xea60}, 0x1, 0x80, 0x7f}, {{}, 0x16, 0x1, 0xffffffff}], 0x60) ioctl$PTP_PIN_GETFUNC2(0xffffffffffffffff, 0xc0603d0f, &(0x7f0000000000)={'\x00', 0x1000, 0x2, 0x5}) (async) r3 = syz_open_dev$sg(&(0x7f0000000380), 0x4, 0x78900) ioctl$SG_GET_COMMAND_Q(r3, 0x1274, 0x0) 20:26:56 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) 20:26:56 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000000)=0x62) 20:26:56 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000000e000001"], 0x1c}}, 0x0) 20:26:56 executing program 0: r0 = syz_open_dev$sg(&(0x7f00000000c0), 0x3, 0x14200) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000080)) r2 = socket(0xa, 0x6, 0x0) setsockopt$bt_hci_HCI_TIME_STAMP(r2, 0x10d, 0x5, 0x0, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x401, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r3, 0x2287, &(0x7f0000000000)=0x7fffffff) syz_open_dev$sg(&(0x7f00000000c0), 0x3, 0x14200) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000080)) (async) socket(0xa, 0x6, 0x0) (async) setsockopt$bt_hci_HCI_TIME_STAMP(r2, 0x10d, 0x5, 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x401, 0x0) (async) ioctl$SG_SET_KEEP_ORPHAN(r3, 0x2287, &(0x7f0000000000)=0x7fffffff) (async) 20:26:56 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) 20:26:56 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000000)=0x66) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:26:56 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000000)=0x62) 20:26:56 executing program 0: r0 = syz_open_dev$sg(&(0x7f00000000c0), 0x3, 0x14200) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000080)) (async) r2 = socket(0xa, 0x6, 0x0) setsockopt$bt_hci_HCI_TIME_STAMP(r2, 0x10d, 0x5, 0x0, 0x0) (async) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x401, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r3, 0x2287, &(0x7f0000000000)=0x7fffffff) 20:26:56 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) (async) 20:26:56 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000000f000001"], 0x1c}}, 0x0) 20:26:56 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x2200, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r1, 0x2) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000080)) r2 = syz_open_dev$sg(&(0x7f0000000000), 0xa, 0x82) ioctl$SG_SET_RESERVED_SIZE(r2, 0x2275, &(0x7f0000000040)=0x9) r3 = syz_open_dev$sg(&(0x7f0000000080), 0x4a, 0x8000) ioctl$SCSI_IOCTL_DOORLOCK(r3, 0x5380) 20:26:56 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000000)=0x66) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:26:56 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x80002, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f0000000000)=0x8000) ioctl$SG_GET_COMMAND_Q(r1, 0x1267, 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r0, 0x2) 20:26:56 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f00000001c0)) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f0000000080)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$EVIOCGVERSION(r1, 0x80044501, &(0x7f00000000c0)=""/195) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x7) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000000)) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:26:56 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000010000001"], 0x1c}}, 0x0) 20:26:56 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x7, 0x472800) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) 20:26:56 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x80002, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f0000000000)=0x8000) ioctl$SG_GET_COMMAND_Q(r1, 0x1267, 0x0) (async) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r0, 0x2) 20:26:56 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000011000001"], 0x1c}}, 0x0) 20:26:56 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x7, 0x472800) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) 20:26:56 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f00000001c0)) (async) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f0000000080)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$EVIOCGVERSION(r1, 0x80044501, &(0x7f00000000c0)=""/195) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x7) (async, rerun: 64) write$vga_arbiter(r1, 0x0, 0x0) (async, rerun: 64) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000000)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:26:56 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000000)=0x66) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:26:56 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x7, 0x472800) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) syz_open_dev$sg(&(0x7f0000000040), 0x7, 0x472800) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) 20:26:57 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x2200, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r1, 0x2) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000080)) r2 = syz_open_dev$sg(&(0x7f0000000000), 0xa, 0x82) ioctl$SG_SET_RESERVED_SIZE(r2, 0x2275, &(0x7f0000000040)=0x9) r3 = syz_open_dev$sg(&(0x7f0000000080), 0x4a, 0x8000) ioctl$SCSI_IOCTL_DOORLOCK(r3, 0x5380) 20:26:57 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000012000001"], 0x1c}}, 0x0) 20:26:57 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async, rerun: 64) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x80002, 0x0) (rerun: 64) write$vga_arbiter(r1, 0x0, 0x0) ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f0000000000)=0x8000) ioctl$SG_GET_COMMAND_Q(r1, 0x1267, 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r0, 0x2) 20:26:57 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f00000001c0)) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f0000000080)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$EVIOCGVERSION(r1, 0x80044501, &(0x7f00000000c0)=""/195) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x7) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000000)) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f00000001c0)) (async) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f0000000080)) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$EVIOCGVERSION(r1, 0x80044501, &(0x7f00000000c0)=""/195) (async) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x7) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000000)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) 20:26:57 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x339a02) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:26:57 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) ioctl$SG_GET_KEEP_ORPHAN(r1, 0x2288, &(0x7f0000000040)) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) 20:26:57 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) ioctl$SG_GET_KEEP_ORPHAN(r1, 0x2288, &(0x7f0000000040)) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) (async) ioctl$SG_GET_KEEP_ORPHAN(r1, 0x2288, &(0x7f0000000040)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) 20:26:57 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x339a02) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:26:57 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000025000001"], 0x1c}}, 0x0) 20:26:57 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) ioctl$SG_GET_KEEP_ORPHAN(r1, 0x2288, &(0x7f0000000040)) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) (async) ioctl$SG_GET_KEEP_ORPHAN(r1, 0x2288, &(0x7f0000000040)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) 20:26:57 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x44100) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x8, 0x4000) ioctl$SCSI_IOCTL_SYNC(r1, 0x4) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f0000000040)) 20:26:57 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x10000000000, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:26:58 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x2200, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r1, 0x2) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000080)) r2 = syz_open_dev$sg(&(0x7f0000000000), 0xa, 0x82) ioctl$SG_SET_RESERVED_SIZE(r2, 0x2275, &(0x7f0000000040)=0x9) syz_open_dev$sg(&(0x7f0000000080), 0x4a, 0x8000) 20:26:58 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000d26000001"], 0x1c}}, 0x0) 20:26:58 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x339a02) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x339a02) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) 20:26:58 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x10000000000, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:26:58 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000000)) 20:26:58 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x44100) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x8, 0x4000) ioctl$SCSI_IOCTL_SYNC(r1, 0x4) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f0000000040)) 20:26:58 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000000)) 20:26:58 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:26:58 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000048000001"], 0x1c}}, 0x0) 20:26:58 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x10000000000, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x10000000000, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) 20:26:58 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x44100) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x8, 0x4000) ioctl$SCSI_IOCTL_SYNC(r1, 0x4) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f0000000040)) 20:26:58 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0xfffffffffffffffd) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SG_EMULATED_HOST(r2, 0x2203, &(0x7f0000000000)) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:26:59 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x2200, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r1, 0x2) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000080)) r2 = syz_open_dev$sg(&(0x7f0000000000), 0xa, 0x82) ioctl$SG_SET_RESERVED_SIZE(r2, 0x2275, &(0x7f0000000040)=0x9) 20:26:59 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:26:59 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_GET_PCI(0xffffffffffffffff, 0x5387, &(0x7f0000000080)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0), 0x201, 0x0) ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f0000000100)=0x40) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000040)={&(0x7f0000000000)='./file0\x00'}, 0x10) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:26:59 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000004c000001"], 0x1c}}, 0x0) 20:26:59 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000000)) 20:26:59 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0xfffffffffffffffd) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SG_EMULATED_HOST(r2, 0x2203, &(0x7f0000000000)) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0xfffffffffffffffd) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r2, 0x0, 0x0) (async) ioctl$SG_EMULATED_HOST(r2, 0x2203, &(0x7f0000000000)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) 20:26:59 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SCSI_IOCTL_GET_PCI(0xffffffffffffffff, 0x5387, &(0x7f0000000080)) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0), 0x201, 0x0) ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f0000000100)=0x40) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000040)={&(0x7f0000000000)='./file0\x00'}, 0x10) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:26:59 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SCSI_IOCTL_GET_PCI(0xffffffffffffffff, 0x5387, &(0x7f0000000080)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0), 0x201, 0x0) ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f0000000100)=0x40) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000040)={&(0x7f0000000000)='./file0\x00'}, 0x10) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:26:59 executing program 2: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) 20:26:59 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async, rerun: 64) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (rerun: 64) write$vga_arbiter(r1, 0x0, 0x0) (async) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0xfffffffffffffffd) (async) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) (async) ioctl$SG_EMULATED_HOST(r2, 0x2203, &(0x7f0000000000)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:26:59 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000060000001"], 0x1c}}, 0x0) 20:26:59 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) [ 2111.571739][T30226] __nla_validate_parse: 40 callbacks suppressed [ 2111.571760][T30226] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2111.632491][T30249] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:00 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x2200, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r1, 0x2) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000080)) syz_open_dev$sg(&(0x7f0000000000), 0xa, 0x82) 20:27:00 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x3, 0x41000) ioctl$SG_GET_RESERVED_SIZE(r0, 0x2272, &(0x7f0000000000)) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r0, 0x2) 20:27:00 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x80080) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:27:00 executing program 2: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) 20:27:00 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0xfffffffffffffffe, 0x20c0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:27:00 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000068000001"], 0x1c}}, 0x0) 20:27:00 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0xfffffffffffffffe, 0x20c0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0xfffffffffffffffe, 0x20c0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) 20:27:00 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x80080) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:27:00 executing program 2: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) 20:27:00 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000006c000001"], 0x1c}}, 0x0) 20:27:00 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x3, 0x41000) ioctl$SG_GET_RESERVED_SIZE(r0, 0x2272, &(0x7f0000000000)) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r0, 0x2) 20:27:00 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0xfffffffffffffffe, 0x20c0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0xfffffffffffffffe, 0x20c0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) [ 2112.456327][T30257] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2112.506331][T30276] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:01 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x2200, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r1, 0x2) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0xa, 0x82) 20:27:01 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x80080) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:27:01 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x3, 0x41000) ioctl$SG_GET_RESERVED_SIZE(r0, 0x2272, &(0x7f0000000000)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r0, 0x2) 20:27:01 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) socket$key(0xf, 0x3, 0x2) 20:27:01 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x200, 0x0) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000000)=0x9b) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:27:01 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000074000001"], 0x1c}}, 0x0) 20:27:01 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x200, 0x0) (async) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000000)=0x9b) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:27:01 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x400000000, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:27:01 executing program 0: sendmsg$AUDIT_LIST_RULES(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x3f5, 0x2, 0x70bd28, 0x25dfdbfd, "", ["", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x4040000}, 0x8000) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:27:01 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000007a000001"], 0x1c}}, 0x0) 20:27:01 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) socket$key(0xf, 0x3, 0x2) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) socket$key(0xf, 0x3, 0x2) (async) 20:27:01 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x400000000, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x400000000, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) [ 2113.322776][T30283] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2113.371445][T30303] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:02 executing program 3: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x2200, 0x0) write$vga_arbiter(r0, 0x0, 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r0, 0x2) syz_open_dev$sg(&(0x7f0000000000), 0xa, 0x82) 20:27:02 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x200, 0x0) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000000)=0x9b) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:27:02 executing program 0: sendmsg$AUDIT_LIST_RULES(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x3f5, 0x2, 0x70bd28, 0x25dfdbfd, "", ["", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x4040000}, 0x8000) (async) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:27:02 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x400000000, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:27:02 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) socket$key(0xf, 0x3, 0x2) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) socket$key(0xf, 0x3, 0x2) (async) 20:27:02 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000ffffff9e000001"], 0x1c}}, 0x0) 20:27:02 executing program 0: sendmsg$AUDIT_LIST_RULES(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x3f5, 0x2, 0x70bd28, 0x25dfdbfd, "", ["", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x4040000}, 0x8000) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:27:02 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f0000000000)=0x7f, 0x4) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:27:02 executing program 1: ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x1274, 0x0) 20:27:02 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000000)) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x101900, 0x0) ioctl$SG_GET_KEEP_ORPHAN(r1, 0x2288, &(0x7f00000000c0)) ioctl$SCSI_IOCTL_START_UNIT(r2, 0x5) 20:27:02 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x153080, 0x0) sendmsg$AUDIT_ADD_RULE(r3, &(0x7f0000000180)={&(0x7f0000000100), 0xc, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="28040000f30310002cbd7000fcdbdf25040000000000000005000000000000020000008000000800070000000100000003000000ff07000000fcffff0200000081ffffff00100000020000000500000001800000010000001f0000000080ffff010100006bcd00000900000003000000ff07000000f8ffff918600000800000000f0ffff040000000700000002000000010001000800000005000000010000000000000088000000e90e00000600000009000000ff0f000000000000070000000800000000000000060000000200000005000000050000000000000001f0ffff0000000107000000050000009f000000ff03000004000000080000000d0bed05060000004914000091f3ffff00100000000000000001000000000000090000006d5e0000ff010000070000004f0000000300000003000000000200000000010048000000ff7f00003f0000000600000059010000070000000c0000000800000085070000001000003f00000001000000000000507f000000fcffffff04020000020000000900000007000000010001000100010008000000720000003f000000ffffff7f030f000001000000000000000100000001ff0000090000000600000007000000ff7f00000095000007000000f9ffffff020000000400000009000000fdffffff8fbf00000200000001000000feffffff02000000010001000900000009000000d462000002000000bd090000030000000002000001000000000400006800000000080000faffffff000400000400000003000000060000008100000001000000030000000800000004000000090000000101000018040000040000000100010000000000020000007704000005000000ff7f000000010000070000004d00000048dc000080000000ce0b00000600000005000000050000000000000000000000040000000700000004000000ff0700000200000009000000ff01000002000000ff0f00000800000081000000800000003bd992581f0000000100000007000000dc0400000600000090fbbf1f060000000000000000000000800000000008000004000000d1d90000010000000300000080000000020000003f0000000b0e0000010000000700000004000000060000000700000000010000050000000900000003000000ff0300000200000009000000f70000000101000006000000010000000600000001800000020000000000008002000000030000009215707cc87400000000000002000000060000000000a0090100000000000000030000000100000001000000060000000900000004000000000100000009000000ff0f000081000000ff07000000000000050000000600000001000000200000000900000002000000010000002d7300000500000008000000020000000004000002000000010001006d000000fe7000000100000000000000050000042925ce2400000000"], 0x428}, 0x1, 0x0, 0x0, 0x8851}, 0x20000000) 20:27:02 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000000)) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x101900, 0x0) ioctl$SG_GET_KEEP_ORPHAN(r1, 0x2288, &(0x7f00000000c0)) (async) ioctl$SCSI_IOCTL_START_UNIT(r2, 0x5) [ 2114.197239][T30319] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:02 executing program 3: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x2200, 0x0) write$vga_arbiter(r0, 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0xa, 0x82) 20:27:02 executing program 1: ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x1274, 0x0) ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x1274, 0x0) (async) 20:27:02 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000ffffffef000001"], 0x1c}}, 0x0) 20:27:02 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f0000000000)=0x7f, 0x4) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) socket$inet6_sctp(0xa, 0x5, 0x84) (async) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) (async) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f0000000000)=0x7f, 0x4) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) 20:27:02 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) (async) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x153080, 0x0) sendmsg$AUDIT_ADD_RULE(r3, &(0x7f0000000180)={&(0x7f0000000100), 0xc, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="28040000f30310002cbd7000fcdbdf25040000000000000005000000000000020000008000000800070000000100000003000000ff07000000fcffff0200000081ffffff00100000020000000500000001800000010000001f0000000080ffff010100006bcd00000900000003000000ff07000000f8ffff918600000800000000f0ffff040000000700000002000000010001000800000005000000010000000000000088000000e90e00000600000009000000ff0f000000000000070000000800000000000000060000000200000005000000050000000000000001f0ffff0000000107000000050000009f000000ff03000004000000080000000d0bed05060000004914000091f3ffff00100000000000000001000000000000090000006d5e0000ff010000070000004f0000000300000003000000000200000000010048000000ff7f00003f0000000600000059010000070000000c0000000800000085070000001000003f00000001000000000000507f000000fcffffff04020000020000000900000007000000010001000100010008000000720000003f000000ffffff7f030f000001000000000000000100000001ff0000090000000600000007000000ff7f00000095000007000000f9ffffff020000000400000009000000fdffffff8fbf00000200000001000000feffffff02000000010001000900000009000000d462000002000000bd090000030000000002000001000000000400006800000000080000faffffff000400000400000003000000060000008100000001000000030000000800000004000000090000000101000018040000040000000100010000000000020000007704000005000000ff7f000000010000070000004d00000048dc000080000000ce0b00000600000005000000050000000000000000000000040000000700000004000000ff0700000200000009000000ff01000002000000ff0f00000800000081000000800000003bd992581f0000000100000007000000dc0400000600000090fbbf1f060000000000000000000000800000000008000004000000d1d90000010000000300000080000000020000003f0000000b0e0000010000000700000004000000060000000700000000010000050000000900000003000000ff0300000200000009000000f70000000101000006000000010000000600000001800000020000000000008002000000030000009215707cc87400000000000002000000060000000000a0090100000000000000030000000100000001000000060000000900000004000000000100000009000000ff0f000081000000ff07000000000000050000000600000001000000200000000900000002000000010000002d7300000500000008000000020000000004000002000000010001006d000000fe7000000100000000000000050000042925ce2400000000"], 0x428}, 0x1, 0x0, 0x0, 0x8851}, 0x20000000) 20:27:02 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000000)) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x101900, 0x0) ioctl$SG_GET_KEEP_ORPHAN(r1, 0x2288, &(0x7f00000000c0)) ioctl$SCSI_IOCTL_START_UNIT(r2, 0x5) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000000)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x101900, 0x0) (async) ioctl$SG_GET_KEEP_ORPHAN(r1, 0x2288, &(0x7f00000000c0)) (async) ioctl$SCSI_IOCTL_START_UNIT(r2, 0x5) (async) 20:27:03 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x153080, 0x0) sendmsg$AUDIT_ADD_RULE(r3, &(0x7f0000000180)={&(0x7f0000000100), 0xc, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="28040000f30310002cbd7000fcdbdf25040000000000000005000000000000020000008000000800070000000100000003000000ff07000000fcffff0200000081ffffff00100000020000000500000001800000010000001f0000000080ffff010100006bcd00000900000003000000ff07000000f8ffff918600000800000000f0ffff040000000700000002000000010001000800000005000000010000000000000088000000e90e00000600000009000000ff0f000000000000070000000800000000000000060000000200000005000000050000000000000001f0ffff0000000107000000050000009f000000ff03000004000000080000000d0bed05060000004914000091f3ffff00100000000000000001000000000000090000006d5e0000ff010000070000004f0000000300000003000000000200000000010048000000ff7f00003f0000000600000059010000070000000c0000000800000085070000001000003f00000001000000000000507f000000fcffffff04020000020000000900000007000000010001000100010008000000720000003f000000ffffff7f030f000001000000000000000100000001ff0000090000000600000007000000ff7f00000095000007000000f9ffffff020000000400000009000000fdffffff8fbf00000200000001000000feffffff02000000010001000900000009000000d462000002000000bd090000030000000002000001000000000400006800000000080000faffffff000400000400000003000000060000008100000001000000030000000800000004000000090000000101000018040000040000000100010000000000020000007704000005000000ff7f000000010000070000004d00000048dc000080000000ce0b00000600000005000000050000000000000000000000040000000700000004000000ff0700000200000009000000ff01000002000000ff0f00000800000081000000800000003bd992581f0000000100000007000000dc0400000600000090fbbf1f060000000000000000000000800000000008000004000000d1d90000010000000300000080000000020000003f0000000b0e0000010000000700000004000000060000000700000000010000050000000900000003000000ff0300000200000009000000f70000000101000006000000010000000600000001800000020000000000008002000000030000009215707cc87400000000000002000000060000000000a0090100000000000000030000000100000001000000060000000900000004000000000100000009000000ff0f000081000000ff07000000000000050000000600000001000000200000000900000002000000010000002d7300000500000008000000020000000004000002000000010001006d000000fe7000000100000000000000050000042925ce2400000000"], 0x428}, 0x1, 0x0, 0x0, 0x8851}, 0x20000000) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) (async) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) (async) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000080)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r2, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x153080, 0x0) (async) sendmsg$AUDIT_ADD_RULE(r3, &(0x7f0000000180)={&(0x7f0000000100), 0xc, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="28040000f30310002cbd7000fcdbdf25040000000000000005000000000000020000008000000800070000000100000003000000ff07000000fcffff0200000081ffffff00100000020000000500000001800000010000001f0000000080ffff010100006bcd00000900000003000000ff07000000f8ffff918600000800000000f0ffff040000000700000002000000010001000800000005000000010000000000000088000000e90e00000600000009000000ff0f000000000000070000000800000000000000060000000200000005000000050000000000000001f0ffff0000000107000000050000009f000000ff03000004000000080000000d0bed05060000004914000091f3ffff00100000000000000001000000000000090000006d5e0000ff010000070000004f0000000300000003000000000200000000010048000000ff7f00003f0000000600000059010000070000000c0000000800000085070000001000003f00000001000000000000507f000000fcffffff04020000020000000900000007000000010001000100010008000000720000003f000000ffffff7f030f000001000000000000000100000001ff0000090000000600000007000000ff7f00000095000007000000f9ffffff020000000400000009000000fdffffff8fbf00000200000001000000feffffff02000000010001000900000009000000d462000002000000bd090000030000000002000001000000000400006800000000080000faffffff000400000400000003000000060000008100000001000000030000000800000004000000090000000101000018040000040000000100010000000000020000007704000005000000ff7f000000010000070000004d00000048dc000080000000ce0b00000600000005000000050000000000000000000000040000000700000004000000ff0700000200000009000000ff01000002000000ff0f00000800000081000000800000003bd992581f0000000100000007000000dc0400000600000090fbbf1f060000000000000000000000800000000008000004000000d1d90000010000000300000080000000020000003f0000000b0e0000010000000700000004000000060000000700000000010000050000000900000003000000ff0300000200000009000000f70000000101000006000000010000000600000001800000020000000000008002000000030000009215707cc87400000000000002000000060000000000a0090100000000000000030000000100000001000000060000000900000004000000000100000009000000ff0f000081000000ff07000000000000050000000600000001000000200000000900000002000000010000002d7300000500000008000000020000000004000002000000010001006d000000fe7000000100000000000000050000042925ce2400000000"], 0x428}, 0x1, 0x0, 0x0, 0x8851}, 0x20000000) (async) 20:27:03 executing program 1: ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x1274, 0x0) ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x1274, 0x0) (async) 20:27:03 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000fffffff0000001"], 0x1c}}, 0x0) 20:27:03 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x6, 0x202842) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) 20:27:03 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000080), 0xfffffffffffffffd, 0x0) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f00000000c0)) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SG_GET_REQUEST_TABLE(r2, 0x2286, &(0x7f0000000100)) io_uring_setup(0x4efa, &(0x7f0000000000)={0x0, 0xb941, 0x0, 0x1, 0x21f, 0x0, r2}) [ 2115.063558][T30352] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:03 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x6, 0x202842) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) syz_open_dev$sg(&(0x7f0000000040), 0x6, 0x202842) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) [ 2115.113892][T30382] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:03 executing program 3: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x2200, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0xa, 0x82) 20:27:03 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000080), 0xfffffffffffffffd, 0x0) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f00000000c0)) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SG_GET_REQUEST_TABLE(r2, 0x2286, &(0x7f0000000100)) io_uring_setup(0x4efa, &(0x7f0000000000)={0x0, 0xb941, 0x0, 0x1, 0x21f, 0x0, r2}) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) syz_open_dev$sg(&(0x7f0000000080), 0xfffffffffffffffd, 0x0) (async) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f00000000c0)) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r2, 0x0, 0x0) (async) ioctl$SG_GET_REQUEST_TABLE(r2, 0x2286, &(0x7f0000000100)) (async) io_uring_setup(0x4efa, &(0x7f0000000000)={0x0, 0xb941, 0x0, 0x1, 0x21f, 0x0, r2}) (async) 20:27:03 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000007fffffff000001"], 0x1c}}, 0x0) 20:27:03 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x6, 0x202842) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) 20:27:03 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f0000000000)=0x7f, 0x4) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:27:03 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x5, 0x4000) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x400, 0x0) ioctl$EVIOCGLED(r2, 0x80404519, &(0x7f0000000080)=""/140) ioctl$SG_GET_TIMEOUT(r1, 0x2202, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:27:03 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) r1 = syz_open_dev$sg(&(0x7f0000000080), 0xfffffffffffffffd, 0x0) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f00000000c0)) (async) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) (async) ioctl$SG_GET_REQUEST_TABLE(r2, 0x2286, &(0x7f0000000100)) (async) io_uring_setup(0x4efa, &(0x7f0000000000)={0x0, 0xb941, 0x0, 0x1, 0x21f, 0x0, r2}) 20:27:03 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000009effffff000001"], 0x1c}}, 0x0) 20:27:03 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x2, 0x22401) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r1, 0x2) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) 20:27:03 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x5, 0x4000) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x400, 0x0) ioctl$EVIOCGLED(r2, 0x80404519, &(0x7f0000000080)=""/140) ioctl$SG_GET_TIMEOUT(r1, 0x2202, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) syz_open_dev$sg(&(0x7f0000000000), 0x5, 0x4000) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x400, 0x0) (async) ioctl$EVIOCGLED(r2, 0x80404519, &(0x7f0000000080)=""/140) (async) ioctl$SG_GET_TIMEOUT(r1, 0x2202, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) 20:27:03 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x40000, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) [ 2115.928563][T30409] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:03 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) ioctl$BINDER_CTL_ADD(0xffffffffffffffff, 0xc1086201, &(0x7f0000000000)={'binder1\x00'}) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$EVIOCREVOKE(0xffffffffffffffff, 0x40044591, &(0x7f0000000140)=0x7) 20:27:03 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x5, 0x4000) (async) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x400, 0x0) ioctl$EVIOCGLED(r2, 0x80404519, &(0x7f0000000080)=""/140) (async) ioctl$SG_GET_TIMEOUT(r1, 0x2202, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:27:04 executing program 3: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0xa, 0x82) 20:27:04 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x40000, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:27:04 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) ioctl$BINDER_CTL_ADD(0xffffffffffffffff, 0xc1086201, &(0x7f0000000000)={'binder1\x00'}) (async) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) (async, rerun: 32) ioctl$EVIOCREVOKE(0xffffffffffffffff, 0x40044591, &(0x7f0000000140)=0x7) (rerun: 32) 20:27:04 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x2, 0x22401) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r1, 0x2) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x2, 0x22401) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r1, 0x2) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) 20:27:04 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000efffffff000001"], 0x1c}}, 0x0) 20:27:04 executing program 0: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:27:04 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x2, 0x22401) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r1, 0x2) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x2, 0x22401) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r1, 0x2) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) 20:27:04 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x40000, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:27:04 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) ioctl$BINDER_CTL_ADD(0xffffffffffffffff, 0xc1086201, &(0x7f0000000000)={'binder1\x00'}) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$EVIOCREVOKE(0xffffffffffffffff, 0x40044591, &(0x7f0000000140)=0x7) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) ioctl$BINDER_CTL_ADD(0xffffffffffffffff, 0xc1086201, &(0x7f0000000000)={'binder1\x00'}) (async) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) (async) ioctl$EVIOCREVOKE(0xffffffffffffffff, 0x40044591, &(0x7f0000000140)=0x7) (async) 20:27:04 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000f0ffffff000001"], 0x1c}}, 0x0) 20:27:04 executing program 0: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) [ 2116.800292][T30455] __nla_validate_parse: 1 callbacks suppressed [ 2116.800322][T30455] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:04 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x7, 0x80400) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) [ 2116.843230][T30476] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:05 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0xa, 0x82) 20:27:05 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000000)={0xf4, 0x2, 0x3f, "bbe8329525d183e9faf208ae57141195ec322e76f3b532e6856c6d6857eea0f7bb107e8f8162dd03b1b6970a4f8fddd13b9d12de04a031df7db58999bf0a0141bc9b2f47bba6e419533b1512cc26b9b08c907849d34f02cb48fe1ed82485f983af5cefe1236fdd724da536a1ebc3ab2351d78565044af469589b35aacbdab09a32a53158e702253884907f9e0100d07bb7953c593d3c750ddcdd64799f0b330961a656e1d8b654e901de4f97db7a89a74013572d8b5b9b59e1d000bee05d2bfe9cbcdeddc2505829cd6cf4c90f1de4a1388ca24c53c0b278bfabc2944440fd9c6343cf9f76c692daeca418c9a9f9c935edc50516"}) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000100)) 20:27:05 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x7, 0x80400) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:27:05 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100"/11], 0x1c}}, 0x0) 20:27:05 executing program 0: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async, rerun: 32) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (rerun: 32) write$vga_arbiter(r0, 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:27:05 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SCSI_IOCTL_GET_PCI(0xffffffffffffffff, 0x5387, &(0x7f0000000440)) getsockname$packet(r1, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000000c0)=0x14) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r4, 0x0, 0x0) r5 = bpf$ITER_CREATE(0x21, &(0x7f0000000140)={r2}, 0x8) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000480)=0x14) sendmsg$ETHTOOL_MSG_RINGS_SET(r2, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)={0xec, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@ETHTOOL_A_RINGS_RX_MINI={0x8, 0x7, 0x640}, @ETHTOOL_A_RINGS_RX_MINI={0x8, 0x7, 0x1}, @ETHTOOL_A_RINGS_TX={0x8, 0x9, 0x53f}, @ETHTOOL_A_RINGS_RX={0x8, 0x6, 0x1}, @ETHTOOL_A_RINGS_HEADER={0x6c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x4}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6erspan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bond\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}]}, @ETHTOOL_A_RINGS_RX_MINI={0x8, 0x7, 0x80000001}, @ETHTOOL_A_RINGS_HEADER={0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'nr0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6gre0\x00'}]}]}, 0xec}, 0x1, 0x0, 0x0, 0x40080}, 0x24000840) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_TIMEOUT(r1, 0x2202, 0x0) sendmsg$IPVS_CMD_GET_CONFIG(r1, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x20, 0x0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}]}]}, 0x20}}, 0x0) 20:27:05 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x7, 0x80400) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:27:05 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000020000000001"], 0x1c}}, 0x0) 20:27:05 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000030000000001"], 0x1c}}, 0x0) 20:27:05 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000000)={0xf4, 0x2, 0x3f, "bbe8329525d183e9faf208ae57141195ec322e76f3b532e6856c6d6857eea0f7bb107e8f8162dd03b1b6970a4f8fddd13b9d12de04a031df7db58999bf0a0141bc9b2f47bba6e419533b1512cc26b9b08c907849d34f02cb48fe1ed82485f983af5cefe1236fdd724da536a1ebc3ab2351d78565044af469589b35aacbdab09a32a53158e702253884907f9e0100d07bb7953c593d3c750ddcdd64799f0b330961a656e1d8b654e901de4f97db7a89a74013572d8b5b9b59e1d000bee05d2bfe9cbcdeddc2505829cd6cf4c90f1de4a1388ca24c53c0b278bfabc2944440fd9c6343cf9f76c692daeca418c9a9f9c935edc50516"}) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000100)) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000000)={0xf4, 0x2, 0x3f, "bbe8329525d183e9faf208ae57141195ec322e76f3b532e6856c6d6857eea0f7bb107e8f8162dd03b1b6970a4f8fddd13b9d12de04a031df7db58999bf0a0141bc9b2f47bba6e419533b1512cc26b9b08c907849d34f02cb48fe1ed82485f983af5cefe1236fdd724da536a1ebc3ab2351d78565044af469589b35aacbdab09a32a53158e702253884907f9e0100d07bb7953c593d3c750ddcdd64799f0b330961a656e1d8b654e901de4f97db7a89a74013572d8b5b9b59e1d000bee05d2bfe9cbcdeddc2505829cd6cf4c90f1de4a1388ca24c53c0b278bfabc2944440fd9c6343cf9f76c692daeca418c9a9f9c935edc50516"}) (async) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000100)) (async) 20:27:05 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0xfa, 0x20000) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:27:05 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SCSI_IOCTL_GET_PCI(0xffffffffffffffff, 0x5387, &(0x7f0000000440)) getsockname$packet(r1, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000000c0)=0x14) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r4, 0x0, 0x0) r5 = bpf$ITER_CREATE(0x21, &(0x7f0000000140)={r2}, 0x8) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000480)=0x14) sendmsg$ETHTOOL_MSG_RINGS_SET(r2, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)={0xec, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@ETHTOOL_A_RINGS_RX_MINI={0x8, 0x7, 0x640}, @ETHTOOL_A_RINGS_RX_MINI={0x8, 0x7, 0x1}, @ETHTOOL_A_RINGS_TX={0x8, 0x9, 0x53f}, @ETHTOOL_A_RINGS_RX={0x8, 0x6, 0x1}, @ETHTOOL_A_RINGS_HEADER={0x6c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x4}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6erspan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bond\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}]}, @ETHTOOL_A_RINGS_RX_MINI={0x8, 0x7, 0x80000001}, @ETHTOOL_A_RINGS_HEADER={0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'nr0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6gre0\x00'}]}]}, 0xec}, 0x1, 0x0, 0x0, 0x40080}, 0x24000840) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_TIMEOUT(r1, 0x2202, 0x0) sendmsg$IPVS_CMD_GET_CONFIG(r1, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x20, 0x0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}]}]}, 0x20}}, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r2, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_GET_PCI(0xffffffffffffffff, 0x5387, &(0x7f0000000440)) (async) getsockname$packet(r1, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000000c0)=0x14) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r4, 0x0, 0x0) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000140)={r2}, 0x8) (async) getsockname$packet(r5, &(0x7f0000000100), &(0x7f0000000480)=0x14) (async) sendmsg$ETHTOOL_MSG_RINGS_SET(r2, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)={0xec, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@ETHTOOL_A_RINGS_RX_MINI={0x8, 0x7, 0x640}, @ETHTOOL_A_RINGS_RX_MINI={0x8, 0x7, 0x1}, @ETHTOOL_A_RINGS_TX={0x8, 0x9, 0x53f}, @ETHTOOL_A_RINGS_RX={0x8, 0x6, 0x1}, @ETHTOOL_A_RINGS_HEADER={0x6c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x4}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6erspan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bond\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}]}, @ETHTOOL_A_RINGS_RX_MINI={0x8, 0x7, 0x80000001}, @ETHTOOL_A_RINGS_HEADER={0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'nr0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6gre0\x00'}]}]}, 0xec}, 0x1, 0x0, 0x0, 0x40080}, 0x24000840) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_GET_TIMEOUT(r1, 0x2202, 0x0) (async) sendmsg$IPVS_CMD_GET_CONFIG(r1, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x20, 0x0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}]}]}, 0x20}}, 0x0) (async) [ 2117.647168][T30494] program syz-executor.5 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2117.670130][T30497] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:05 executing program 3: syz_open_dev$sg(0x0, 0xa, 0x82) 20:27:05 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0xffffffffffffffff, 0xe0000) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000340)={r1}, 0x8) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r3 = bpf$ITER_CREATE(0x21, &(0x7f0000000380)={r1}, 0x8) bpf$LINK_DETACH(0x22, &(0x7f00000003c0)=r3, 0x4) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f0000000100)) syz_open_dev$evdev(&(0x7f0000000140), 0x0, 0x80400) r4 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) ioctl$SCSI_IOCTL_SYNC(r4, 0x4) r5 = syz_open_dev$sg(&(0x7f0000000080), 0xde05, 0x509100) ioctl$SG_GET_SCSI_ID(r5, 0x2276, &(0x7f0000000180)) sendmsg$IPVS_CMD_NEW_SERVICE(r4, &(0x7f0000000240)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042cbd7000fcdbdf25017ef6aca3017c35435a5c0000000800040001000080"], 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x14) r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r6, 0x0, 0x0) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000500)={&(0x7f00000006c0)=ANY=[@ANYBLOB="890ec3c79c2a4558e4415adc7beae624b634a4d762aaef13446159b034a8d8eeb88eaaffb410074451a384580200000071ebf63c02a960e6da420a4a62370331237c39090acaef01ca04eb3a607944d7fd0cfa0fa756f8fc1e92752b8967cee62b433f947e31e9cbccdc87880ce7afc8a293ae5ef270b54d1d", @ANYRES16=0x0, @ANYRESDEC=r2], 0x8c}, 0x1, 0x0, 0x0, 0x1}, 0x1) ioctl$EVIOCSCLOCKID(r6, 0x400445a0, &(0x7f00000001c0)) ioctl$SCSI_IOCTL_GET_PCI(r4, 0x5387, &(0x7f00000002c0)) ioctl$SG_GET_RESERVED_SIZE(r5, 0x2272, &(0x7f00000000c0)) 20:27:05 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0xfa, 0x20000) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) [ 2117.718830][T30501] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2117.722185][T30505] program syz-executor.5 is using a deprecated SCSI ioctl, please convert it to SG_IO 20:27:05 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0xffffffffffffffff, 0xe0000) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000340)={r1}, 0x8) (async, rerun: 64) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (rerun: 64) r3 = bpf$ITER_CREATE(0x21, &(0x7f0000000380)={r1}, 0x8) bpf$LINK_DETACH(0x22, &(0x7f00000003c0)=r3, 0x4) (async) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f0000000100)) (async) syz_open_dev$evdev(&(0x7f0000000140), 0x0, 0x80400) (async) r4 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) ioctl$SCSI_IOCTL_SYNC(r4, 0x4) (async) r5 = syz_open_dev$sg(&(0x7f0000000080), 0xde05, 0x509100) ioctl$SG_GET_SCSI_ID(r5, 0x2276, &(0x7f0000000180)) (async) sendmsg$IPVS_CMD_NEW_SERVICE(r4, &(0x7f0000000240)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042cbd7000fcdbdf25017ef6aca3017c35435a5c0000000800040001000080"], 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x14) r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r6, 0x0, 0x0) (async) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000500)={&(0x7f00000006c0)=ANY=[@ANYBLOB="890ec3c79c2a4558e4415adc7beae624b634a4d762aaef13446159b034a8d8eeb88eaaffb410074451a384580200000071ebf63c02a960e6da420a4a62370331237c39090acaef01ca04eb3a607944d7fd0cfa0fa756f8fc1e92752b8967cee62b433f947e31e9cbccdc87880ce7afc8a293ae5ef270b54d1d", @ANYRES16=0x0, @ANYRESDEC=r2], 0x8c}, 0x1, 0x0, 0x0, 0x1}, 0x1) (async) ioctl$EVIOCSCLOCKID(r6, 0x400445a0, &(0x7f00000001c0)) (async, rerun: 64) ioctl$SCSI_IOCTL_GET_PCI(r4, 0x5387, &(0x7f00000002c0)) (async, rerun: 64) ioctl$SG_GET_RESERVED_SIZE(r5, 0x2272, &(0x7f00000000c0)) 20:27:05 executing program 3: syz_open_dev$sg(0x0, 0xa, 0x82) 20:27:05 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000040000000001"], 0x1c}}, 0x0) 20:27:05 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SCSI_IOCTL_GET_PCI(0xffffffffffffffff, 0x5387, &(0x7f0000000440)) getsockname$packet(r1, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000000c0)=0x14) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r4, 0x0, 0x0) r5 = bpf$ITER_CREATE(0x21, &(0x7f0000000140)={r2}, 0x8) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000480)=0x14) sendmsg$ETHTOOL_MSG_RINGS_SET(r2, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)={0xec, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@ETHTOOL_A_RINGS_RX_MINI={0x8, 0x7, 0x640}, @ETHTOOL_A_RINGS_RX_MINI={0x8, 0x7, 0x1}, @ETHTOOL_A_RINGS_TX={0x8, 0x9, 0x53f}, @ETHTOOL_A_RINGS_RX={0x8, 0x6, 0x1}, @ETHTOOL_A_RINGS_HEADER={0x6c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x4}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6erspan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bond\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}]}, @ETHTOOL_A_RINGS_RX_MINI={0x8, 0x7, 0x80000001}, @ETHTOOL_A_RINGS_HEADER={0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'nr0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6gre0\x00'}]}]}, 0xec}, 0x1, 0x0, 0x0, 0x40080}, 0x24000840) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_TIMEOUT(r1, 0x2202, 0x0) sendmsg$IPVS_CMD_GET_CONFIG(r1, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x20, 0x0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}]}]}, 0x20}}, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r2, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_GET_PCI(0xffffffffffffffff, 0x5387, &(0x7f0000000440)) (async) getsockname$packet(r1, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000000c0)=0x14) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r4, 0x0, 0x0) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000140)={r2}, 0x8) (async) getsockname$packet(r5, &(0x7f0000000100), &(0x7f0000000480)=0x14) (async) sendmsg$ETHTOOL_MSG_RINGS_SET(r2, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)={0xec, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@ETHTOOL_A_RINGS_RX_MINI={0x8, 0x7, 0x640}, @ETHTOOL_A_RINGS_RX_MINI={0x8, 0x7, 0x1}, @ETHTOOL_A_RINGS_TX={0x8, 0x9, 0x53f}, @ETHTOOL_A_RINGS_RX={0x8, 0x6, 0x1}, @ETHTOOL_A_RINGS_HEADER={0x6c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x4}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6erspan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bond\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}]}, @ETHTOOL_A_RINGS_RX_MINI={0x8, 0x7, 0x80000001}, @ETHTOOL_A_RINGS_HEADER={0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'nr0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6gre0\x00'}]}]}, 0xec}, 0x1, 0x0, 0x0, 0x40080}, 0x24000840) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_GET_TIMEOUT(r1, 0x2202, 0x0) (async) sendmsg$IPVS_CMD_GET_CONFIG(r1, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x20, 0x0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}]}]}, 0x20}}, 0x0) (async) 20:27:05 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0xfa, 0x20000) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:27:05 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0xffffffffffffffff, 0xe0000) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000340)={r1}, 0x8) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r3 = bpf$ITER_CREATE(0x21, &(0x7f0000000380)={r1}, 0x8) bpf$LINK_DETACH(0x22, &(0x7f00000003c0)=r3, 0x4) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f0000000100)) syz_open_dev$evdev(&(0x7f0000000140), 0x0, 0x80400) r4 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) ioctl$SCSI_IOCTL_SYNC(r4, 0x4) r5 = syz_open_dev$sg(&(0x7f0000000080), 0xde05, 0x509100) ioctl$SG_GET_SCSI_ID(r5, 0x2276, &(0x7f0000000180)) sendmsg$IPVS_CMD_NEW_SERVICE(r4, &(0x7f0000000240)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042cbd7000fcdbdf25017ef6aca3017c35435a5c0000000800040001000080"], 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x14) r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r6, 0x0, 0x0) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000500)={&(0x7f00000006c0)=ANY=[@ANYBLOB="890ec3c79c2a4558e4415adc7beae624b634a4d762aaef13446159b034a8d8eeb88eaaffb410074451a384580200000071ebf63c02a960e6da420a4a62370331237c39090acaef01ca04eb3a607944d7fd0cfa0fa756f8fc1e92752b8967cee62b433f947e31e9cbccdc87880ce7afc8a293ae5ef270b54d1d", @ANYRES16=0x0, @ANYRESDEC=r2], 0x8c}, 0x1, 0x0, 0x0, 0x1}, 0x1) ioctl$EVIOCSCLOCKID(r6, 0x400445a0, &(0x7f00000001c0)) ioctl$SCSI_IOCTL_GET_PCI(r4, 0x5387, &(0x7f00000002c0)) ioctl$SG_GET_RESERVED_SIZE(r5, 0x2272, &(0x7f00000000c0)) syz_open_dev$sg(&(0x7f0000000040), 0xffffffffffffffff, 0xe0000) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000340)={r1}, 0x8) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000380)={r1}, 0x8) (async) bpf$LINK_DETACH(0x22, &(0x7f00000003c0)=r3, 0x4) (async) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f0000000100)) (async) syz_open_dev$evdev(&(0x7f0000000140), 0x0, 0x80400) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) (async) ioctl$SCSI_IOCTL_SYNC(r4, 0x4) (async) syz_open_dev$sg(&(0x7f0000000080), 0xde05, 0x509100) (async) ioctl$SG_GET_SCSI_ID(r5, 0x2276, &(0x7f0000000180)) (async) sendmsg$IPVS_CMD_NEW_SERVICE(r4, &(0x7f0000000240)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042cbd7000fcdbdf25017ef6aca3017c35435a5c0000000800040001000080"], 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x14) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r6, 0x0, 0x0) (async) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000500)={&(0x7f00000006c0)=ANY=[@ANYBLOB="890ec3c79c2a4558e4415adc7beae624b634a4d762aaef13446159b034a8d8eeb88eaaffb410074451a384580200000071ebf63c02a960e6da420a4a62370331237c39090acaef01ca04eb3a607944d7fd0cfa0fa756f8fc1e92752b8967cee62b433f947e31e9cbccdc87880ce7afc8a293ae5ef270b54d1d", @ANYRES16=0x0, @ANYRESDEC=r2], 0x8c}, 0x1, 0x0, 0x0, 0x1}, 0x1) (async) ioctl$EVIOCSCLOCKID(r6, 0x400445a0, &(0x7f00000001c0)) (async) ioctl$SCSI_IOCTL_GET_PCI(r4, 0x5387, &(0x7f00000002c0)) (async) ioctl$SG_GET_RESERVED_SIZE(r5, 0x2272, &(0x7f00000000c0)) (async) 20:27:05 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000000)={0xf4, 0x2, 0x3f, "bbe8329525d183e9faf208ae57141195ec322e76f3b532e6856c6d6857eea0f7bb107e8f8162dd03b1b6970a4f8fddd13b9d12de04a031df7db58999bf0a0141bc9b2f47bba6e419533b1512cc26b9b08c907849d34f02cb48fe1ed82485f983af5cefe1236fdd724da536a1ebc3ab2351d78565044af469589b35aacbdab09a32a53158e702253884907f9e0100d07bb7953c593d3c750ddcdd64799f0b330961a656e1d8b654e901de4f97db7a89a74013572d8b5b9b59e1d000bee05d2bfe9cbcdeddc2505829cd6cf4c90f1de4a1388ca24c53c0b278bfabc2944440fd9c6343cf9f76c692daeca418c9a9f9c935edc50516"}) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000100)) 20:27:05 executing program 3: syz_open_dev$sg(0x0, 0xa, 0x82) 20:27:05 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x20000000007d, 0x50100) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) io_uring_register$IORING_UNREGISTER_BUFFERS(r1, 0x1, 0x0, 0x0) [ 2117.759188][T30528] program syz-executor.5 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2117.799141][T30542] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:05 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$EVIOCGABS0(r1, 0x80184540, &(0x7f0000000000)=""/50) 20:27:05 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000050000000001"], 0x1c}}, 0x0) 20:27:05 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) 20:27:05 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x20000000007d, 0x50100) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) io_uring_register$IORING_UNREGISTER_BUFFERS(r1, 0x1, 0x0, 0x0) 20:27:05 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x2, 0x5d3102) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$EVIOCGVERSION(r2, 0x80044501, &(0x7f0000000080)=""/4096) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f0000000000)) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:27:05 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$EVIOCGABS0(r1, 0x80184540, &(0x7f0000000000)=""/50) 20:27:05 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) 20:27:05 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x20000000007d, 0x50100) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) io_uring_register$IORING_UNREGISTER_BUFFERS(r1, 0x1, 0x0, 0x0) 20:27:05 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000060000000001"], 0x1c}}, 0x0) 20:27:05 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x2, 0x5d3102) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) (async) ioctl$EVIOCGVERSION(r2, 0x80044501, &(0x7f0000000080)=""/4096) (async) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f0000000000)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) [ 2117.830490][T30565] program syz-executor.5 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2117.866808][T30590] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:05 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$EVIOCGABS0(r1, 0x80184540, &(0x7f0000000000)=""/50) 20:27:05 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) 20:27:05 executing program 1: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) ioctl$EVIOCGABS3F(r0, 0x8018457f, &(0x7f0000000000)=""/211) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x1274, 0x0) 20:27:05 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) (async) 20:27:05 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x2, 0x5d3102) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$EVIOCGVERSION(r2, 0x80044501, &(0x7f0000000080)=""/4096) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f0000000000)) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) syz_open_dev$sg(&(0x7f0000000040), 0x2, 0x5d3102) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r2, 0x0, 0x0) (async) ioctl$EVIOCGVERSION(r2, 0x80044501, &(0x7f0000000080)=""/4096) (async) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f0000000000)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) 20:27:05 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x7f, 0x42880) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f0000000040)={0xde, 0x6, 0x5, "a0e5256778ef08467fdd3fc9448cdaa313e596eba9e6f852d936ea46c481af97238aa2f837ff19b9a26be2d0c2882f0ff2a2b56a2e26d97bfc65e951fc9fa54169b13979abab7c98b0e6cbf959400190271d4671054e6722cd2974d2e7733ee38957df7cd42d465668dd76def896e5b8ad1a4177db4a8bdcbc2ad003f4e95b2b17096f7880746d3e25fe4fad42136b36def6da35e3dddbdef08384751d3e6a788e3d18205a330676c619e05b07356130cb7934fcaf5424e0cc3cb3877aaf846662c1db1198b4c76812d2bf926f5f1bb323e8bd9ea82ec601bd0a40752b55"}) 20:27:05 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000070000000001"], 0x1c}}, 0x0) 20:27:05 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) 20:27:05 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) [ 2117.920327][T30605] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:05 executing program 1: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) (async) ioctl$EVIOCGABS3F(r0, 0x8018457f, &(0x7f0000000000)=""/211) (async) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x1274, 0x0) 20:27:05 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x7f, 0x42880) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f0000000040)={0xde, 0x6, 0x5, "a0e5256778ef08467fdd3fc9448cdaa313e596eba9e6f852d936ea46c481af97238aa2f837ff19b9a26be2d0c2882f0ff2a2b56a2e26d97bfc65e951fc9fa54169b13979abab7c98b0e6cbf959400190271d4671054e6722cd2974d2e7733ee38957df7cd42d465668dd76def896e5b8ad1a4177db4a8bdcbc2ad003f4e95b2b17096f7880746d3e25fe4fad42136b36def6da35e3dddbdef08384751d3e6a788e3d18205a330676c619e05b07356130cb7934fcaf5424e0cc3cb3877aaf846662c1db1198b4c76812d2bf926f5f1bb323e8bd9ea82ec601bd0a40752b55"}) 20:27:05 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000080000000001"], 0x1c}}, 0x0) 20:27:05 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0xa, 0x0) 20:27:05 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_SERVICE(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0xa4, r2, 0x0, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7d34}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x1f}]}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x6}]}, @IPVS_CMD_ATTR_SERVICE={0x10, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x9, 0x6, 'none\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xffffff7f}, @IPVS_CMD_ATTR_DAEMON={0x44, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x9}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @initdev={0xac, 0x1e, 0x0, 0x0}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x8}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x59}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}]}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x1}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x4804}, 0x0) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000000)) 20:27:05 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0xfffffffffffffffd, 0x84000) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f0000000000)=0x1) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:27:05 executing program 1: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) (async, rerun: 32) ioctl$EVIOCGABS3F(r0, 0x8018457f, &(0x7f0000000000)=""/211) (async, rerun: 32) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x1274, 0x0) [ 2117.973578][T30634] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:05 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_SERVICE(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0xa4, r2, 0x0, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7d34}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x1f}]}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x6}]}, @IPVS_CMD_ATTR_SERVICE={0x10, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x9, 0x6, 'none\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xffffff7f}, @IPVS_CMD_ATTR_DAEMON={0x44, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x9}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @initdev={0xac, 0x1e, 0x0, 0x0}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x8}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x59}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}]}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x1}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x4804}, 0x0) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000000)) 20:27:05 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x7f, 0x42880) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f0000000040)={0xde, 0x6, 0x5, "a0e5256778ef08467fdd3fc9448cdaa313e596eba9e6f852d936ea46c481af97238aa2f837ff19b9a26be2d0c2882f0ff2a2b56a2e26d97bfc65e951fc9fa54169b13979abab7c98b0e6cbf959400190271d4671054e6722cd2974d2e7733ee38957df7cd42d465668dd76def896e5b8ad1a4177db4a8bdcbc2ad003f4e95b2b17096f7880746d3e25fe4fad42136b36def6da35e3dddbdef08384751d3e6a788e3d18205a330676c619e05b07356130cb7934fcaf5424e0cc3cb3877aaf846662c1db1198b4c76812d2bf926f5f1bb323e8bd9ea82ec601bd0a40752b55"}) 20:27:05 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0xa, 0x0) 20:27:05 executing program 1: ioctl$SCSI_IOCTL_START_UNIT(0xffffffffffffffff, 0x5) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f0000000000)) 20:27:06 executing program 2: sendmsg$AUDIT_GET(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x3e8, 0x300, 0x70bd2c, 0x25dfdbfb, "", ["", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x891}, 0x8001) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_MCAST_RATE(r1, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1c000000", @ANYRESDEC=r1, @ANYBLOB="200026bd7000fddbdf255c00000008000300", @ANYRES32=0x0, @ANYBLOB="31c20aff20e1c5d7c80235a79880ed6ea4c39c86e5c262abee2152ce633dc6472b9ea8f199a71c826403e8f31902520347bbe09151539b890adc0b0f98fdabe8bb6e59cde89f70d1f99e0c2dea105fe25743347cde3b1c18f3d46e459c6bb035538b5101f3ed53d0cc70b920a718de42e6c07b63aff3598186a6288489c7d49cb004dfb7c295e182a5c2cb984ed8adc1c5b502ec2ea60d9dc51e31772707a4768e93435687083c082b96ff28027c5d9df19e6d4ed2c61d97bcbe04a6380c0b69c72dee3e7ce260be627defbe5cc7"], 0x1c}, 0x1, 0x0, 0x0, 0x9fab9896bb49bb93}, 0x2004080) 20:27:06 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_SERVICE(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0xa4, r2, 0x0, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7d34}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x1f}]}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x6}]}, @IPVS_CMD_ATTR_SERVICE={0x10, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x9, 0x6, 'none\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xffffff7f}, @IPVS_CMD_ATTR_DAEMON={0x44, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x9}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @initdev={0xac, 0x1e, 0x0, 0x0}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x8}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x59}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}]}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x1}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x4804}, 0x0) (async) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000000)) 20:27:06 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000090000000001"], 0x1c}}, 0x0) 20:27:06 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0xfffffffffffffffd, 0x84000) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f0000000000)=0x1) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:27:06 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0xa, 0x0) [ 2118.027697][T30649] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:06 executing program 1: ioctl$SCSI_IOCTL_START_UNIT(0xffffffffffffffff, 0x5) (async) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f0000000000)) 20:27:06 executing program 2: sendmsg$AUDIT_GET(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x3e8, 0x300, 0x70bd2c, 0x25dfdbfb, "", ["", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x891}, 0x8001) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_MCAST_RATE(r1, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1c000000", @ANYRESDEC=r1, @ANYBLOB="200026bd7000fddbdf255c00000008000300", @ANYRES32=0x0, @ANYBLOB="31c20aff20e1c5d7c80235a79880ed6ea4c39c86e5c262abee2152ce633dc6472b9ea8f199a71c826403e8f31902520347bbe09151539b890adc0b0f98fdabe8bb6e59cde89f70d1f99e0c2dea105fe25743347cde3b1c18f3d46e459c6bb035538b5101f3ed53d0cc70b920a718de42e6c07b63aff3598186a6288489c7d49cb004dfb7c295e182a5c2cb984ed8adc1c5b502ec2ea60d9dc51e31772707a4768e93435687083c082b96ff28027c5d9df19e6d4ed2c61d97bcbe04a6380c0b69c72dee3e7ce260be627defbe5cc7"], 0x1c}, 0x1, 0x0, 0x0, 0x9fab9896bb49bb93}, 0x2004080) sendmsg$AUDIT_GET(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x3e8, 0x300, 0x70bd2c, 0x25dfdbfb, "", ["", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x891}, 0x8001) (async) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NL80211_CMD_SET_MCAST_RATE(r1, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1c000000", @ANYRESDEC=r1, @ANYBLOB="200026bd7000fddbdf255c00000008000300", @ANYRES32=0x0, @ANYBLOB="31c20aff20e1c5d7c80235a79880ed6ea4c39c86e5c262abee2152ce633dc6472b9ea8f199a71c826403e8f31902520347bbe09151539b890adc0b0f98fdabe8bb6e59cde89f70d1f99e0c2dea105fe25743347cde3b1c18f3d46e459c6bb035538b5101f3ed53d0cc70b920a718de42e6c07b63aff3598186a6288489c7d49cb004dfb7c295e182a5c2cb984ed8adc1c5b502ec2ea60d9dc51e31772707a4768e93435687083c082b96ff28027c5d9df19e6d4ed2c61d97bcbe04a6380c0b69c72dee3e7ce260be627defbe5cc7"], 0x1c}, 0x1, 0x0, 0x0, 0x9fab9896bb49bb93}, 0x2004080) (async) 20:27:06 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0xfffffffffffffffd, 0x84000) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f0000000000)=0x1) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:27:06 executing program 0: sendmsg$NL80211_CMD_NEW_MPATH(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="dfa2111b", @ANYRES16=0x0, @ANYBLOB="200027bd7000ffdbdf251700000008000300", @ANYRES32=0x0, @ANYBLOB="0c00990000020000290000000a0006000802110000010000"], 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x40) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_DEV(r1, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x40, 0x0, 0x8, 0x70bd27, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_DEVICE={0x10, 0x23, 0x0, 0x1, {0xc, 0x4, {0xaaaaaaaaaaaa0102}}}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}]}, 0x40}, 0x1, 0x0, 0x0, 0x40}, 0x4000000) ioctl$SG_NEXT_CMD_LEN(0xffffffffffffffff, 0x2283, &(0x7f0000000100)=0x35) 20:27:06 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) 20:27:06 executing program 1: ioctl$SCSI_IOCTL_START_UNIT(0xffffffffffffffff, 0x5) (async) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f0000000000)) 20:27:06 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000a0000000001"], 0x1c}}, 0x0) 20:27:06 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x9, 0x32820) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r2, 0x1, &(0x7f0000000080)=ANY=[@ANYBLOB="6f0000003f000000d9a500008bdcd66fb122565920952447fd334d4bd1084fc805b73a1d3aacd4ec2bca2c7be9aa618ef7b475696947bba47346ebdd7eca4874cbec98f8f722719fd9f52f5b83ddde5a0e8c42379eed41e55715dbf8a9309e660a44f4ed7751eab55995d3aeffc4b9f9b75c42fc33742c1b6307b2"]) ioctl$SCSI_IOCTL_SYNC(r1, 0x4) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100), 0x208100, 0x0) ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, 0x1) ioctl$SG_GET_RESERVED_SIZE(r3, 0x2272, &(0x7f0000000040)) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:27:06 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x8, 0x268c81) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f0000000080)={0x6a, 0x1, 0x7fff, "74473d44b17ee98b0466716830c8f131e961dd671b7f20e69a3b68283e782875d6ec0864d59f64a08806d1924ec77da4f8ae9fbeae4c91d7151292d491eb16beaf13a3271300f12f195a5b21319df761088660f2fd96a550ec5541a22bcff05458143d299adf978d1602"}) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) [ 2118.103172][T30676] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:06 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) 20:27:06 executing program 2: sendmsg$AUDIT_GET(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x3e8, 0x300, 0x70bd2c, 0x25dfdbfb, "", ["", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x891}, 0x8001) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_MCAST_RATE(r1, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1c000000", @ANYRESDEC=r1, @ANYBLOB="200026bd7000fddbdf255c00000008000300", @ANYRES32=0x0, @ANYBLOB="31c20aff20e1c5d7c80235a79880ed6ea4c39c86e5c262abee2152ce633dc6472b9ea8f199a71c826403e8f31902520347bbe09151539b890adc0b0f98fdabe8bb6e59cde89f70d1f99e0c2dea105fe25743347cde3b1c18f3d46e459c6bb035538b5101f3ed53d0cc70b920a718de42e6c07b63aff3598186a6288489c7d49cb004dfb7c295e182a5c2cb984ed8adc1c5b502ec2ea60d9dc51e31772707a4768e93435687083c082b96ff28027c5d9df19e6d4ed2c61d97bcbe04a6380c0b69c72dee3e7ce260be627defbe5cc7"], 0x1c}, 0x1, 0x0, 0x0, 0x9fab9896bb49bb93}, 0x2004080) sendmsg$AUDIT_GET(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x3e8, 0x300, 0x70bd2c, 0x25dfdbfb, "", ["", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x891}, 0x8001) (async) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NL80211_CMD_SET_MCAST_RATE(r1, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1c000000", @ANYRESDEC=r1, @ANYBLOB="200026bd7000fddbdf255c00000008000300", @ANYRES32=0x0, @ANYBLOB="31c20aff20e1c5d7c80235a79880ed6ea4c39c86e5c262abee2152ce633dc6472b9ea8f199a71c826403e8f31902520347bbe09151539b890adc0b0f98fdabe8bb6e59cde89f70d1f99e0c2dea105fe25743347cde3b1c18f3d46e459c6bb035538b5101f3ed53d0cc70b920a718de42e6c07b63aff3598186a6288489c7d49cb004dfb7c295e182a5c2cb984ed8adc1c5b502ec2ea60d9dc51e31772707a4768e93435687083c082b96ff28027c5d9df19e6d4ed2c61d97bcbe04a6380c0b69c72dee3e7ce260be627defbe5cc7"], 0x1c}, 0x1, 0x0, 0x0, 0x9fab9896bb49bb93}, 0x2004080) (async) 20:27:06 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000b0000000001"], 0x1c}}, 0x0) 20:27:06 executing program 0: sendmsg$NL80211_CMD_NEW_MPATH(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="dfa2111b", @ANYRES16=0x0, @ANYBLOB="200027bd7000ffdbdf251700000008000300", @ANYRES32=0x0, @ANYBLOB="0c00990000020000290000000a0006000802110000010000"], 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x40) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async, rerun: 64) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_DEV(r1, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x40, 0x0, 0x8, 0x70bd27, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_DEVICE={0x10, 0x23, 0x0, 0x1, {0xc, 0x4, {0xaaaaaaaaaaaa0102}}}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}]}, 0x40}, 0x1, 0x0, 0x0, 0x40}, 0x4000000) (async) ioctl$SG_NEXT_CMD_LEN(0xffffffffffffffff, 0x2283, &(0x7f0000000100)=0x35) 20:27:06 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async, rerun: 64) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x9, 0x32820) (rerun: 64) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_SEND_COMMAND(r2, 0x1, &(0x7f0000000080)=ANY=[@ANYBLOB="6f0000003f000000d9a500008bdcd66fb122565920952447fd334d4bd1084fc805b73a1d3aacd4ec2bca2c7be9aa618ef7b475696947bba47346ebdd7eca4874cbec98f8f722719fd9f52f5b83ddde5a0e8c42379eed41e55715dbf8a9309e660a44f4ed7751eab55995d3aeffc4b9f9b75c42fc33742c1b6307b2"]) (async) ioctl$SCSI_IOCTL_SYNC(r1, 0x4) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) (async) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100), 0x208100, 0x0) ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, 0x1) (async) ioctl$SG_GET_RESERVED_SIZE(r3, 0x2272, &(0x7f0000000040)) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:27:06 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) 20:27:06 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x8, 0x268c81) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f0000000080)={0x6a, 0x1, 0x7fff, "74473d44b17ee98b0466716830c8f131e961dd671b7f20e69a3b68283e782875d6ec0864d59f64a08806d1924ec77da4f8ae9fbeae4c91d7151292d491eb16beaf13a3271300f12f195a5b21319df761088660f2fd96a550ec5541a22bcff05458143d299adf978d1602"}) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) syz_open_dev$sg(&(0x7f0000000040), 0x8, 0x268c81) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f0000000080)={0x6a, 0x1, 0x7fff, "74473d44b17ee98b0466716830c8f131e961dd671b7f20e69a3b68283e782875d6ec0864d59f64a08806d1924ec77da4f8ae9fbeae4c91d7151292d491eb16beaf13a3271300f12f195a5b21319df761088660f2fd96a550ec5541a22bcff05458143d299adf978d1602"}) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) 20:27:06 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) r1 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r2, 0x2287, &(0x7f0000000240)=0x80000001) ioctl$PTP_PIN_GETFUNC2(r1, 0xc0603d0f, &(0x7f00000000c0)={'\x00', 0x6, 0x0, 0x8001}) r3 = syz_open_dev$sg(&(0x7f0000000000), 0x400, 0x40) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r4, 0x0, 0x0) r5 = syz_open_dev$sg(&(0x7f00000001c0), 0x4, 0x28000) ioctl$SG_GET_RESERVED_SIZE(r5, 0x2272, &(0x7f0000000200)) ioctl$SG_SET_RESERVED_SIZE(r4, 0x2275, &(0x7f0000000180)=0x3) ioctl$SG_NEXT_CMD_LEN(r3, 0x2283, &(0x7f0000000040)=0x34) socket$inet_sctp(0x2, 0x1, 0x84) modify_ldt$write(0x1, &(0x7f0000000140)={0xfffffff7, 0x0, 0x2000, 0x1, 0x3, 0x1, 0x1, 0x0, 0x1}, 0x10) io_uring_register$IORING_UNREGISTER_BUFFERS(r4, 0x1, 0x0, 0x0) 20:27:06 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000c0000000001"], 0x1c}}, 0x0) 20:27:06 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x8, 0x268c81) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f0000000080)={0x6a, 0x1, 0x7fff, "74473d44b17ee98b0466716830c8f131e961dd671b7f20e69a3b68283e782875d6ec0864d59f64a08806d1924ec77da4f8ae9fbeae4c91d7151292d491eb16beaf13a3271300f12f195a5b21319df761088660f2fd96a550ec5541a22bcff05458143d299adf978d1602"}) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) syz_open_dev$sg(&(0x7f0000000040), 0x8, 0x268c81) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f0000000080)={0x6a, 0x1, 0x7fff, "74473d44b17ee98b0466716830c8f131e961dd671b7f20e69a3b68283e782875d6ec0864d59f64a08806d1924ec77da4f8ae9fbeae4c91d7151292d491eb16beaf13a3271300f12f195a5b21319df761088660f2fd96a550ec5541a22bcff05458143d299adf978d1602"}) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) 20:27:06 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x9, 0x32820) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r2, 0x1, &(0x7f0000000080)=ANY=[@ANYBLOB="6f0000003f000000d9a500008bdcd66fb122565920952447fd334d4bd1084fc805b73a1d3aacd4ec2bca2c7be9aa618ef7b475696947bba47346ebdd7eca4874cbec98f8f722719fd9f52f5b83ddde5a0e8c42379eed41e55715dbf8a9309e660a44f4ed7751eab55995d3aeffc4b9f9b75c42fc33742c1b6307b2"]) ioctl$SCSI_IOCTL_SYNC(r1, 0x4) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100), 0x208100, 0x0) ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, 0x1) ioctl$SG_GET_RESERVED_SIZE(r3, 0x2272, &(0x7f0000000040)) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) syz_open_dev$sg(&(0x7f0000000000), 0x9, 0x32820) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r2, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_SEND_COMMAND(r2, 0x1, &(0x7f0000000080)=ANY=[@ANYBLOB="6f0000003f000000d9a500008bdcd66fb122565920952447fd334d4bd1084fc805b73a1d3aacd4ec2bca2c7be9aa618ef7b475696947bba47346ebdd7eca4874cbec98f8f722719fd9f52f5b83ddde5a0e8c42379eed41e55715dbf8a9309e660a44f4ed7751eab55995d3aeffc4b9f9b75c42fc33742c1b6307b2"]) (async) ioctl$SCSI_IOCTL_SYNC(r1, 0x4) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r3, 0x0, 0x0) (async) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100), 0x208100, 0x0) (async) ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, 0x1) (async) ioctl$SG_GET_RESERVED_SIZE(r3, 0x2272, &(0x7f0000000040)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) 20:27:06 executing program 0: sendmsg$NL80211_CMD_NEW_MPATH(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="dfa2111b", @ANYRES16=0x0, @ANYBLOB="200027bd7000ffdbdf251700000008000300", @ANYRES32=0x0, @ANYBLOB="0c00990000020000290000000a0006000802110000010000"], 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x40) (async, rerun: 64) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (rerun: 64) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_DEV(r1, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x40, 0x0, 0x8, 0x70bd27, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_DEVICE={0x10, 0x23, 0x0, 0x1, {0xc, 0x4, {0xaaaaaaaaaaaa0102}}}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}]}, 0x40}, 0x1, 0x0, 0x0, 0x40}, 0x4000000) (async, rerun: 32) ioctl$SG_NEXT_CMD_LEN(0xffffffffffffffff, 0x2283, &(0x7f0000000100)=0x35) (rerun: 32) 20:27:06 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000d0000000001"], 0x1c}}, 0x0) 20:27:06 executing program 3: syz_open_dev$sg(0x0, 0x0, 0x82) 20:27:06 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) r1 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) (async) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) (async) ioctl$SG_SET_KEEP_ORPHAN(r2, 0x2287, &(0x7f0000000240)=0x80000001) (async) ioctl$PTP_PIN_GETFUNC2(r1, 0xc0603d0f, &(0x7f00000000c0)={'\x00', 0x6, 0x0, 0x8001}) (async) r3 = syz_open_dev$sg(&(0x7f0000000000), 0x400, 0x40) (async, rerun: 64) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (rerun: 64) write$vga_arbiter(r4, 0x0, 0x0) r5 = syz_open_dev$sg(&(0x7f00000001c0), 0x4, 0x28000) ioctl$SG_GET_RESERVED_SIZE(r5, 0x2272, &(0x7f0000000200)) ioctl$SG_SET_RESERVED_SIZE(r4, 0x2275, &(0x7f0000000180)=0x3) ioctl$SG_NEXT_CMD_LEN(r3, 0x2283, &(0x7f0000000040)=0x34) (async) socket$inet_sctp(0x2, 0x1, 0x84) (async) modify_ldt$write(0x1, &(0x7f0000000140)={0xfffffff7, 0x0, 0x2000, 0x1, 0x3, 0x1, 0x1, 0x0, 0x1}, 0x10) (async) io_uring_register$IORING_UNREGISTER_BUFFERS(r4, 0x1, 0x0, 0x0) 20:27:06 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan0\x00'}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs2/custom0\x00', 0x802, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000100)) r3 = syz_open_dev$evdev(&(0x7f0000000080), 0x8, 0x501000) ioctl$EVIOCSCLOCKID(r3, 0x400445a0, &(0x7f00000000c0)=0x9) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000000)) 20:27:06 executing program 3: syz_open_dev$sg(0x0, 0x0, 0x82) 20:27:06 executing program 5: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x7, 0x200000) ioctl$EVIOCGLED(r0, 0x80404519, &(0x7f0000000080)=""/87) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x80, 0x2000) ioctl$SG_GET_COMMAND_Q(r1, 0x1267, 0x0) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000100), 0x8) ioctl$EVIOCGLED(r2, 0x80404519, &(0x7f0000000140)=""/38) 20:27:06 executing program 0: ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x1276, 0x0) 20:27:06 executing program 5: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x7, 0x200000) ioctl$EVIOCGLED(r0, 0x80404519, &(0x7f0000000080)=""/87) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x80, 0x2000) ioctl$SG_GET_COMMAND_Q(r1, 0x1267, 0x0) (async) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000100), 0x8) ioctl$EVIOCGLED(r2, 0x80404519, &(0x7f0000000140)=""/38) 20:27:06 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) r1 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) (async) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r2, 0x2287, &(0x7f0000000240)=0x80000001) (async) ioctl$PTP_PIN_GETFUNC2(r1, 0xc0603d0f, &(0x7f00000000c0)={'\x00', 0x6, 0x0, 0x8001}) r3 = syz_open_dev$sg(&(0x7f0000000000), 0x400, 0x40) (async) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r4, 0x0, 0x0) (async) r5 = syz_open_dev$sg(&(0x7f00000001c0), 0x4, 0x28000) ioctl$SG_GET_RESERVED_SIZE(r5, 0x2272, &(0x7f0000000200)) (async) ioctl$SG_SET_RESERVED_SIZE(r4, 0x2275, &(0x7f0000000180)=0x3) ioctl$SG_NEXT_CMD_LEN(r3, 0x2283, &(0x7f0000000040)=0x34) (async) socket$inet_sctp(0x2, 0x1, 0x84) (async) modify_ldt$write(0x1, &(0x7f0000000140)={0xfffffff7, 0x0, 0x2000, 0x1, 0x3, 0x1, 0x1, 0x0, 0x1}, 0x10) io_uring_register$IORING_UNREGISTER_BUFFERS(r4, 0x1, 0x0, 0x0) 20:27:06 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000e0000000001"], 0x1c}}, 0x0) 20:27:06 executing program 5: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x7, 0x200000) ioctl$EVIOCGLED(r0, 0x80404519, &(0x7f0000000080)=""/87) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x80, 0x2000) ioctl$SG_GET_COMMAND_Q(r1, 0x1267, 0x0) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000100), 0x8) ioctl$EVIOCGLED(r2, 0x80404519, &(0x7f0000000140)=""/38) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) syz_open_dev$evdev(&(0x7f0000000040), 0x7, 0x200000) (async) ioctl$EVIOCGLED(r0, 0x80404519, &(0x7f0000000080)=""/87) (async) syz_open_dev$sg(&(0x7f0000000000), 0x80, 0x2000) (async) ioctl$SG_GET_COMMAND_Q(r1, 0x1267, 0x0) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000100), 0x8) (async) ioctl$EVIOCGLED(r2, 0x80404519, &(0x7f0000000140)=""/38) (async) 20:27:06 executing program 3: syz_open_dev$sg(0x0, 0x0, 0x82) 20:27:06 executing program 0: ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x1276, 0x0) 20:27:06 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x4, 0x6c0002) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f0000000040)) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) 20:27:06 executing program 5: sendmsg$AUDIT_SIGNAL_INFO(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x3f2, 0x4, 0x70bd27, 0x25dfdbfc, "", ["", "", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x4004810}, 0x810) r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_TTY(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="10000000640400cdbe1fb2c9faffffffb652303a7199b732bc8748ab1290a5d1e88d0d9408f732e58fe61450d04ce9a6b39d321f9d9b6955c15a4fcae14afc2385e27a9410f3acb53c928700e25f3afbee92d11940cf20b4d5ca1aa8644cd9f7bfea62876ce5e21c54e61b2b"], 0x10}}, 0x0) sendmsg$AUDIT_GET_FEATURE(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x10, 0x3fb, 0x20, 0x70bd28, 0x25dfdbfb, "", [""]}, 0x10}, 0x1, 0x0, 0x0, 0x2004c004}, 0x880) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x408200) ioctl$SG_GET_COMMAND_Q(r1, 0x1267, 0x0) 20:27:06 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan0\x00'}) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs2/custom0\x00', 0x802, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000100)) (async) r3 = syz_open_dev$evdev(&(0x7f0000000080), 0x8, 0x501000) ioctl$EVIOCSCLOCKID(r3, 0x400445a0, &(0x7f00000000c0)=0x9) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000000)) 20:27:06 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000f0000000001"], 0x1c}}, 0x0) 20:27:06 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) 20:27:06 executing program 0: ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x1276, 0x0) ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x1276, 0x0) (async) 20:27:06 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x4, 0x6c0002) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f0000000040)) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) 20:27:06 executing program 5: sendmsg$AUDIT_SIGNAL_INFO(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x3f2, 0x4, 0x70bd27, 0x25dfdbfc, "", ["", "", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x4004810}, 0x810) r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_TTY(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="10000000640400cdbe1fb2c9faffffffb652303a7199b732bc8748ab1290a5d1e88d0d9408f732e58fe61450d04ce9a6b39d321f9d9b6955c15a4fcae14afc2385e27a9410f3acb53c928700e25f3afbee92d11940cf20b4d5ca1aa8644cd9f7bfea62876ce5e21c54e61b2b"], 0x10}}, 0x0) sendmsg$AUDIT_GET_FEATURE(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x10, 0x3fb, 0x20, 0x70bd28, 0x25dfdbfb, "", [""]}, 0x10}, 0x1, 0x0, 0x0, 0x2004c004}, 0x880) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x408200) ioctl$SG_GET_COMMAND_Q(r1, 0x1267, 0x0) sendmsg$AUDIT_SIGNAL_INFO(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x3f2, 0x4, 0x70bd27, 0x25dfdbfc, "", ["", "", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x4004810}, 0x810) (async) socket$nl_audit(0x10, 0x3, 0x9) (async) sendmsg$AUDIT_USER_TTY(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="10000000640400cdbe1fb2c9faffffffb652303a7199b732bc8748ab1290a5d1e88d0d9408f732e58fe61450d04ce9a6b39d321f9d9b6955c15a4fcae14afc2385e27a9410f3acb53c928700e25f3afbee92d11940cf20b4d5ca1aa8644cd9f7bfea62876ce5e21c54e61b2b"], 0x10}}, 0x0) (async) sendmsg$AUDIT_GET_FEATURE(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x10, 0x3fb, 0x20, 0x70bd28, 0x25dfdbfb, "", [""]}, 0x10}, 0x1, 0x0, 0x0, 0x2004c004}, 0x880) (async) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x408200) (async) ioctl$SG_GET_COMMAND_Q(r1, 0x1267, 0x0) (async) 20:27:06 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r1 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_TTY(r1, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x10}, 0x10}}, 0x0) sendmsg$AUDIT_USER_AVC(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x106200008}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x50, 0x453, 0x300, 0x70bd25, 0x25dfdbff, "e7c20966e76a6e601ac78649951f075e2dba9599490c69eda2793400a52341fbc66126902ba2b8439f1571415c5b422eb74cdcfff527f7122109d68932d3", ["", "", "", ""]}, 0x50}}, 0x0) 20:27:06 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000100000000001"], 0x1c}}, 0x0) 20:27:06 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x4, 0x6c0002) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f0000000040)) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x4, 0x6c0002) (async) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f0000000040)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) 20:27:06 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) 20:27:06 executing program 5: sendmsg$AUDIT_SIGNAL_INFO(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x3f2, 0x4, 0x70bd27, 0x25dfdbfc, "", ["", "", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x4004810}, 0x810) r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_TTY(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="10000000640400cdbe1fb2c9faffffffb652303a7199b732bc8748ab1290a5d1e88d0d9408f732e58fe61450d04ce9a6b39d321f9d9b6955c15a4fcae14afc2385e27a9410f3acb53c928700e25f3afbee92d11940cf20b4d5ca1aa8644cd9f7bfea62876ce5e21c54e61b2b"], 0x10}}, 0x0) (async) sendmsg$AUDIT_GET_FEATURE(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x10, 0x3fb, 0x20, 0x70bd28, 0x25dfdbfb, "", [""]}, 0x10}, 0x1, 0x0, 0x0, 0x2004c004}, 0x880) (async, rerun: 32) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x408200) (rerun: 32) ioctl$SG_GET_COMMAND_Q(r1, 0x1267, 0x0) 20:27:06 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x422302) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) [ 2118.438337][ T24] audit: type=1107 audit(1643228826.357:2604): pid=30824 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t msg=' fjn`džI^-I iy4' 20:27:06 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan0\x00'}) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs2/custom0\x00', 0x802, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000100)) r3 = syz_open_dev$evdev(&(0x7f0000000080), 0x8, 0x501000) ioctl$EVIOCSCLOCKID(r3, 0x400445a0, &(0x7f00000000c0)=0x9) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000000)) 20:27:06 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) 20:27:06 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000110000000001"], 0x1c}}, 0x0) 20:27:06 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r1 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_TTY(r1, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x10}, 0x10}}, 0x0) sendmsg$AUDIT_USER_AVC(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x106200008}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x50, 0x453, 0x300, 0x70bd25, 0x25dfdbff, "e7c20966e76a6e601ac78649951f075e2dba9599490c69eda2793400a52341fbc66126902ba2b8439f1571415c5b422eb74cdcfff527f7122109d68932d3", ["", "", "", ""]}, 0x50}}, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) socket$nl_audit(0x10, 0x3, 0x9) (async) sendmsg$AUDIT_USER_TTY(r1, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x10}, 0x10}}, 0x0) (async) sendmsg$AUDIT_USER_AVC(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x106200008}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x50, 0x453, 0x300, 0x70bd25, 0x25dfdbff, "e7c20966e76a6e601ac78649951f075e2dba9599490c69eda2793400a52341fbc66126902ba2b8439f1571415c5b422eb74cdcfff527f7122109d68932d3", ["", "", "", ""]}, 0x50}}, 0x0) (async) 20:27:06 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x80000000, 0x101000) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) ioctl$SCSI_IOCTL_SYNC(r1, 0x4) 20:27:06 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x422302) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x422302) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) 20:27:06 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x80000000, 0x101000) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) ioctl$SCSI_IOCTL_SYNC(r1, 0x4) 20:27:06 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0xa, 0x82) 20:27:06 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x422302) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) 20:27:06 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000120000000001"], 0x1c}}, 0x0) [ 2118.516694][ T24] audit: type=1107 audit(1643228826.437:2605): pid=30850 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t msg=' fjn`džI^-I iy4' 20:27:06 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) r1 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_TTY(r1, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x10}, 0x10}}, 0x0) (async) sendmsg$AUDIT_USER_AVC(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x106200008}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x50, 0x453, 0x300, 0x70bd25, 0x25dfdbff, "e7c20966e76a6e601ac78649951f075e2dba9599490c69eda2793400a52341fbc66126902ba2b8439f1571415c5b422eb74cdcfff527f7122109d68932d3", ["", "", "", ""]}, 0x50}}, 0x0) 20:27:06 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000250000000001"], 0x1c}}, 0x0) [ 2118.560215][ T24] audit: type=1107 audit(1643228826.457:2606): pid=30850 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t msg=' fjn`džI^-I iy4' 20:27:06 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x7, 0x2001) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) 20:27:06 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x80000000, 0x101000) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) ioctl$SCSI_IOCTL_SYNC(r1, 0x4) 20:27:06 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0xfffffffffffffffe, 0x200000) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SCSI_IOCTL_SYNC(r1, 0x4) 20:27:06 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000480000000001"], 0x1c}}, 0x0) 20:27:06 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0xa, 0x82) [ 2118.597104][ T24] audit: type=1107 audit(1643228826.507:2607): pid=30880 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t msg=' fjn`džI^-I iy4' 20:27:06 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f0000000240)) write$vga_arbiter(r0, 0x0, 0x0) sendmsg$TIPC_CMD_SET_NETID(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x24, 0x0, 0x4, 0x70bd2c, 0x25dfdbfc, {{}, {}, {0x8, 0x2, 0x8}}, ["", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x40880}, 0x400c010) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(r2, 0x84, 0x21, &(0x7f0000000280)=0x7fffffff, 0x4) ioctl$SG_GET_COMMAND_Q(r1, 0x1275, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r3, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r4, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x36}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_SET_PMKSA(r0, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x6c, r4, 0x400, 0x70bd28, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x0, 0xe}}}}, [@NL80211_ATTR_SSID={0x24, 0x34, @random="9d281f44add6ebea78a81236f5b0d69820f798d976b0d212945ea97496f2afdf"}, @NL80211_ATTR_PMKID={0x14, 0x55, "e97068e199004d0550bc21333c637119"}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_FILS_CACHE_ID={0x6, 0xfd, 0x400}]}, 0x6c}, 0x1, 0x0, 0x0, 0x10}, 0x0) 20:27:06 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000004c0000000001"], 0x1c}}, 0x0) 20:27:06 executing program 5: r0 = syz_open_dev$sg(&(0x7f00000000c0), 0x27, 0x0) write$vga_arbiter(0xffffffffffffffff, 0x0, 0x0) ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000000)=0x6) ioctl$SCSI_IOCTL_START_UNIT(0xffffffffffffffff, 0x5) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:27:06 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0xfffffffffffffffe, 0x200000) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SCSI_IOCTL_SYNC(r1, 0x4) 20:27:06 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x7, 0x2001) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) 20:27:06 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0xa, 0x82) 20:27:06 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0xfffffffffffffffe, 0x200000) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async, rerun: 64) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (rerun: 64) ioctl$SCSI_IOCTL_SYNC(r1, 0x4) 20:27:06 executing program 5: r0 = syz_open_dev$sg(&(0x7f00000000c0), 0x27, 0x0) write$vga_arbiter(0xffffffffffffffff, 0x0, 0x0) ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000000)=0x6) ioctl$SCSI_IOCTL_START_UNIT(0xffffffffffffffff, 0x5) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) syz_open_dev$sg(&(0x7f00000000c0), 0x27, 0x0) (async) write$vga_arbiter(0xffffffffffffffff, 0x0, 0x0) (async) ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000000)=0x6) (async) ioctl$SCSI_IOCTL_START_UNIT(0xffffffffffffffff, 0x5) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) 20:27:06 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f0000000240)) write$vga_arbiter(r0, 0x0, 0x0) (async) sendmsg$TIPC_CMD_SET_NETID(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x24, 0x0, 0x4, 0x70bd2c, 0x25dfdbfc, {{}, {}, {0x8, 0x2, 0x8}}, ["", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x40880}, 0x400c010) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) (async) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(r2, 0x84, 0x21, &(0x7f0000000280)=0x7fffffff, 0x4) (async) ioctl$SG_GET_COMMAND_Q(r1, 0x1275, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r3, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r4, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x36}]}, 0x24}}, 0x0) (async) sendmsg$NL80211_CMD_SET_PMKSA(r0, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x6c, r4, 0x400, 0x70bd28, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x0, 0xe}}}}, [@NL80211_ATTR_SSID={0x24, 0x34, @random="9d281f44add6ebea78a81236f5b0d69820f798d976b0d212945ea97496f2afdf"}, @NL80211_ATTR_PMKID={0x14, 0x55, "e97068e199004d0550bc21333c637119"}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_FILS_CACHE_ID={0x6, 0xfd, 0x400}]}, 0x6c}, 0x1, 0x0, 0x0, 0x10}, 0x0) 20:27:06 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) syz_open_dev$sg(&(0x7f0000000000), 0x7, 0x2001) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) 20:27:06 executing program 3: syz_open_dev$sg(0x0, 0xa, 0x82) 20:27:06 executing program 0: getpid() r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:27:06 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000600000000001"], 0x1c}}, 0x0) 20:27:06 executing program 5: r0 = syz_open_dev$sg(&(0x7f00000000c0), 0x27, 0x0) write$vga_arbiter(0xffffffffffffffff, 0x0, 0x0) ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000000)=0x6) ioctl$SCSI_IOCTL_START_UNIT(0xffffffffffffffff, 0x5) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) syz_open_dev$sg(&(0x7f00000000c0), 0x27, 0x0) (async) write$vga_arbiter(0xffffffffffffffff, 0x0, 0x0) (async) ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000000)=0x6) (async) ioctl$SCSI_IOCTL_START_UNIT(0xffffffffffffffff, 0x5) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) 20:27:06 executing program 0: getpid() r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:27:06 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$PTP_CLOCK_GETCAPS(0xffffffffffffffff, 0x80503d01, &(0x7f0000000000)) socket$packet(0x11, 0x0, 0x300) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:27:06 executing program 3: syz_open_dev$sg(0x0, 0xa, 0x82) 20:27:06 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000080), 0x3, 0x600940) ioctl$SCSI_IOCTL_SYNC(r1, 0x4) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f00000000c0)) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000000)={0x6a, 0xc55, 0x8, "4fd3576d2d1e894c9469412a3d302442891dd820bfabebbc34d7e6470c63bdee936e770b1fefaecc56dbaac4f8d7a47a7d6b50be6e8942036f9602f270d422665410e5e5af3978d12dd46ffd731e60382323d685a816106ab86d9d79c02a1f61a9cd5ffc62a3fec0718f"}) 20:27:06 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000680000000001"], 0x1c}}, 0x0) 20:27:06 executing program 0: getpid() (async) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:27:06 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f0000000240)) (async, rerun: 64) write$vga_arbiter(r0, 0x0, 0x0) (async, rerun: 64) sendmsg$TIPC_CMD_SET_NETID(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x24, 0x0, 0x4, 0x70bd2c, 0x25dfdbfc, {{}, {}, {0x8, 0x2, 0x8}}, ["", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x40880}, 0x400c010) (async, rerun: 64) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async, rerun: 64) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(r2, 0x84, 0x21, &(0x7f0000000280)=0x7fffffff, 0x4) ioctl$SG_GET_COMMAND_Q(r1, 0x1275, 0x0) (async, rerun: 32) r3 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r3, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r4, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x36}]}, 0x24}}, 0x0) (async) sendmsg$NL80211_CMD_SET_PMKSA(r0, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x6c, r4, 0x400, 0x70bd28, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x0, 0xe}}}}, [@NL80211_ATTR_SSID={0x24, 0x34, @random="9d281f44add6ebea78a81236f5b0d69820f798d976b0d212945ea97496f2afdf"}, @NL80211_ATTR_PMKID={0x14, 0x55, "e97068e199004d0550bc21333c637119"}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_FILS_CACHE_ID={0x6, 0xfd, 0x400}]}, 0x6c}, 0x1, 0x0, 0x0, 0x10}, 0x0) 20:27:06 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$PTP_CLOCK_GETCAPS(0xffffffffffffffff, 0x80503d01, &(0x7f0000000000)) socket$packet(0x11, 0x0, 0x300) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:27:06 executing program 3: syz_open_dev$sg(0x0, 0xa, 0x82) 20:27:06 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$PTP_CLOCK_GETCAPS(0xffffffffffffffff, 0x80503d01, &(0x7f0000000000)) socket$packet(0x11, 0x0, 0x300) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$PTP_CLOCK_GETCAPS(0xffffffffffffffff, 0x80503d01, &(0x7f0000000000)) (async) socket$packet(0x11, 0x0, 0x300) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) 20:27:06 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000006c0000000001"], 0x1c}}, 0x0) 20:27:06 executing program 0: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x800, 0x26400) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000080), 0x7, 0x2000) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r4, 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:27:06 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) [ 2118.792443][T30948] program syz-executor.5 is using a deprecated SCSI ioctl, please convert it to SG_IO 20:27:06 executing program 0: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) (async) syz_open_dev$sg(&(0x7f0000000000), 0x800, 0x26400) (async) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) (async) syz_open_dev$sg(&(0x7f0000000080), 0x7, 0x2000) (async) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r4, 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:27:06 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x202201) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x8, 0x8000) ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5387, &(0x7f0000000080)) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:27:06 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) r1 = syz_open_dev$sg(&(0x7f0000000080), 0x3, 0x600940) ioctl$SCSI_IOCTL_SYNC(r1, 0x4) (async) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f00000000c0)) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000000)={0x6a, 0xc55, 0x8, "4fd3576d2d1e894c9469412a3d302442891dd820bfabebbc34d7e6470c63bdee936e770b1fefaecc56dbaac4f8d7a47a7d6b50be6e8942036f9602f270d422665410e5e5af3978d12dd46ffd731e60382323d685a816106ab86d9d79c02a1f61a9cd5ffc62a3fec0718f"}) 20:27:06 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000740000000001"], 0x1c}}, 0x0) 20:27:06 executing program 0: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) (async) syz_open_dev$sg(&(0x7f0000000000), 0x800, 0x26400) (async) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) (async) syz_open_dev$sg(&(0x7f0000000080), 0x7, 0x2000) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r4, 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:27:06 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x800000000000, 0x10d000) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0xfc58) ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) 20:27:06 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x202201) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x8, 0x8000) ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5387, &(0x7f0000000080)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:27:06 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) 20:27:06 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000007a0000000001"], 0x1c}}, 0x0) 20:27:06 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x6, 0x880c3) ioctl$SG_SET_KEEP_ORPHAN(r1, 0x2287, &(0x7f0000000040)=0x8000) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:27:06 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x800000000000, 0x10d000) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0xfc58) ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) 20:27:06 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) 20:27:06 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x202201) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x8, 0x8000) ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5387, &(0x7f0000000080)) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x202201) (async) syz_open_dev$sg(&(0x7f0000000040), 0x8, 0x8000) (async) ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5387, &(0x7f0000000080)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) 20:27:07 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x6, 0x880c3) ioctl$SG_SET_KEEP_ORPHAN(r1, 0x2287, &(0x7f0000000040)=0x8000) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) [ 2119.042777][T31003] program syz-executor.5 is using a deprecated SCSI ioctl, please convert it to SG_IO 20:27:07 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000080), 0x3, 0x600940) ioctl$SCSI_IOCTL_SYNC(r1, 0x4) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f00000000c0)) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000000)={0x6a, 0xc55, 0x8, "4fd3576d2d1e894c9469412a3d302442891dd820bfabebbc34d7e6470c63bdee936e770b1fefaecc56dbaac4f8d7a47a7d6b50be6e8942036f9602f270d422665410e5e5af3978d12dd46ffd731e60382323d685a816106ab86d9d79c02a1f61a9cd5ffc62a3fec0718f"}) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) syz_open_dev$sg(&(0x7f0000000080), 0x3, 0x600940) (async) ioctl$SCSI_IOCTL_SYNC(r1, 0x4) (async) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f00000000c0)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000000)={0x6a, 0xc55, 0x8, "4fd3576d2d1e894c9469412a3d302442891dd820bfabebbc34d7e6470c63bdee936e770b1fefaecc56dbaac4f8d7a47a7d6b50be6e8942036f9602f270d422665410e5e5af3978d12dd46ffd731e60382323d685a816106ab86d9d79c02a1f61a9cd5ffc62a3fec0718f"}) (async) 20:27:07 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x800000000000, 0x10d000) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0xfc58) ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) syz_open_dev$sg(&(0x7f0000000380), 0x800000000000, 0x10d000) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0xfc58) (async) ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) (async) 20:27:07 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) 20:27:07 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000300000001"], 0x1c}}, 0x0) 20:27:07 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) 20:27:07 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async, rerun: 32) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x6, 0x880c3) (rerun: 32) ioctl$SG_SET_KEEP_ORPHAN(r1, 0x2287, &(0x7f0000000040)=0x8000) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:27:07 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x44100) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x8, 0x4000) ioctl$SCSI_IOCTL_SYNC(r1, 0x4) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f0000000040)) 20:27:07 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) 20:27:07 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000500000001"], 0x1c}}, 0x0) 20:27:07 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x400400, 0x0) ioctl$BINDER_CTL_ADD(r0, 0xc1086201, &(0x7f0000000040)={'custom1\x00'}) ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x1275, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x49a182, 0x0) sendmsg$AUDIT_GET(r0, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x10, 0x3e8, 0x200, 0x70bd25, 0x25dfdbfe, "", [""]}, 0x10}}, 0x8004) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f00000001c0)=0x1) 20:27:07 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) 20:27:07 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x400400, 0x0) ioctl$BINDER_CTL_ADD(r0, 0xc1086201, &(0x7f0000000040)={'custom1\x00'}) (async) ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x1275, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x49a182, 0x0) sendmsg$AUDIT_GET(r0, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x10, 0x3e8, 0x200, 0x70bd25, 0x25dfdbfe, "", [""]}, 0x10}}, 0x8004) (async) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f00000001c0)=0x1) [ 2119.288308][T31030] program syz-executor.5 is using a deprecated SCSI ioctl, please convert it to SG_IO 20:27:07 executing program 5: r0 = getpid() prlimit64(r0, 0x0, 0x0, &(0x7f0000000000)) prlimit64(r0, 0x3, &(0x7f0000000000)={0x7, 0x2}, &(0x7f0000000040)) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x1267, 0x0) 20:27:07 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x44100) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x8, 0x4000) ioctl$SCSI_IOCTL_SYNC(r1, 0x4) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f0000000040)) 20:27:07 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x400400, 0x0) ioctl$BINDER_CTL_ADD(r0, 0xc1086201, &(0x7f0000000040)={'custom1\x00'}) (async) ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x1275, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x49a182, 0x0) sendmsg$AUDIT_GET(r0, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x10, 0x3e8, 0x200, 0x70bd25, 0x25dfdbfe, "", [""]}, 0x10}}, 0x8004) (async, rerun: 32) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f00000001c0)=0x1) (rerun: 32) 20:27:07 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000600000001"], 0x1c}}, 0x0) 20:27:07 executing program 0: ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x227d, &(0x7f0000000000)) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000040)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) ioctl$SCSI_IOCTL_GET_PCI(0xffffffffffffffff, 0x5387, &(0x7f0000000140)) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100), 0x111080, 0x0) write$vga_arbiter(r2, 0x0, 0x0) write$selinux_attr(r2, &(0x7f0000000080)='system_u:object_r:groupadd_exec_t:s0\x00', 0x25) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:27:07 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x13, 0xb, &(0x7f00000002c0)=ANY=[@ANYBLOB="18680000000085200000040000008500000083000000185500000900ffffffffffffffff000000004c000000186900000d00000000000000a90000001875000003000000000000000000000021bf2ad69b89484b0454bdcf85de7a91cc4f0215efda23b174d717d17c020c08948c1a74962f5cb53edc3139f977f03600e92e99c5833c2ea1c74ec6"], &(0x7f00000000c0)='GPL\x00', 0x81, 0x0, 0x0, 0x40f00, 0x12, '\x00', 0x0, 0xf0c13cb3cf283481, 0xffffffffffffffff, 0x8, &(0x7f0000000100)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000140)={0x0, 0x1, 0x2, 0x3}, 0x10}, 0x80) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000200)={r1, r2, 0x4, r3}, 0x10) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r4, 0x0, 0x0) bpf$LINK_DETACH(0x22, &(0x7f0000000240)=r4, 0x4) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) ioctl$SG_GET_RESERVED_SIZE(r2, 0x2272, &(0x7f0000000280)) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000080)) 20:27:07 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000007401"], 0x1c}}, 0x0) 20:27:07 executing program 5: r0 = getpid() prlimit64(r0, 0x0, 0x0, &(0x7f0000000000)) prlimit64(r0, 0x3, &(0x7f0000000000)={0x7, 0x2}, &(0x7f0000000040)) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x1267, 0x0) getpid() (async) prlimit64(r0, 0x0, 0x0, &(0x7f0000000000)) (async) prlimit64(r0, 0x3, &(0x7f0000000000)={0x7, 0x2}, &(0x7f0000000040)) (async) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r1, 0x1267, 0x0) (async) 20:27:07 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000700000001"], 0x1c}}, 0x0) 20:27:07 executing program 0: ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x227d, &(0x7f0000000000)) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000040)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) ioctl$SCSI_IOCTL_GET_PCI(0xffffffffffffffff, 0x5387, &(0x7f0000000140)) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100), 0x111080, 0x0) write$vga_arbiter(r2, 0x0, 0x0) write$selinux_attr(r2, &(0x7f0000000080)='system_u:object_r:groupadd_exec_t:s0\x00', 0x25) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x227d, &(0x7f0000000000)) (async) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000040)) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) (async) ioctl$SCSI_IOCTL_GET_PCI(0xffffffffffffffff, 0x5387, &(0x7f0000000140)) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100), 0x111080, 0x0) (async) write$vga_arbiter(r2, 0x0, 0x0) (async) write$selinux_attr(r2, &(0x7f0000000080)='system_u:object_r:groupadd_exec_t:s0\x00', 0x25) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) 20:27:07 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x13, 0xb, &(0x7f00000002c0)=ANY=[@ANYBLOB="18680000000085200000040000008500000083000000185500000900ffffffffffffffff000000004c000000186900000d00000000000000a90000001875000003000000000000000000000021bf2ad69b89484b0454bdcf85de7a91cc4f0215efda23b174d717d17c020c08948c1a74962f5cb53edc3139f977f03600e92e99c5833c2ea1c74ec6"], &(0x7f00000000c0)='GPL\x00', 0x81, 0x0, 0x0, 0x40f00, 0x12, '\x00', 0x0, 0xf0c13cb3cf283481, 0xffffffffffffffff, 0x8, &(0x7f0000000100)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000140)={0x0, 0x1, 0x2, 0x3}, 0x10}, 0x80) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000200)={r1, r2, 0x4, r3}, 0x10) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r4, 0x0, 0x0) bpf$LINK_DETACH(0x22, &(0x7f0000000240)=r4, 0x4) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) ioctl$SG_GET_RESERVED_SIZE(r2, 0x2272, &(0x7f0000000280)) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000080)) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r2, 0x0, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x13, 0xb, &(0x7f00000002c0)=ANY=[@ANYBLOB="18680000000085200000040000008500000083000000185500000900ffffffffffffffff000000004c000000186900000d00000000000000a90000001875000003000000000000000000000021bf2ad69b89484b0454bdcf85de7a91cc4f0215efda23b174d717d17c020c08948c1a74962f5cb53edc3139f977f03600e92e99c5833c2ea1c74ec6"], &(0x7f00000000c0)='GPL\x00', 0x81, 0x0, 0x0, 0x40f00, 0x12, '\x00', 0x0, 0xf0c13cb3cf283481, 0xffffffffffffffff, 0x8, &(0x7f0000000100)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000140)={0x0, 0x1, 0x2, 0x3}, 0x10}, 0x80) (async) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000200)={r1, r2, 0x4, r3}, 0x10) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r4, 0x0, 0x0) (async) bpf$LINK_DETACH(0x22, &(0x7f0000000240)=r4, 0x4) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) ioctl$SG_GET_RESERVED_SIZE(r2, 0x2272, &(0x7f0000000280)) (async) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000080)) (async) 20:27:07 executing program 2: ioctl$EVIOCGABS0(0xffffffffffffffff, 0x80184540, &(0x7f0000000040)=""/158) r0 = syz_open_dev$sg(&(0x7f0000000000), 0xfffffffffffffffc, 0x121803) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000100)) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) 20:27:07 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (fail_nth: 1) 20:27:07 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000900000001"], 0x1c}}, 0x0) 20:27:07 executing program 5: r0 = getpid() prlimit64(r0, 0x0, 0x0, &(0x7f0000000000)) (async) prlimit64(r0, 0x3, &(0x7f0000000000)={0x7, 0x2}, &(0x7f0000000040)) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x1267, 0x0) 20:27:07 executing program 2: ioctl$EVIOCGABS0(0xffffffffffffffff, 0x80184540, &(0x7f0000000040)=""/158) r0 = syz_open_dev$sg(&(0x7f0000000000), 0xfffffffffffffffc, 0x121803) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000100)) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) ioctl$EVIOCGABS0(0xffffffffffffffff, 0x80184540, &(0x7f0000000040)=""/158) (async) syz_open_dev$sg(&(0x7f0000000000), 0xfffffffffffffffc, 0x121803) (async) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000100)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) 20:27:07 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x13, 0xb, &(0x7f00000002c0)=ANY=[@ANYBLOB="18680000000085200000040000008500000083000000185500000900ffffffffffffffff000000004c000000186900000d00000000000000a90000001875000003000000000000000000000021bf2ad69b89484b0454bdcf85de7a91cc4f0215efda23b174d717d17c020c08948c1a74962f5cb53edc3139f977f03600e92e99c5833c2ea1c74ec6"], &(0x7f00000000c0)='GPL\x00', 0x81, 0x0, 0x0, 0x40f00, 0x12, '\x00', 0x0, 0xf0c13cb3cf283481, 0xffffffffffffffff, 0x8, &(0x7f0000000100)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000140)={0x0, 0x1, 0x2, 0x3}, 0x10}, 0x80) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000200)={r1, r2, 0x4, r3}, 0x10) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r4, 0x0, 0x0) bpf$LINK_DETACH(0x22, &(0x7f0000000240)=r4, 0x4) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) ioctl$SG_GET_RESERVED_SIZE(r2, 0x2272, &(0x7f0000000280)) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000080)) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r2, 0x0, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x13, 0xb, &(0x7f00000002c0)=ANY=[@ANYBLOB="18680000000085200000040000008500000083000000185500000900ffffffffffffffff000000004c000000186900000d00000000000000a90000001875000003000000000000000000000021bf2ad69b89484b0454bdcf85de7a91cc4f0215efda23b174d717d17c020c08948c1a74962f5cb53edc3139f977f03600e92e99c5833c2ea1c74ec6"], &(0x7f00000000c0)='GPL\x00', 0x81, 0x0, 0x0, 0x40f00, 0x12, '\x00', 0x0, 0xf0c13cb3cf283481, 0xffffffffffffffff, 0x8, &(0x7f0000000100)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000140)={0x0, 0x1, 0x2, 0x3}, 0x10}, 0x80) (async) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000200)={r1, r2, 0x4, r3}, 0x10) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r4, 0x0, 0x0) (async) bpf$LINK_DETACH(0x22, &(0x7f0000000240)=r4, 0x4) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) ioctl$SG_GET_RESERVED_SIZE(r2, 0x2272, &(0x7f0000000280)) (async) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000080)) (async) 20:27:07 executing program 5: r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r1, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r2, 0x1, 0x4000, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x36}]}, 0x24}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, r2, 0x800, 0x70bd27, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r3}, @val={0x1b, 0x99, {0x6, 0x49}}}}, [@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x1608}]}, 0x30}, 0x1, 0x0, 0x0, 0x20000880}, 0x40000) syz_open_dev$sg(&(0x7f0000000380), 0x5, 0x250001) syz_genetlink_get_family_id$gtp(&(0x7f0000000180), 0xffffffffffffffff) 20:27:07 executing program 5: r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r1, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r2, 0x1, 0x4000, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x36}]}, 0x24}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, r2, 0x800, 0x70bd27, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r3}, @val={0x1b, 0x99, {0x6, 0x49}}}}, [@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x1608}]}, 0x30}, 0x1, 0x0, 0x0, 0x20000880}, 0x40000) syz_open_dev$sg(&(0x7f0000000380), 0x5, 0x250001) syz_genetlink_get_family_id$gtp(&(0x7f0000000180), 0xffffffffffffffff) bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) sendmsg$NL80211_CMD_RADAR_DETECT(r1, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r2, 0x1, 0x4000, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x36}]}, 0x24}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) (async) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, r2, 0x800, 0x70bd27, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r3}, @val={0x1b, 0x99, {0x6, 0x49}}}}, [@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x1608}]}, 0x30}, 0x1, 0x0, 0x0, 0x20000880}, 0x40000) (async) syz_open_dev$sg(&(0x7f0000000380), 0x5, 0x250001) (async) syz_genetlink_get_family_id$gtp(&(0x7f0000000180), 0xffffffffffffffff) (async) [ 2119.608351][T31107] FAULT_INJECTION: forcing a failure. [ 2119.608351][T31107] name failslab, interval 1, probability 0, space 0, times 0 [ 2119.621039][T31107] CPU: 1 PID: 31107 Comm: syz-executor.3 Not tainted 5.17.0-rc1-syzkaller #0 [ 2119.629815][T31107] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2119.639876][T31107] Call Trace: [ 2119.643230][T31107] [ 2119.646188][T31107] dump_stack_lvl+0xd6/0x122 [ 2119.650809][T31107] dump_stack+0x11/0x1b 20:27:07 executing program 2: ioctl$EVIOCGABS0(0xffffffffffffffff, 0x80184540, &(0x7f0000000040)=""/158) (async) r0 = syz_open_dev$sg(&(0x7f0000000000), 0xfffffffffffffffc, 0x121803) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000100)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) 20:27:07 executing program 2: syz_open_dev$sg(&(0x7f0000000380), 0xffffffffffffffff, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0xa0402, 0x0) write$vga_arbiter(r0, 0x0, 0x0) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f0000000000)) [ 2119.654981][T31107] should_fail+0x23c/0x250 [ 2119.659482][T31107] ? getname_flags+0x84/0x3f0 [ 2119.664233][T31107] __should_failslab+0x81/0x90 [ 2119.669043][T31107] should_failslab+0x5/0x20 [ 2119.673569][T31107] kmem_cache_alloc+0x4f/0x320 [ 2119.678433][T31107] getname_flags+0x84/0x3f0 [ 2119.682992][T31107] getname+0x15/0x20 [ 2119.686897][T31107] do_sys_openat2+0x6d/0x2b0 [ 2119.691535][T31107] __x64_sys_openat+0xef/0x110 [ 2119.696317][T31107] do_syscall_64+0x44/0xd0 [ 2119.700750][T31107] entry_SYSCALL_64_after_hwframe+0x44/0xae 20:27:07 executing program 0: ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x227d, &(0x7f0000000000)) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000040)) (async, rerun: 32) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (rerun: 32) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) (async, rerun: 32) ioctl$SCSI_IOCTL_GET_PCI(0xffffffffffffffff, 0x5387, &(0x7f0000000140)) (rerun: 32) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100), 0x111080, 0x0) write$vga_arbiter(r2, 0x0, 0x0) (async, rerun: 64) write$selinux_attr(r2, &(0x7f0000000080)='system_u:object_r:groupadd_exec_t:s0\x00', 0x25) (rerun: 64) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:27:07 executing program 5: r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r1, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r2, 0x1, 0x4000, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x36}]}, 0x24}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, r2, 0x800, 0x70bd27, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r3}, @val={0x1b, 0x99, {0x6, 0x49}}}}, [@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x1608}]}, 0x30}, 0x1, 0x0, 0x0, 0x20000880}, 0x40000) syz_open_dev$sg(&(0x7f0000000380), 0x5, 0x250001) syz_genetlink_get_family_id$gtp(&(0x7f0000000180), 0xffffffffffffffff) bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) sendmsg$NL80211_CMD_RADAR_DETECT(r1, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r2, 0x1, 0x4000, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x36}]}, 0x24}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) (async) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, r2, 0x800, 0x70bd27, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r3}, @val={0x1b, 0x99, {0x6, 0x49}}}}, [@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x1608}]}, 0x30}, 0x1, 0x0, 0x0, 0x20000880}, 0x40000) (async) syz_open_dev$sg(&(0x7f0000000380), 0x5, 0x250001) (async) syz_genetlink_get_family_id$gtp(&(0x7f0000000180), 0xffffffffffffffff) (async) 20:27:07 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000a00000001"], 0x1c}}, 0x0) [ 2119.706673][T31107] RIP: 0033:0x7f126d891f74 [ 2119.711100][T31107] Code: 84 00 00 00 00 00 44 89 54 24 0c e8 96 f9 ff ff 44 8b 54 24 0c 44 89 e2 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 89 44 24 0c e8 c8 f9 ff ff 8b 44 [ 2119.730827][T31107] RSP: 002b:00007f126ca54ca0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [ 2119.739316][T31107] RAX: ffffffffffffffda RBX: 6666666666666667 RCX: 00007f126d891f74 [ 2119.747301][T31107] RDX: 0000000000000082 RSI: 00007f126ca54d40 RDI: 00000000ffffff9c 20:27:07 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (fail_nth: 2) 20:27:07 executing program 2: syz_open_dev$sg(&(0x7f0000000380), 0xffffffffffffffff, 0x0) (async) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0xa0402, 0x0) write$vga_arbiter(r0, 0x0, 0x0) (async) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f0000000000)) 20:27:07 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000b00000001"], 0x1c}}, 0x0) 20:27:07 executing program 0: ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x1276, 0x0) 20:27:07 executing program 5: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) 20:27:07 executing program 1: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000080), 0x243, 0x50200) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) syz_open_dev$sg(&(0x7f00000000c0), 0x2, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000000)) 20:27:07 executing program 2: syz_open_dev$sg(&(0x7f0000000380), 0xffffffffffffffff, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0xa0402, 0x0) write$vga_arbiter(r0, 0x0, 0x0) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f0000000000)) 20:27:07 executing program 5: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) 20:27:07 executing program 0: ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x1276, 0x0) [ 2119.755284][T31107] RBP: 00007f126ca54d40 R08: 0000000000000000 R09: 0000000000000000 [ 2119.763271][T31107] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000082 [ 2119.771477][T31107] R13: 00007ffe5e3b506f R14: 00007f126ca55300 R15: 0000000000022000 [ 2119.779443][T31107] [ 2119.821718][T31176] FAULT_INJECTION: forcing a failure. [ 2119.821718][T31176] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2119.834857][T31176] CPU: 0 PID: 31176 Comm: syz-executor.3 Not tainted 5.17.0-rc1-syzkaller #0 [ 2119.843935][T31176] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2119.854010][T31176] Call Trace: [ 2119.857368][T31176] [ 2119.860303][T31176] dump_stack_lvl+0xd6/0x122 [ 2119.864914][T31176] dump_stack+0x11/0x1b 20:27:07 executing program 1: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000080), 0x243, 0x50200) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) syz_open_dev$sg(&(0x7f00000000c0), 0x2, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async, rerun: 64) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000000)) (rerun: 64) 20:27:07 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x2000) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) 20:27:07 executing program 0: ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x1276, 0x0) [ 2119.869166][T31176] should_fail+0x23c/0x250 [ 2119.873668][T31176] should_fail_usercopy+0x16/0x20 [ 2119.878711][T31176] strncpy_from_user+0x21/0x250 [ 2119.883648][T31176] getname_flags+0xb8/0x3f0 [ 2119.888221][T31176] ? save_fpregs_to_fpstate+0xf5/0x140 [ 2119.893693][T31176] getname+0x15/0x20 [ 2119.897638][T31176] do_sys_openat2+0x6d/0x2b0 [ 2119.902321][T31176] ? __this_cpu_preempt_check+0x18/0x20 [ 2119.907884][T31176] ? xfd_validate_state+0x4e/0xf0 [ 2119.912937][T31176] __x64_sys_openat+0xef/0x110 [ 2119.917707][T31176] do_syscall_64+0x44/0xd0 [ 2119.922118][T31176] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2119.928009][T31176] RIP: 0033:0x7f126d891f74 [ 2119.932477][T31176] Code: 84 00 00 00 00 00 44 89 54 24 0c e8 96 f9 ff ff 44 8b 54 24 0c 44 89 e2 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 89 44 24 0c e8 c8 f9 ff ff 8b 44 [ 2119.952142][T31176] RSP: 002b:00007f126ca54ca0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [ 2119.960566][T31176] RAX: ffffffffffffffda RBX: 6666666666666667 RCX: 00007f126d891f74 20:27:07 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (fail_nth: 3) 20:27:07 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000c00000001"], 0x1c}}, 0x0) 20:27:07 executing program 1: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) syz_open_dev$sg(&(0x7f0000000080), 0x243, 0x50200) (async) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) syz_open_dev$sg(&(0x7f00000000c0), 0x2, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000000)) 20:27:07 executing program 5: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r0, 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) (async) 20:27:07 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0xb84, 0x8000) r1 = syz_open_dev$sg(&(0x7f0000000080), 0x200, 0x2200) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f0000000040)=0xffffffbf) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f0000000000)) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) ioctl$SG_GET_TIMEOUT(r3, 0x2202, 0x0) ioctl$SCSI_IOCTL_GET_PCI(r2, 0x5387, &(0x7f0000000100)) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f00000000c0)) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) [ 2119.968542][T31176] RDX: 0000000000000082 RSI: 00007f126ca54d40 RDI: 00000000ffffff9c [ 2119.976557][T31176] RBP: 00007f126ca54d40 R08: 0000000000000000 R09: 0000000000000000 [ 2119.984655][T31176] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000082 [ 2119.992625][T31176] R13: 00007ffe5e3b506f R14: 00007f126ca55300 R15: 0000000000022000 [ 2120.000628][T31176] 20:27:07 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x1, 0x301882) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f00000001c0)) syz_open_dev$sg(&(0x7f0000000000), 0x40, 0x4800) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000240)=0x8104) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_TIMEOUT(r1, 0x2202, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) ioctl$SG_GET_REQUEST_TABLE(r3, 0x2286, &(0x7f00000003c0)) 20:27:07 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000d00000001"], 0x1c}}, 0x0) 20:27:07 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0xb84, 0x8000) r1 = syz_open_dev$sg(&(0x7f0000000080), 0x200, 0x2200) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f0000000040)=0xffffffbf) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f0000000000)) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) ioctl$SG_GET_TIMEOUT(r3, 0x2202, 0x0) ioctl$SCSI_IOCTL_GET_PCI(r2, 0x5387, &(0x7f0000000100)) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f00000000c0)) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) syz_open_dev$sg(&(0x7f0000000380), 0xb84, 0x8000) (async) syz_open_dev$sg(&(0x7f0000000080), 0x200, 0x2200) (async) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f0000000040)=0xffffffbf) (async) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f0000000000)) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r2, 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r3, 0x0, 0x0) (async) ioctl$SG_GET_TIMEOUT(r3, 0x2202, 0x0) (async) ioctl$SCSI_IOCTL_GET_PCI(r2, 0x5387, &(0x7f0000000100)) (async) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f00000000c0)) (async) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) (async) [ 2120.030028][T31206] FAULT_INJECTION: forcing a failure. [ 2120.030028][T31206] name failslab, interval 1, probability 0, space 0, times 0 [ 2120.042773][T31206] CPU: 0 PID: 31206 Comm: syz-executor.3 Not tainted 5.17.0-rc1-syzkaller #0 [ 2120.053288][T31206] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2120.063365][T31206] Call Trace: [ 2120.066729][T31206] [ 2120.069672][T31206] dump_stack_lvl+0xd6/0x122 [ 2120.074338][T31206] dump_stack+0x11/0x1b 20:27:08 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x1, 0x301882) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f00000001c0)) syz_open_dev$sg(&(0x7f0000000000), 0x40, 0x4800) (async) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000240)=0x8104) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_GET_TIMEOUT(r1, 0x2202, 0x0) (async) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) ioctl$SG_GET_REQUEST_TABLE(r3, 0x2286, &(0x7f00000003c0)) 20:27:08 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0xb84, 0x8000) r1 = syz_open_dev$sg(&(0x7f0000000080), 0x200, 0x2200) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f0000000040)=0xffffffbf) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f0000000000)) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) ioctl$SG_GET_TIMEOUT(r3, 0x2202, 0x0) ioctl$SCSI_IOCTL_GET_PCI(r2, 0x5387, &(0x7f0000000100)) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f00000000c0)) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) syz_open_dev$sg(&(0x7f0000000380), 0xb84, 0x8000) (async) syz_open_dev$sg(&(0x7f0000000080), 0x200, 0x2200) (async) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f0000000040)=0xffffffbf) (async) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f0000000000)) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r2, 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r3, 0x0, 0x0) (async) ioctl$SG_GET_TIMEOUT(r3, 0x2202, 0x0) (async) ioctl$SCSI_IOCTL_GET_PCI(r2, 0x5387, &(0x7f0000000100)) (async) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f00000000c0)) (async) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) (async) [ 2120.078519][T31206] should_fail+0x23c/0x250 [ 2120.082970][T31206] ? __alloc_file+0x2e/0x1a0 [ 2120.087627][T31206] __should_failslab+0x81/0x90 [ 2120.092434][T31206] should_failslab+0x5/0x20 [ 2120.097016][T31206] kmem_cache_alloc+0x4f/0x320 [ 2120.101821][T31206] __alloc_file+0x2e/0x1a0 [ 2120.106255][T31206] alloc_empty_file+0xcd/0x1c0 [ 2120.111070][T31206] path_openat+0x6a/0x1f30 [ 2120.115585][T31206] ? try_charge_memcg+0x9de/0xa50 [ 2120.120625][T31206] ? unlock_page_memcg+0xc3/0xe0 [ 2120.125571][T31206] ? next_uptodate_page+0x512/0x540 20:27:08 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x2000) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) 20:27:08 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x1, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000080), 0x3, 0x200200) syz_open_dev$sg(&(0x7f00000000c0), 0x9, 0x400000) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000000)={r1}, 0x8) r3 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$PTP_ENABLE_PPS(r3, 0x40043d04, 0x0) ioctl$PTP_EXTTS_REQUEST(r3, 0x40103d02, &(0x7f0000000140)={0xd5, 0xd}) ioctl$SG_GET_NUM_WAITING(r2, 0x227d, &(0x7f0000000100)) [ 2120.130815][T31206] ? __rcu_read_unlock+0x5c/0x290 [ 2120.135865][T31206] ? filemap_map_pages+0x892/0x8d0 [ 2120.140999][T31206] do_filp_open+0x105/0x220 [ 2120.145578][T31206] do_sys_openat2+0xb5/0x2b0 [ 2120.150191][T31206] __x64_sys_openat+0xef/0x110 [ 2120.155036][T31206] do_syscall_64+0x44/0xd0 [ 2120.159477][T31206] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2120.165426][T31206] RIP: 0033:0x7f126d891f74 [ 2120.169928][T31206] Code: 84 00 00 00 00 00 44 89 54 24 0c e8 96 f9 ff ff 44 8b 54 24 0c 44 89 e2 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 89 44 24 0c e8 c8 f9 ff ff 8b 44 [ 2120.189549][T31206] RSP: 002b:00007f126ca54ca0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [ 2120.198456][T31206] RAX: ffffffffffffffda RBX: 6666666666666667 RCX: 00007f126d891f74 [ 2120.206458][T31206] RDX: 0000000000000082 RSI: 00007f126ca54d40 RDI: 00000000ffffff9c [ 2120.214491][T31206] RBP: 00007f126ca54d40 R08: 0000000000000000 R09: 0000000000000000 [ 2120.222448][T31206] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000082 20:27:08 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (fail_nth: 4) 20:27:08 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000260d00000001"], 0x1c}}, 0x0) 20:27:08 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x2000) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x2000) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) 20:27:08 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x9, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x2270, &(0x7f0000000080)) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f0000000000)) ioctl$BINDER_CTL_ADD(r1, 0xc1086201, &(0x7f00000000c0)={'binder1\x00'}) 20:27:08 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x1, 0x301882) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f00000001c0)) syz_open_dev$sg(&(0x7f0000000000), 0x40, 0x4800) (async) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000240)=0x8104) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_GET_TIMEOUT(r1, 0x2202, 0x0) (async) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) (async) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) (async) ioctl$SG_GET_REQUEST_TABLE(r3, 0x2286, &(0x7f00000003c0)) 20:27:08 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x1, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) syz_open_dev$sg(&(0x7f0000000080), 0x3, 0x200200) (async) syz_open_dev$sg(&(0x7f00000000c0), 0x9, 0x400000) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000000)={r1}, 0x8) (async) r3 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$PTP_ENABLE_PPS(r3, 0x40043d04, 0x0) ioctl$PTP_EXTTS_REQUEST(r3, 0x40103d02, &(0x7f0000000140)={0xd5, 0xd}) (async) ioctl$SG_GET_NUM_WAITING(r2, 0x227d, &(0x7f0000000100)) 20:27:08 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x9, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x2270, &(0x7f0000000080)) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f0000000000)) ioctl$BINDER_CTL_ADD(r1, 0xc1086201, &(0x7f00000000c0)={'binder1\x00'}) syz_open_dev$sg(&(0x7f0000000380), 0x9, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x2270, &(0x7f0000000080)) (async) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f0000000000)) (async) ioctl$BINDER_CTL_ADD(r1, 0xc1086201, &(0x7f00000000c0)={'binder1\x00'}) (async) [ 2120.230405][T31206] R13: 00007ffe5e3b506f R14: 00007f126ca55300 R15: 0000000000022000 [ 2120.238408][T31206] [ 2120.261088][T31257] FAULT_INJECTION: forcing a failure. [ 2120.261088][T31257] name failslab, interval 1, probability 0, space 0, times 0 20:27:08 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x442000) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) 20:27:08 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x1, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) syz_open_dev$sg(&(0x7f0000000080), 0x3, 0x200200) syz_open_dev$sg(&(0x7f00000000c0), 0x9, 0x400000) (async) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000000)={r1}, 0x8) r3 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$PTP_ENABLE_PPS(r3, 0x40043d04, 0x0) ioctl$PTP_EXTTS_REQUEST(r3, 0x40103d02, &(0x7f0000000140)={0xd5, 0xd}) (async) ioctl$SG_GET_NUM_WAITING(r2, 0x227d, &(0x7f0000000100)) 20:27:08 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) 20:27:08 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) [ 2120.273746][T31257] CPU: 0 PID: 31257 Comm: syz-executor.3 Not tainted 5.17.0-rc1-syzkaller #0 [ 2120.282588][T31257] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2120.292658][T31257] Call Trace: [ 2120.295952][T31257] [ 2120.298890][T31257] dump_stack_lvl+0xd6/0x122 [ 2120.303508][T31257] dump_stack+0x11/0x1b [ 2120.307683][T31257] should_fail+0x23c/0x250 [ 2120.312116][T31257] ? security_file_alloc+0x30/0x190 [ 2120.317394][T31257] __should_failslab+0x81/0x90 [ 2120.322182][T31257] should_failslab+0x5/0x20 [ 2120.326708][T31257] kmem_cache_alloc+0x4f/0x320 20:27:08 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) [ 2120.331582][T31257] security_file_alloc+0x30/0x190 [ 2120.336628][T31257] __alloc_file+0x83/0x1a0 [ 2120.341141][T31257] alloc_empty_file+0xcd/0x1c0 [ 2120.345924][T31257] path_openat+0x6a/0x1f30 [ 2120.350353][T31257] ? unlock_page_memcg+0xc3/0xe0 [ 2120.355303][T31257] ? next_uptodate_page+0x512/0x540 [ 2120.360616][T31257] ? __rcu_read_unlock+0x5c/0x290 [ 2120.365674][T31257] ? filemap_map_pages+0x892/0x8d0 [ 2120.370799][T31257] do_filp_open+0x105/0x220 [ 2120.375372][T31257] do_sys_openat2+0xb5/0x2b0 [ 2120.379974][T31257] ? __this_cpu_preempt_check+0x18/0x20 [ 2120.385612][T31257] ? xfd_validate_state+0x4e/0xf0 [ 2120.390678][T31257] __x64_sys_openat+0xef/0x110 [ 2120.395453][T31257] do_syscall_64+0x44/0xd0 [ 2120.399910][T31257] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2120.405849][T31257] RIP: 0033:0x7f126d891f74 [ 2120.410415][T31257] Code: 84 00 00 00 00 00 44 89 54 24 0c e8 96 f9 ff ff 44 8b 54 24 0c 44 89 e2 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 89 44 24 0c e8 c8 f9 ff ff 8b 44 20:27:08 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (fail_nth: 5) 20:27:08 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000e00000001"], 0x1c}}, 0x0) 20:27:08 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000080)) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000000)={r0}, 0x8) ioctl$SG_GET_KEEP_ORPHAN(r2, 0x2288, &(0x7f0000000040)) 20:27:08 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x9, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x2270, &(0x7f0000000080)) (async) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f0000000000)) (async) ioctl$BINDER_CTL_ADD(r1, 0xc1086201, &(0x7f00000000c0)={'binder1\x00'}) 20:27:08 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x80000001, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:27:08 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x442000) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) 20:27:08 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x80000001, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:27:08 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000f00000001"], 0x1c}}, 0x0) [ 2120.430011][T31257] RSP: 002b:00007f126ca54ca0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [ 2120.438559][T31257] RAX: ffffffffffffffda RBX: 6666666666666667 RCX: 00007f126d891f74 [ 2120.446516][T31257] RDX: 0000000000000082 RSI: 00007f126ca54d40 RDI: 00000000ffffff9c [ 2120.454470][T31257] RBP: 00007f126ca54d40 R08: 0000000000000000 R09: 0000000000000000 [ 2120.462489][T31257] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000082 [ 2120.470566][T31257] R13: 00007ffe5e3b506f R14: 00007f126ca55300 R15: 0000000000022000 [ 2120.478524][T31257] 20:27:08 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) 20:27:08 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x442000) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x442000) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) 20:27:08 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x80000001, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:27:08 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000080)) (async) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000000)={r0}, 0x8) ioctl$SG_GET_KEEP_ORPHAN(r2, 0x2288, &(0x7f0000000040)) [ 2120.532715][T31308] FAULT_INJECTION: forcing a failure. [ 2120.532715][T31308] name failslab, interval 1, probability 0, space 0, times 0 [ 2120.545385][T31308] CPU: 0 PID: 31308 Comm: syz-executor.3 Not tainted 5.17.0-rc1-syzkaller #0 [ 2120.554162][T31308] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2120.564220][T31308] Call Trace: [ 2120.567501][T31308] [ 2120.570438][T31308] dump_stack_lvl+0xd6/0x122 [ 2120.575112][T31308] dump_stack+0x11/0x1b [ 2120.579252][T31308] should_fail+0x23c/0x250 [ 2120.583657][T31308] ? sg_open+0x6fd/0xe00 [ 2120.587940][T31308] __should_failslab+0x81/0x90 [ 2120.592746][T31308] should_failslab+0x5/0x20 [ 2120.597236][T31308] kmem_cache_alloc_trace+0x52/0x350 [ 2120.602523][T31308] ? scsi_block_when_processing_errors+0x194/0x1d0 [ 2120.609085][T31308] sg_open+0x6fd/0xe00 [ 2120.613156][T31308] chrdev_open+0x362/0x3d0 [ 2120.617628][T31308] ? cd_forget+0xe0/0xe0 [ 2120.621947][T31308] do_dentry_open+0x52c/0x860 [ 2120.626622][T31308] vfs_open+0x43/0x50 [ 2120.630595][T31308] path_openat+0x170c/0x1f30 [ 2120.635199][T31308] ? next_uptodate_page+0x512/0x540 [ 2120.640385][T31308] do_filp_open+0x105/0x220 [ 2120.644884][T31308] do_sys_openat2+0xb5/0x2b0 [ 2120.649589][T31308] __x64_sys_openat+0xef/0x110 [ 2120.654365][T31308] do_syscall_64+0x44/0xd0 [ 2120.658814][T31308] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2120.664695][T31308] RIP: 0033:0x7f126d891f74 [ 2120.669104][T31308] Code: 84 00 00 00 00 00 44 89 54 24 0c e8 96 f9 ff ff 44 8b 54 24 0c 44 89 e2 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 89 44 24 0c e8 c8 f9 ff ff 8b 44 [ 2120.688852][T31308] RSP: 002b:00007f126ca54ca0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [ 2120.697257][T31308] RAX: ffffffffffffffda RBX: 6666666666666667 RCX: 00007f126d891f74 [ 2120.705224][T31308] RDX: 0000000000000082 RSI: 00007f126ca54d40 RDI: 00000000ffffff9c [ 2120.713242][T31308] RBP: 00007f126ca54d40 R08: 0000000000000000 R09: 0000000000000000 [ 2120.721223][T31308] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000082 20:27:08 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (fail_nth: 6) 20:27:08 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000001100000001"], 0x1c}}, 0x0) 20:27:08 executing program 0: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) bpf$LINK_DETACH(0x22, &(0x7f0000000080), 0x4) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r1) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:27:08 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) bpf$ITER_CREATE(0x21, &(0x7f0000000180), 0x8) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000001c0), 0x102201, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x1275, 0x0) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f0000000000)) 20:27:08 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async, rerun: 32) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) (rerun: 32) 20:27:08 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000080)) (async) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000000)={r0}, 0x8) ioctl$SG_GET_KEEP_ORPHAN(r2, 0x2288, &(0x7f0000000040)) [ 2120.729208][T31308] R13: 00007ffe5e3b506f R14: 00007f126ca55300 R15: 0000000000022000 [ 2120.737179][T31308] [ 2120.769719][T31331] FAULT_INJECTION: forcing a failure. [ 2120.769719][T31331] name failslab, interval 1, probability 0, space 0, times 0 20:27:08 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000001200000001"], 0x1c}}, 0x0) 20:27:08 executing program 0: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) bpf$LINK_DETACH(0x22, &(0x7f0000000080), 0x4) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r1) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r0, 0x0, 0x0) (async) bpf$LINK_DETACH(0x22, &(0x7f0000000080), 0x4) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r1) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) 20:27:08 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000180), 0x8) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000001c0), 0x102201, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x1275, 0x0) (async) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f0000000000)) 20:27:08 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000002500000001"], 0x1c}}, 0x0) 20:27:08 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000d2600000001"], 0x1c}}, 0x0) [ 2120.782430][T31331] CPU: 0 PID: 31331 Comm: syz-executor.3 Not tainted 5.17.0-rc1-syzkaller #0 [ 2120.791203][T31331] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2120.801312][T31331] Call Trace: [ 2120.804599][T31331] [ 2120.807531][T31331] dump_stack_lvl+0xd6/0x122 [ 2120.812214][T31331] dump_stack+0x11/0x1b [ 2120.816474][T31331] should_fail+0x23c/0x250 [ 2120.820895][T31331] ? kzalloc+0x1d/0x30 [ 2120.824978][T31331] __should_failslab+0x81/0x90 20:27:08 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) [ 2120.829758][T31331] should_failslab+0x5/0x20 [ 2120.834292][T31331] __kmalloc+0x6f/0x370 [ 2120.838478][T31331] ? rpm_resume+0x6ec/0xee0 [ 2120.843004][T31331] kzalloc+0x1d/0x30 [ 2120.846915][T31331] sg_build_indirect+0x7c/0x4c0 [ 2120.851844][T31331] ? kmem_cache_alloc_trace+0x24b/0x350 [ 2120.857414][T31331] ? sg_open+0x6fd/0xe00 [ 2120.861669][T31331] ? preempt_count_add+0x4e/0x90 [ 2120.866725][T31331] sg_open+0xa03/0xe00 [ 2120.870789][T31331] chrdev_open+0x362/0x3d0 [ 2120.875194][T31331] ? cd_forget+0xe0/0xe0 [ 2120.879423][T31331] do_dentry_open+0x52c/0x860 [ 2120.884128][T31331] vfs_open+0x43/0x50 [ 2120.888094][T31331] path_openat+0x170c/0x1f30 [ 2120.892706][T31331] ? next_uptodate_page+0x512/0x540 [ 2120.897892][T31331] do_filp_open+0x105/0x220 [ 2120.902384][T31331] do_sys_openat2+0xb5/0x2b0 [ 2120.906982][T31331] __x64_sys_openat+0xef/0x110 [ 2120.911813][T31331] do_syscall_64+0x44/0xd0 [ 2120.916222][T31331] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2120.922108][T31331] RIP: 0033:0x7f126d891f74 [ 2120.926672][T31331] Code: 84 00 00 00 00 00 44 89 54 24 0c e8 96 f9 ff ff 44 8b 54 24 0c 44 89 e2 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 89 44 24 0c e8 c8 f9 ff ff 8b 44 [ 2120.946382][T31331] RSP: 002b:00007f126ca54ca0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [ 2120.954783][T31331] RAX: ffffffffffffffda RBX: 6666666666666667 RCX: 00007f126d891f74 [ 2120.962778][T31331] RDX: 0000000000000082 RSI: 00007f126ca54d40 RDI: 00000000ffffff9c [ 2120.970803][T31331] RBP: 00007f126ca54d40 R08: 0000000000000000 R09: 0000000000000000 20:27:08 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (fail_nth: 7) 20:27:08 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000004800000001"], 0x1c}}, 0x0) 20:27:08 executing program 0: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) bpf$LINK_DETACH(0x22, &(0x7f0000000080), 0x4) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r1) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r0, 0x0, 0x0) (async) bpf$LINK_DETACH(0x22, &(0x7f0000000080), 0x4) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r1) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) 20:27:08 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async, rerun: 32) bpf$ITER_CREATE(0x21, &(0x7f0000000180), 0x8) (async, rerun: 32) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000001c0), 0x102201, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x1275, 0x0) (async, rerun: 64) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f0000000000)) (rerun: 64) 20:27:08 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x1ff, 0x432040) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:27:08 executing program 5: r0 = getpid() prlimit64(r0, 0x4, &(0x7f0000000000)={0x80000000, 0x18a000000000000}, &(0x7f0000000080)) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x1267, 0x0) [ 2120.978783][T31331] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000082 [ 2120.986753][T31331] R13: 00007ffe5e3b506f R14: 00007f126ca55300 R15: 0000000000022000 [ 2120.994752][T31331] 20:27:08 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000040)) 20:27:08 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000004c00000001"], 0x1c}}, 0x0) 20:27:08 executing program 2: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0xa8001, 0x0) ioctl$PTP_EXTTS_REQUEST(r0, 0x40103d02, &(0x7f0000000040)={0x80000001, 0x8}) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x1275, 0x0) 20:27:08 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x1ff, 0x432040) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:27:09 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000006000000001"], 0x1c}}, 0x0) 20:27:09 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000006800000001"], 0x1c}}, 0x0) [ 2121.053559][T31380] FAULT_INJECTION: forcing a failure. [ 2121.053559][T31380] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 2121.066852][T31380] CPU: 1 PID: 31380 Comm: syz-executor.3 Not tainted 5.17.0-rc1-syzkaller #0 [ 2121.075724][T31380] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2121.085794][T31380] Call Trace: [ 2121.089078][T31380] [ 2121.092025][T31380] dump_stack_lvl+0xd6/0x122 [ 2121.096629][T31380] dump_stack+0x11/0x1b [ 2121.100802][T31380] should_fail+0x23c/0x250 [ 2121.105232][T31380] __alloc_pages+0x102/0x330 [ 2121.109875][T31380] alloc_pages+0x316/0x420 [ 2121.114319][T31380] sg_build_indirect+0x1bd/0x4c0 [ 2121.119447][T31380] sg_open+0xa03/0xe00 [ 2121.123552][T31380] ? init_wait_entry+0x30/0x30 [ 2121.128323][T31380] chrdev_open+0x362/0x3d0 [ 2121.132819][T31380] ? cd_forget+0xe0/0xe0 [ 2121.137099][T31380] do_dentry_open+0x52c/0x860 [ 2121.141810][T31380] vfs_open+0x43/0x50 [ 2121.145876][T31380] path_openat+0x170c/0x1f30 [ 2121.150456][T31380] ? next_uptodate_page+0x512/0x540 [ 2121.155680][T31380] do_filp_open+0x105/0x220 [ 2121.160226][T31380] do_sys_openat2+0xb5/0x2b0 [ 2121.164840][T31380] __x64_sys_openat+0xef/0x110 [ 2121.169618][T31380] do_syscall_64+0x44/0xd0 [ 2121.174052][T31380] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2121.179948][T31380] RIP: 0033:0x7f126d891f74 [ 2121.184354][T31380] Code: 84 00 00 00 00 00 44 89 54 24 0c e8 96 f9 ff ff 44 8b 54 24 0c 44 89 e2 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 89 44 24 0c e8 c8 f9 ff ff 8b 44 [ 2121.203966][T31380] RSP: 002b:00007f126ca54ca0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [ 2121.212370][T31380] RAX: ffffffffffffffda RBX: 6666666666666667 RCX: 00007f126d891f74 [ 2121.220351][T31380] RDX: 0000000000000082 RSI: 00007f126ca54d40 RDI: 00000000ffffff9c [ 2121.228324][T31380] RBP: 00007f126ca54d40 R08: 0000000000000000 R09: 0000000000000000 [ 2121.236310][T31380] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000082 [ 2121.244266][T31380] R13: 00007ffe5e3b506f R14: 00007f126ca55300 R15: 0000000000022000 20:27:09 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (fail_nth: 8) 20:27:09 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x1ff, 0x432040) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x1ff, 0x432040) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) 20:27:09 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000006c00000001"], 0x1c}}, 0x0) 20:27:09 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000040)) 20:27:09 executing program 2: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0xa8001, 0x0) ioctl$PTP_EXTTS_REQUEST(r0, 0x40103d02, &(0x7f0000000040)={0x80000001, 0x8}) (async) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x1275, 0x0) 20:27:09 executing program 5: r0 = getpid() prlimit64(r0, 0x4, &(0x7f0000000000)={0x80000000, 0x18a000000000000}, &(0x7f0000000080)) (async) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x1267, 0x0) 20:27:09 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000000)) [ 2121.252229][T31380] 20:27:09 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000040)) 20:27:09 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000000)) 20:27:09 executing program 5: r0 = getpid() prlimit64(r0, 0x4, &(0x7f0000000000)={0x80000000, 0x18a000000000000}, &(0x7f0000000080)) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x1267, 0x0) 20:27:09 executing program 2: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0xa8001, 0x0) ioctl$PTP_EXTTS_REQUEST(r0, 0x40103d02, &(0x7f0000000040)={0x80000001, 0x8}) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x1275, 0x0) 20:27:09 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000007400000001"], 0x1c}}, 0x0) [ 2121.312388][T31415] FAULT_INJECTION: forcing a failure. [ 2121.312388][T31415] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2121.325553][T31415] CPU: 1 PID: 31415 Comm: syz-executor.3 Not tainted 5.17.0-rc1-syzkaller #0 [ 2121.334357][T31415] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2121.344444][T31415] Call Trace: [ 2121.347727][T31415] [ 2121.350663][T31415] dump_stack_lvl+0xd6/0x122 [ 2121.355309][T31415] dump_stack+0x11/0x1b [ 2121.359462][T31415] should_fail+0x23c/0x250 [ 2121.363884][T31415] should_fail_usercopy+0x16/0x20 [ 2121.368943][T31415] _copy_to_user+0x1c/0x90 [ 2121.373383][T31415] simple_read_from_buffer+0xab/0x120 [ 2121.378743][T31415] proc_fail_nth_read+0x10d/0x150 [ 2121.383886][T31415] ? proc_fault_inject_write+0x230/0x230 [ 2121.389511][T31415] vfs_read+0x1e6/0x750 [ 2121.393775][T31415] ? __fget_files+0x1d2/0x210 [ 2121.398478][T31415] ksys_read+0xd9/0x190 [ 2121.402638][T31415] __x64_sys_read+0x3e/0x50 [ 2121.407172][T31415] do_syscall_64+0x44/0xd0 [ 2121.411598][T31415] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2121.417506][T31415] RIP: 0033:0x7f126d891c0c [ 2121.421908][T31415] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 [ 2121.441556][T31415] RSP: 002b:00007f126ca55160 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2121.449967][T31415] RAX: ffffffffffffffda RBX: 00007f126d9f1f60 RCX: 00007f126d891c0c 20:27:09 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) 20:27:09 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000007a00000001"], 0x1c}}, 0x0) 20:27:09 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x2, 0x82) 20:27:09 executing program 2: sendmsg$AUDIT_GET_FEATURE(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x3fb, 0x10, 0x70bd27, 0x25dfdbfd, "", ["", ""]}, 0x10}}, 0x20) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) [ 2121.458057][T31415] RDX: 000000000000000f RSI: 00007f126ca551e0 RDI: 0000000000000003 [ 2121.466050][T31415] RBP: 00007f126ca551d0 R08: 0000000000000000 R09: 0000000000000000 [ 2121.474049][T31415] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2121.482113][T31415] R13: 00007ffe5e3b506f R14: 00007f126ca55300 R15: 0000000000022000 [ 2121.490150][T31415] 20:27:09 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f0000000140)={'wg0\x00'}) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(0xffffffffffffffff, 0x0, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) ioctl$SCSI_IOCTL_SEND_COMMAND(r3, 0x1, &(0x7f0000000280)=ANY=[@ANYBLOB="a7000000010000000400000087715ae947ec009e13bae661c2bfb69c12245ea8f90a942119d64cd15b7b6c7f714cf1725c0c778664df33038e8d0a77c1b26ff6936d8fe66ad7be372789e27d8d6d0fedee07912b0534ac24246ea6acf9fdb3f71439a2b813b2bedc71ed9916a7db28d3726b835c9d5a6ef294e9e7bcd51c812ef17e4a2e6cca62997892f137b1184ea85a70a1212da3961781a206513597de53aad2e74b25aa2decdb8dd635261b0261be058c0770cc8219440570e3e6", @ANYRESDEC=0x0, @ANYRES64=r1]) write$vga_arbiter(0xffffffffffffffff, 0x0, 0x0) ioctl$SG_EMULATED_HOST(r2, 0x2203, &(0x7f0000000000)) 20:27:09 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000000)) 20:27:09 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) r3 = bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000), r3) 20:27:09 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x3, 0x82) 20:27:09 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000003000001"], 0x1c}}, 0x0) 20:27:09 executing program 2: sendmsg$AUDIT_GET_FEATURE(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x3fb, 0x10, 0x70bd27, 0x25dfdbfd, "", ["", ""]}, 0x10}}, 0x20) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) (async, rerun: 64) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (rerun: 64) 20:27:09 executing program 1: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x684802, 0x0) write$vga_arbiter(r1, 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r2, 0x2) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x404100) 20:27:09 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) r3 = bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000), r3) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r2, 0x0, 0x0) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) (async) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000), r3) (async) 20:27:09 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x4, 0x82) 20:27:09 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000004003000001"], 0x1c}}, 0x0) 20:27:09 executing program 2: sendmsg$AUDIT_GET_FEATURE(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x3fb, 0x10, 0x70bd27, 0x25dfdbfd, "", ["", ""]}, 0x10}}, 0x20) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) 20:27:09 executing program 1: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x684802, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r2, 0x2) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x404100) 20:27:09 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f0000000140)={'wg0\x00'}) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(0xffffffffffffffff, 0x0, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) ioctl$SCSI_IOCTL_SEND_COMMAND(r3, 0x1, &(0x7f0000000280)=ANY=[@ANYBLOB="a7000000010000000400000087715ae947ec009e13bae661c2bfb69c12245ea8f90a942119d64cd15b7b6c7f714cf1725c0c778664df33038e8d0a77c1b26ff6936d8fe66ad7be372789e27d8d6d0fedee07912b0534ac24246ea6acf9fdb3f71439a2b813b2bedc71ed9916a7db28d3726b835c9d5a6ef294e9e7bcd51c812ef17e4a2e6cca62997892f137b1184ea85a70a1212da3961781a206513597de53aad2e74b25aa2decdb8dd635261b0261be058c0770cc8219440570e3e6", @ANYRESDEC=0x0, @ANYRES64=r1]) write$vga_arbiter(0xffffffffffffffff, 0x0, 0x0) ioctl$SG_EMULATED_HOST(r2, 0x2203, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) socket$inet6_sctp(0xa, 0x5, 0x84) (async) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f0000000140)={'wg0\x00'}) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(0xffffffffffffffff, 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r3, 0x0, 0x0) (async) socket$inet6_sctp(0xa, 0x5, 0x84) (async) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) (async) ioctl$SCSI_IOCTL_SEND_COMMAND(r3, 0x1, &(0x7f0000000280)=ANY=[@ANYBLOB="a7000000010000000400000087715ae947ec009e13bae661c2bfb69c12245ea8f90a942119d64cd15b7b6c7f714cf1725c0c778664df33038e8d0a77c1b26ff6936d8fe66ad7be372789e27d8d6d0fedee07912b0534ac24246ea6acf9fdb3f71439a2b813b2bedc71ed9916a7db28d3726b835c9d5a6ef294e9e7bcd51c812ef17e4a2e6cca62997892f137b1184ea85a70a1212da3961781a206513597de53aad2e74b25aa2decdb8dd635261b0261be058c0770cc8219440570e3e6", @ANYRESDEC=0x0, @ANYRES64=r1]) (async) write$vga_arbiter(0xffffffffffffffff, 0x0, 0x0) (async) ioctl$SG_EMULATED_HOST(r2, 0x2203, &(0x7f0000000000)) (async) 20:27:09 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x6, 0x82) 20:27:09 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) r3 = bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000), r3) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r2, 0x0, 0x0) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) (async) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000), r3) (async) 20:27:09 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000340000001"], 0x1c}}, 0x0) 20:27:09 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) ioctl$EVIOCSFF(r0, 0x40304580, &(0x7f0000000000)={0x55, 0x80, 0x3, {0x6, 0x1}, {0x1, 0x5}, @rumble={0xff, 0xfff7}}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$EVIOCGEFFECTS(r1, 0x80044584, &(0x7f0000000080)=""/246) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r2, 0x227d, &(0x7f0000000040)) 20:27:09 executing program 1: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x684802, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r2, 0x2) (async) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x404100) 20:27:09 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x18, 0x82) 20:27:09 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000010001"], 0x1c}}, 0x0) 20:27:09 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.net/syz1\x00', 0x200002, 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={0xffffffffffffffff, r1}, 0x10) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) syz_genetlink_get_family_id$wireguard(&(0x7f0000000000), r2) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:27:09 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x8c0, 0x0) ioctl$EVIOCSABS3F(r1, 0x401845ff, &(0x7f0000000040)={0x1, 0x9, 0x7802, 0x10000, 0xfffffffb, 0x8}) 20:27:09 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) ioctl$EVIOCSFF(r0, 0x40304580, &(0x7f0000000000)={0x55, 0x80, 0x3, {0x6, 0x1}, {0x1, 0x5}, @rumble={0xff, 0xfff7}}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$EVIOCGEFFECTS(r1, 0x80044584, &(0x7f0000000080)=""/246) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r2, 0x227d, &(0x7f0000000040)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r0, 0x0, 0x0) (async) ioctl$EVIOCSFF(r0, 0x40304580, &(0x7f0000000000)={0x55, 0x80, 0x3, {0x6, 0x1}, {0x1, 0x5}, @rumble={0xff, 0xfff7}}) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$EVIOCGEFFECTS(r1, 0x80044584, &(0x7f0000000080)=""/246) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r2, 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r2, 0x227d, &(0x7f0000000040)) (async) 20:27:09 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.net/syz1\x00', 0x200002, 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={0xffffffffffffffff, r1}, 0x10) (async) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) (async) syz_genetlink_get_family_id$wireguard(&(0x7f0000000000), r2) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:27:09 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f0000000140)={'wg0\x00'}) (async, rerun: 32) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async, rerun: 32) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) (async) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async, rerun: 32) write$vga_arbiter(0xffffffffffffffff, 0x0, 0x0) (async, rerun: 32) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) (async) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) (async) ioctl$SCSI_IOCTL_SEND_COMMAND(r3, 0x1, &(0x7f0000000280)=ANY=[@ANYBLOB="a7000000010000000400000087715ae947ec009e13bae661c2bfb69c12245ea8f90a942119d64cd15b7b6c7f714cf1725c0c778664df33038e8d0a77c1b26ff6936d8fe66ad7be372789e27d8d6d0fedee07912b0534ac24246ea6acf9fdb3f71439a2b813b2bedc71ed9916a7db28d3726b835c9d5a6ef294e9e7bcd51c812ef17e4a2e6cca62997892f137b1184ea85a70a1212da3961781a206513597de53aad2e74b25aa2decdb8dd635261b0261be058c0770cc8219440570e3e6", @ANYRESDEC=0x0, @ANYRES64=r1]) write$vga_arbiter(0xffffffffffffffff, 0x0, 0x0) (async) ioctl$SG_EMULATED_HOST(r2, 0x2203, &(0x7f0000000000)) 20:27:09 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x300, 0x82) 20:27:09 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x8c0, 0x0) ioctl$EVIOCSABS3F(r1, 0x401845ff, &(0x7f0000000040)={0x1, 0x9, 0x7802, 0x10000, 0xfffffffb, 0x8}) 20:27:09 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) ioctl$EVIOCSFF(r0, 0x40304580, &(0x7f0000000000)={0x55, 0x80, 0x3, {0x6, 0x1}, {0x1, 0x5}, @rumble={0xff, 0xfff7}}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$EVIOCGEFFECTS(r1, 0x80044584, &(0x7f0000000080)=""/246) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r2, 0x227d, &(0x7f0000000040)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r0, 0x0, 0x0) (async) ioctl$EVIOCSFF(r0, 0x40304580, &(0x7f0000000000)={0x55, 0x80, 0x3, {0x6, 0x1}, {0x1, 0x5}, @rumble={0xff, 0xfff7}}) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$EVIOCGEFFECTS(r1, 0x80044584, &(0x7f0000000080)=""/246) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r2, 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r2, 0x227d, &(0x7f0000000040)) (async) 20:27:09 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000020001"], 0x1c}}, 0x0) 20:27:09 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.net/syz1\x00', 0x200002, 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={0xffffffffffffffff, r1}, 0x10) (async) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) (async) syz_genetlink_get_family_id$wireguard(&(0x7f0000000000), r2) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:27:09 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x8c0, 0x0) ioctl$EVIOCSABS3F(r1, 0x401845ff, &(0x7f0000000040)={0x1, 0x9, 0x7802, 0x10000, 0xfffffffb, 0x8}) 20:27:09 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000030001"], 0x1c}}, 0x0) 20:27:09 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x600, 0x82) 20:27:09 executing program 0: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) 20:27:09 executing program 2: syz_open_dev$sg(&(0x7f0000000380), 0xffffffbffffffffd, 0x200001) ioctl$EVIOCSKEYCODE_V2(0xffffffffffffffff, 0x40284504, &(0x7f0000000000)={0x1, 0x2, 0x8, 0x1f1, "481ffbb6b181a6f340916472495eb613fc15a70616ff44d6dda861947815c04c"}) 20:27:09 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x1800, 0x82) 20:27:09 executing program 5: r0 = syz_open_dev$sg(&(0x7f00000000c0), 0x64, 0x802) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x8, 0x80) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$EVIOCSABS3F(r2, 0x401845ff, &(0x7f0000000300)={0x1, 0x3, 0x3, 0x6d746848, 0x101, 0x5}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_PMKSA(r3, &(0x7f0000000500)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000400)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000228bd7000fddbdf25340060de672ded07f7a9884a00000c00990006000000720000000600fd000708000000001f01ff06010014005500eab2a6932899249e376b39641e16b26605002001270000000600fd0000ed400008001f01000800000900340044377f8606000400"], 0x68}, 0x1, 0x0, 0x0, 0x24004004}, 0x20000800) write$vga_arbiter(r2, 0x0, 0x0) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r4, 0x0, 0x0) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(r4, 0x40046210, &(0x7f00000003c0)=0x1) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r5, 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r5, 0x2270, &(0x7f0000000340)) ioctl$SG_GET_REQUEST_TABLE(r2, 0x2286, &(0x7f0000000100)) ioctl$SG_SET_DEBUG(r2, 0x227e, &(0x7f0000000040)=0x1) syz_open_dev$sg(&(0x7f0000000380), 0x1, 0x0) r6 = bpf$ITER_CREATE(0x21, &(0x7f0000000280)={r2}, 0x8) ioctl$SG_GET_KEEP_ORPHAN(r6, 0x2288, &(0x7f00000002c0)) ioctl$SG_GET_KEEP_ORPHAN(r1, 0x2288, &(0x7f0000000080)) 20:27:09 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000040001"], 0x1c}}, 0x0) 20:27:09 executing program 2: syz_open_dev$sg(&(0x7f0000000380), 0xffffffbffffffffd, 0x200001) (async) ioctl$EVIOCSKEYCODE_V2(0xffffffffffffffff, 0x40284504, &(0x7f0000000000)={0x1, 0x2, 0x8, 0x1f1, "481ffbb6b181a6f340916472495eb613fc15a70616ff44d6dda861947815c04c"}) 20:27:09 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x2000, 0x82) 20:27:09 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x3f00, 0x82) 20:27:09 executing program 1: r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x8040) ioctl$SG_GET_COMMAND_Q(r1, 0x1274, 0x0) 20:27:09 executing program 0: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) 20:27:09 executing program 5: r0 = syz_open_dev$sg(&(0x7f00000000c0), 0x64, 0x802) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) (async) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x8, 0x80) (async, rerun: 32) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (rerun: 32) ioctl$EVIOCSABS3F(r2, 0x401845ff, &(0x7f0000000300)={0x1, 0x3, 0x3, 0x6d746848, 0x101, 0x5}) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_PMKSA(r3, &(0x7f0000000500)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000400)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000228bd7000fddbdf25340060de672ded07f7a9884a00000c00990006000000720000000600fd000708000000001f01ff06010014005500eab2a6932899249e376b39641e16b26605002001270000000600fd0000ed400008001f01000800000900340044377f8606000400"], 0x68}, 0x1, 0x0, 0x0, 0x24004004}, 0x20000800) write$vga_arbiter(r2, 0x0, 0x0) (async) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r4, 0x0, 0x0) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(r4, 0x40046210, &(0x7f00000003c0)=0x1) (async) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r5, 0x0, 0x0) (async, rerun: 32) ioctl$SG_GET_COMMAND_Q(r5, 0x2270, &(0x7f0000000340)) (async, rerun: 32) ioctl$SG_GET_REQUEST_TABLE(r2, 0x2286, &(0x7f0000000100)) (async) ioctl$SG_SET_DEBUG(r2, 0x227e, &(0x7f0000000040)=0x1) (async) syz_open_dev$sg(&(0x7f0000000380), 0x1, 0x0) (async, rerun: 32) r6 = bpf$ITER_CREATE(0x21, &(0x7f0000000280)={r2}, 0x8) (rerun: 32) ioctl$SG_GET_KEEP_ORPHAN(r6, 0x2288, &(0x7f00000002c0)) (async) ioctl$SG_GET_KEEP_ORPHAN(r1, 0x2288, &(0x7f0000000080)) 20:27:09 executing program 1: r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x8040) ioctl$SG_GET_COMMAND_Q(r1, 0x1274, 0x0) bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) (async) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) (async) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x8040) (async) ioctl$SG_GET_COMMAND_Q(r1, 0x1274, 0x0) (async) 20:27:09 executing program 0: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) 20:27:09 executing program 2: syz_open_dev$sg(&(0x7f0000000380), 0xffffffbffffffffd, 0x200001) (async) ioctl$EVIOCSKEYCODE_V2(0xffffffffffffffff, 0x40284504, &(0x7f0000000000)={0x1, 0x2, 0x8, 0x1f1, "481ffbb6b181a6f340916472495eb613fc15a70616ff44d6dda861947815c04c"}) 20:27:09 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000050001"], 0x1c}}, 0x0) [ 2121.841980][T31588] __nla_validate_parse: 45 callbacks suppressed [ 2121.842067][T31588] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:09 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x4000, 0x82) 20:27:09 executing program 1: r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) (async) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x8040) ioctl$SG_GET_COMMAND_Q(r1, 0x1274, 0x0) 20:27:09 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x8, 0x80380) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) 20:27:09 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x200000, 0x82) 20:27:09 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) write$evdev(0xffffffffffffffff, &(0x7f0000000000)=[{{}, 0x12, 0x7, 0x1f}, {{0x77359400}, 0x15, 0x3f, 0x400}, {{0x0, 0x2710}, 0x12, 0x0, 0xff}, {{}, 0x0, 0x1000, 0x6}, {{0x77359400}, 0x11, 0x0, 0xe0000000}, {{0x0, 0xea60}, 0x14, 0x1ff, 0x5}], 0x90) 20:27:09 executing program 5: r0 = syz_open_dev$sg(&(0x7f00000000c0), 0x64, 0x802) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x8, 0x80) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$EVIOCSABS3F(r2, 0x401845ff, &(0x7f0000000300)={0x1, 0x3, 0x3, 0x6d746848, 0x101, 0x5}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_PMKSA(r3, &(0x7f0000000500)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000400)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000228bd7000fddbdf25340060de672ded07f7a9884a00000c00990006000000720000000600fd000708000000001f01ff06010014005500eab2a6932899249e376b39641e16b26605002001270000000600fd0000ed400008001f01000800000900340044377f8606000400"], 0x68}, 0x1, 0x0, 0x0, 0x24004004}, 0x20000800) write$vga_arbiter(r2, 0x0, 0x0) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r4, 0x0, 0x0) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(r4, 0x40046210, &(0x7f00000003c0)=0x1) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r5, 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r5, 0x2270, &(0x7f0000000340)) ioctl$SG_GET_REQUEST_TABLE(r2, 0x2286, &(0x7f0000000100)) ioctl$SG_SET_DEBUG(r2, 0x227e, &(0x7f0000000040)=0x1) syz_open_dev$sg(&(0x7f0000000380), 0x1, 0x0) r6 = bpf$ITER_CREATE(0x21, &(0x7f0000000280)={r2}, 0x8) ioctl$SG_GET_KEEP_ORPHAN(r6, 0x2288, &(0x7f00000002c0)) ioctl$SG_GET_KEEP_ORPHAN(r1, 0x2288, &(0x7f0000000080)) syz_open_dev$sg(&(0x7f00000000c0), 0x64, 0x802) (async) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) (async) syz_open_dev$sg(&(0x7f0000000000), 0x8, 0x80) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$EVIOCSABS3F(r2, 0x401845ff, &(0x7f0000000300)={0x1, 0x3, 0x3, 0x6d746848, 0x101, 0x5}) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NL80211_CMD_SET_PMKSA(r3, &(0x7f0000000500)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000400)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000228bd7000fddbdf25340060de672ded07f7a9884a00000c00990006000000720000000600fd000708000000001f01ff06010014005500eab2a6932899249e376b39641e16b26605002001270000000600fd0000ed400008001f01000800000900340044377f8606000400"], 0x68}, 0x1, 0x0, 0x0, 0x24004004}, 0x20000800) (async) write$vga_arbiter(r2, 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r4, 0x0, 0x0) (async) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(r4, 0x40046210, &(0x7f00000003c0)=0x1) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r5, 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r5, 0x2270, &(0x7f0000000340)) (async) ioctl$SG_GET_REQUEST_TABLE(r2, 0x2286, &(0x7f0000000100)) (async) ioctl$SG_SET_DEBUG(r2, 0x227e, &(0x7f0000000040)=0x1) (async) syz_open_dev$sg(&(0x7f0000000380), 0x1, 0x0) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000280)={r2}, 0x8) (async) ioctl$SG_GET_KEEP_ORPHAN(r6, 0x2288, &(0x7f00000002c0)) (async) ioctl$SG_GET_KEEP_ORPHAN(r1, 0x2288, &(0x7f0000000080)) (async) 20:27:09 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x8, 0x80380) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) 20:27:09 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000060001"], 0x1c}}, 0x0) 20:27:09 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000580), 0x6, 0x40000) ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f00000005c0)=0xcc) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x329000, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000340)={0xb4, 0x0, &(0x7f00000003c0)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x71, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000100)={@fd={0x66642a85, 0x0, r2}, @fda={0x66646185, 0x4, 0x2, 0x3f}, @ptr={0x70742a85, 0x1, &(0x7f0000000040)=""/151, 0x97, 0x2, 0x15}}, &(0x7f0000000180)={0x0, 0x18, 0x38}}}, @acquire_done={0x40106309, 0x1}, @request_death={0x400c630e, 0x2}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000280)={@fda={0x66646185, 0x3, 0x1, 0x16}, @flat=@binder={0x73622a85, 0x1000, 0x3}, @ptr={0x70742a85, 0x0, &(0x7f00000001c0)=""/164, 0xa4, 0x0, 0x36}}, &(0x7f0000000300)={0x0, 0x20, 0x38}}, 0x400}], 0xe0, 0x0, &(0x7f0000000480)="d2038edfd42959b6dd47b570ab00671d7eb0711f2a828a489a9bfab1bfec5b177dff5af2ccc1eb04f16140d9b6c06fd59a2464d0508382f446d77369814fcc99d3947b2d46340bc932f6344ae0e12db3871fa26cbf03a47ea43dd747ad12281b9a6640b4a2931c69587ad35362c9b9b1eb0a80732edc6374cd3cf7d6f64be41cf2fb6ec91391eac626315be7eb9a703921be66272d5f9c0eb1a7e899a1386c457ff36547846454ab348efb3e2d81dd0a1cfebf0aa6520edb96aa8c470083a7b89958e554608021d2683e44703f35f9cf1848a8b63ad00ab5f35fc891ef34f01d"}) [ 2121.914658][T31612] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:09 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x1000000, 0x82) 20:27:09 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x8, 0x80380) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) syz_open_dev$sg(&(0x7f0000000000), 0x8, 0x80380) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) (async) 20:27:09 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) write$evdev(0xffffffffffffffff, &(0x7f0000000000)=[{{}, 0x12, 0x7, 0x1f}, {{0x77359400}, 0x15, 0x3f, 0x400}, {{0x0, 0x2710}, 0x12, 0x0, 0xff}, {{}, 0x0, 0x1000, 0x6}, {{0x77359400}, 0x11, 0x0, 0xe0000000}, {{0x0, 0xea60}, 0x14, 0x1ff, 0x5}], 0x90) 20:27:09 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000580), 0x6, 0x40000) ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f00000005c0)=0xcc) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x329000, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000340)={0xb4, 0x0, &(0x7f00000003c0)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x71, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000100)={@fd={0x66642a85, 0x0, r2}, @fda={0x66646185, 0x4, 0x2, 0x3f}, @ptr={0x70742a85, 0x1, &(0x7f0000000040)=""/151, 0x97, 0x2, 0x15}}, &(0x7f0000000180)={0x0, 0x18, 0x38}}}, @acquire_done={0x40106309, 0x1}, @request_death={0x400c630e, 0x2}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000280)={@fda={0x66646185, 0x3, 0x1, 0x16}, @flat=@binder={0x73622a85, 0x1000, 0x3}, @ptr={0x70742a85, 0x0, &(0x7f00000001c0)=""/164, 0xa4, 0x0, 0x36}}, &(0x7f0000000300)={0x0, 0x20, 0x38}}, 0x400}], 0xe0, 0x0, &(0x7f0000000480)="d2038edfd42959b6dd47b570ab00671d7eb0711f2a828a489a9bfab1bfec5b177dff5af2ccc1eb04f16140d9b6c06fd59a2464d0508382f446d77369814fcc99d3947b2d46340bc932f6344ae0e12db3871fa26cbf03a47ea43dd747ad12281b9a6640b4a2931c69587ad35362c9b9b1eb0a80732edc6374cd3cf7d6f64be41cf2fb6ec91391eac626315be7eb9a703921be66272d5f9c0eb1a7e899a1386c457ff36547846454ab348efb3e2d81dd0a1cfebf0aa6520edb96aa8c470083a7b89958e554608021d2683e44703f35f9cf1848a8b63ad00ab5f35fc891ef34f01d"}) 20:27:09 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) ioctl$SCSI_IOCTL_GET_PCI(0xffffffffffffffff, 0x5387, &(0x7f0000000000)) 20:27:09 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x64e, 0x311004) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) 20:27:09 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x2000000, 0x82) 20:27:09 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) write$evdev(0xffffffffffffffff, &(0x7f0000000000)=[{{}, 0x12, 0x7, 0x1f}, {{0x77359400}, 0x15, 0x3f, 0x400}, {{0x0, 0x2710}, 0x12, 0x0, 0xff}, {{}, 0x0, 0x1000, 0x6}, {{0x77359400}, 0x11, 0x0, 0xe0000000}, {{0x0, 0xea60}, 0x14, 0x1ff, 0x5}], 0x90) 20:27:09 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) ioctl$SCSI_IOCTL_GET_PCI(0xffffffffffffffff, 0x5387, &(0x7f0000000000)) 20:27:09 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000580), 0x6, 0x40000) ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f00000005c0)=0xcc) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x329000, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000340)={0xb4, 0x0, &(0x7f00000003c0)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x71, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000100)={@fd={0x66642a85, 0x0, r2}, @fda={0x66646185, 0x4, 0x2, 0x3f}, @ptr={0x70742a85, 0x1, &(0x7f0000000040)=""/151, 0x97, 0x2, 0x15}}, &(0x7f0000000180)={0x0, 0x18, 0x38}}}, @acquire_done={0x40106309, 0x1}, @request_death={0x400c630e, 0x2}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000280)={@fda={0x66646185, 0x3, 0x1, 0x16}, @flat=@binder={0x73622a85, 0x1000, 0x3}, @ptr={0x70742a85, 0x0, &(0x7f00000001c0)=""/164, 0xa4, 0x0, 0x36}}, &(0x7f0000000300)={0x0, 0x20, 0x38}}, 0x400}], 0xe0, 0x0, &(0x7f0000000480)="d2038edfd42959b6dd47b570ab00671d7eb0711f2a828a489a9bfab1bfec5b177dff5af2ccc1eb04f16140d9b6c06fd59a2464d0508382f446d77369814fcc99d3947b2d46340bc932f6344ae0e12db3871fa26cbf03a47ea43dd747ad12281b9a6640b4a2931c69587ad35362c9b9b1eb0a80732edc6374cd3cf7d6f64be41cf2fb6ec91391eac626315be7eb9a703921be66272d5f9c0eb1a7e899a1386c457ff36547846454ab348efb3e2d81dd0a1cfebf0aa6520edb96aa8c470083a7b89958e554608021d2683e44703f35f9cf1848a8b63ad00ab5f35fc891ef34f01d"}) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) syz_open_dev$sg(&(0x7f0000000580), 0x6, 0x40000) (async) ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f00000005c0)=0xcc) (async) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x329000, 0x0) (async) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000340)={0xb4, 0x0, &(0x7f00000003c0)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x71, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000100)={@fd={0x66642a85, 0x0, r2}, @fda={0x66646185, 0x4, 0x2, 0x3f}, @ptr={0x70742a85, 0x1, &(0x7f0000000040)=""/151, 0x97, 0x2, 0x15}}, &(0x7f0000000180)={0x0, 0x18, 0x38}}}, @acquire_done={0x40106309, 0x1}, @request_death={0x400c630e, 0x2}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000280)={@fda={0x66646185, 0x3, 0x1, 0x16}, @flat=@binder={0x73622a85, 0x1000, 0x3}, @ptr={0x70742a85, 0x0, &(0x7f00000001c0)=""/164, 0xa4, 0x0, 0x36}}, &(0x7f0000000300)={0x0, 0x20, 0x38}}, 0x400}], 0xe0, 0x0, &(0x7f0000000480)="d2038edfd42959b6dd47b570ab00671d7eb0711f2a828a489a9bfab1bfec5b177dff5af2ccc1eb04f16140d9b6c06fd59a2464d0508382f446d77369814fcc99d3947b2d46340bc932f6344ae0e12db3871fa26cbf03a47ea43dd747ad12281b9a6640b4a2931c69587ad35362c9b9b1eb0a80732edc6374cd3cf7d6f64be41cf2fb6ec91391eac626315be7eb9a703921be66272d5f9c0eb1a7e899a1386c457ff36547846454ab348efb3e2d81dd0a1cfebf0aa6520edb96aa8c470083a7b89958e554608021d2683e44703f35f9cf1848a8b63ad00ab5f35fc891ef34f01d"}) (async) 20:27:09 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000070001"], 0x1c}}, 0x0) 20:27:09 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x64e, 0x311004) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) [ 2121.995361][T31657] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:09 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x3000000, 0x82) 20:27:10 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) ioctl$SCSI_IOCTL_GET_PCI(0xffffffffffffffff, 0x5387, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) ioctl$SCSI_IOCTL_GET_PCI(0xffffffffffffffff, 0x5387, &(0x7f0000000000)) (async) 20:27:10 executing program 0: ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x1276, 0x0) 20:27:10 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_SET_SHORT_ADDR(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, r1, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_SHORT_ADDR={0x6, 0xa, 0xffff}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_SHORT_ADDR={0x6, 0xa, 0xffff}]}, 0x38}, 0x1, 0x0, 0x0, 0x4008800}, 0x10) r3 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r3, 0x1274, 0x0) 20:27:10 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x4000000, 0x82) 20:27:10 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x64e, 0x311004) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x64e, 0x311004) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) 20:27:10 executing program 0: ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x1276, 0x0) 20:27:10 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_SET_SHORT_ADDR(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, r1, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_SHORT_ADDR={0x6, 0xa, 0xffff}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_SHORT_ADDR={0x6, 0xa, 0xffff}]}, 0x38}, 0x1, 0x0, 0x0, 0x4008800}, 0x10) r3 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r3, 0x1274, 0x0) 20:27:10 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000080001"], 0x1c}}, 0x0) 20:27:10 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x6000000, 0x82) 20:27:10 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x8, 0x18403) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) [ 2122.067574][T31689] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:10 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000000)) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:27:10 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_SET_SHORT_ADDR(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, r1, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_SHORT_ADDR={0x6, 0xa, 0xffff}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_SHORT_ADDR={0x6, 0xa, 0xffff}]}, 0x38}, 0x1, 0x0, 0x0, 0x4008800}, 0x10) r3 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r3, 0x1274, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan0\x00'}) (async) sendmsg$NL802154_CMD_SET_SHORT_ADDR(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, r1, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_SHORT_ADDR={0x6, 0xa, 0xffff}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_SHORT_ADDR={0x6, 0xa, 0xffff}]}, 0x38}, 0x1, 0x0, 0x0, 0x4008800}, 0x10) (async) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r3, 0x1274, 0x0) (async) 20:27:10 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x8, 0x18403) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x8, 0x18403) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) (async) 20:27:10 executing program 0: ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x1276, 0x0) 20:27:10 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x18000000, 0x82) 20:27:10 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000000)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:27:10 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000090001"], 0x1c}}, 0x0) 20:27:10 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x2, 0x220002) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000040)) 20:27:10 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x8, 0x18403) ioctl$SG_GET_COMMAND_Q(r0, 0x1275, 0x0) [ 2122.136282][T31710] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:10 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) recvfrom$rxrpc(0xffffffffffffffff, &(0x7f0000000000)=""/103, 0x67, 0x0, 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) socket$rxrpc(0x21, 0x2, 0xa) 20:27:10 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x3f000000, 0x82) 20:27:10 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x2, 0x220002) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000040)) 20:27:10 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000000)) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000000)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) 20:27:10 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000040)) 20:27:10 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) recvfrom$rxrpc(0xffffffffffffffff, &(0x7f0000000000)=""/103, 0x67, 0x0, 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async, rerun: 64) socket$rxrpc(0x21, 0x2, 0xa) (rerun: 64) 20:27:10 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x2, 0x220002) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000040)) 20:27:10 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000000000a0001"], 0x1c}}, 0x0) 20:27:10 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) 20:27:10 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x40000000, 0x82) 20:27:10 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x6, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x6, 0x204081) ioctl$SCSI_IOCTL_START_UNIT(r2, 0x5) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f0000000040)) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140), 0x202002, 0x0) ioctl$SG_GET_TIMEOUT(r3, 0x2202, 0x0) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0), 0x800, 0x0) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r5, 0x0, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) write$vga_arbiter(r1, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_BUFFERS(r4, 0x1, 0x0, 0x0) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000000)) [ 2122.215763][T31741] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:10 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0xf6ffffff, 0x82) 20:27:10 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (fail_nth: 1) 20:27:10 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x6, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x6, 0x204081) ioctl$SCSI_IOCTL_START_UNIT(r2, 0x5) (async) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f0000000040)) (async) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140), 0x202002, 0x0) ioctl$SG_GET_TIMEOUT(r3, 0x2202, 0x0) (async, rerun: 64) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async, rerun: 64) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0), 0x800, 0x0) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r5, 0x0, 0x0) (async) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) io_uring_register$IORING_UNREGISTER_BUFFERS(r4, 0x1, 0x0, 0x0) (async, rerun: 32) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000000)) (rerun: 32) 20:27:10 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0xfffffff6, 0x82) 20:27:10 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f00000000c0)=0x1) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f0000000000)=ANY=[@ANYBLOB="990000000300000003000000877a75e9de113c0e1538cf3192711f768f278a0ccbf258900e0e869bdadf14211b60627e09923d883bc79518a2d80a4fc9398a05461a5a7c3322fdebe4b7e2a8683366fd2aa3a339fbfb71411c8ac8f7742dff6cd4206d6d0fe9336d86db94a0e11e3ae9f9ce0599a845e5b38960481d1400b6000001000000000066edc06e2bd8968a27c2345c8787f2da8c5f41dbb64549c9ae3a64a516de"]) 20:27:10 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) recvfrom$rxrpc(0xffffffffffffffff, &(0x7f0000000000)=""/103, 0x67, 0x0, 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) socket$rxrpc(0x21, 0x2, 0xa) 20:27:10 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x1000000000000, 0x82) [ 2122.298595][T31769] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2122.320923][T31774] FAULT_INJECTION: forcing a failure. [ 2122.320923][T31774] name failslab, interval 1, probability 0, space 0, times 0 [ 2122.333577][T31774] CPU: 0 PID: 31774 Comm: syz-executor.2 Not tainted 5.17.0-rc1-syzkaller #0 20:27:10 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f00000000c0)=0x1) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f0000000000)=ANY=[@ANYBLOB="990000000300000003000000877a75e9de113c0e1538cf3192711f768f278a0ccbf258900e0e869bdadf14211b60627e09923d883bc79518a2d80a4fc9398a05461a5a7c3322fdebe4b7e2a8683366fd2aa3a339fbfb71411c8ac8f7742dff6cd4206d6d0fe9336d86db94a0e11e3ae9f9ce0599a845e5b38960481d1400b6000001000000000066edc06e2bd8968a27c2345c8787f2da8c5f41dbb64549c9ae3a64a516de"]) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f00000000c0)=0x1) (async) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f0000000000)=ANY=[@ANYBLOB="990000000300000003000000877a75e9de113c0e1538cf3192711f768f278a0ccbf258900e0e869bdadf14211b60627e09923d883bc79518a2d80a4fc9398a05461a5a7c3322fdebe4b7e2a8683366fd2aa3a339fbfb71411c8ac8f7742dff6cd4206d6d0fe9336d86db94a0e11e3ae9f9ce0599a845e5b38960481d1400b6000001000000000066edc06e2bd8968a27c2345c8787f2da8c5f41dbb64549c9ae3a64a516de"]) (async) 20:27:10 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000000000b0001"], 0x1c}}, 0x0) 20:27:10 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f0000000000)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r1, 0x2287, &(0x7f0000000040)=0x7f) 20:27:10 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x6, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x6, 0x204081) ioctl$SCSI_IOCTL_START_UNIT(r2, 0x5) (async, rerun: 64) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f0000000040)) (async, rerun: 64) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140), 0x202002, 0x0) ioctl$SG_GET_TIMEOUT(r3, 0x2202, 0x0) (async, rerun: 64) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async, rerun: 64) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0), 0x800, 0x0) (async) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r5, 0x0, 0x0) (async, rerun: 64) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) (rerun: 64) write$vga_arbiter(r1, 0x0, 0x0) (async) io_uring_register$IORING_UNREGISTER_BUFFERS(r4, 0x1, 0x0, 0x0) (async) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000000)) [ 2122.342356][T31774] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2122.352424][T31774] Call Trace: [ 2122.355863][T31774] [ 2122.358799][T31774] dump_stack_lvl+0xd6/0x122 [ 2122.363411][T31774] dump_stack+0x11/0x1b [ 2122.367663][T31774] should_fail+0x23c/0x250 [ 2122.372096][T31774] ? getname_flags+0x84/0x3f0 [ 2122.376818][T31774] __should_failslab+0x81/0x90 [ 2122.381608][T31774] should_failslab+0x5/0x20 [ 2122.386127][T31774] kmem_cache_alloc+0x4f/0x320 [ 2122.390944][T31774] getname_flags+0x84/0x3f0 20:27:10 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000000000c0001"], 0x1c}}, 0x0) [ 2122.395457][T31774] getname+0x15/0x20 [ 2122.396750][T31799] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2122.399372][T31774] do_sys_openat2+0x6d/0x2b0 [ 2122.399404][T31774] __x64_sys_openat+0xef/0x110 [ 2122.418073][T31774] do_syscall_64+0x44/0xd0 [ 2122.422578][T31774] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2122.427469][T31801] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2122.428487][T31774] RIP: 0033:0x7f2fe4d41f74 20:27:10 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000000000d0001"], 0x1c}}, 0x0) [ 2122.442142][T31774] Code: 84 00 00 00 00 00 44 89 54 24 0c e8 96 f9 ff ff 44 8b 54 24 0c 44 89 e2 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 89 44 24 0c e8 c8 f9 ff ff 8b 44 [ 2122.461802][T31774] RSP: 002b:00007f2fe3f04ca0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [ 2122.470220][T31774] RAX: ffffffffffffffda RBX: 6666666666666667 RCX: 00007f2fe4d41f74 [ 2122.478242][T31774] RDX: 0000000000000082 RSI: 00007f2fe3f04d40 RDI: 00000000ffffff9c [ 2122.479864][T31805] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:10 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (fail_nth: 2) 20:27:10 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x20000000000000, 0x82) 20:27:10 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f00000000c0)=0x1) (async) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f0000000000)=ANY=[@ANYBLOB="990000000300000003000000877a75e9de113c0e1538cf3192711f768f278a0ccbf258900e0e869bdadf14211b60627e09923d883bc79518a2d80a4fc9398a05461a5a7c3322fdebe4b7e2a8683366fd2aa3a339fbfb71411c8ac8f7742dff6cd4206d6d0fe9336d86db94a0e11e3ae9f9ce0599a845e5b38960481d1400b6000001000000000066edc06e2bd8968a27c2345c8787f2da8c5f41dbb64549c9ae3a64a516de"]) 20:27:10 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000000000e0001"], 0x1c}}, 0x0) 20:27:10 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f0000000000)) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_SET_KEEP_ORPHAN(r1, 0x2287, &(0x7f0000000040)=0x7f) 20:27:10 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x100000000000000, 0x82) [ 2122.486217][T31774] RBP: 00007f2fe3f04d40 R08: 0000000000000000 R09: 0000000000000000 [ 2122.486233][T31774] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000082 [ 2122.511386][T31774] R13: 00007fff233cfdaf R14: 00007f2fe3f05300 R15: 0000000000022000 [ 2122.519368][T31774] 20:27:10 executing program 5: r0 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000004c0)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) sendmsg$IEEE802154_LLSEC_GETPARAMS(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20c02}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x54, r0, 0x0, 0x70bd2a, 0x25dfdbfc, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000004}, 0x20000000) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'wpan0\x00'}) sendmsg$NL802154_CMD_DEL_SEC_DEV(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f0000000540)=ANY=[@ANYBLOB="600000002679656a3e81fcb2997e6cf2c04fc90d495fc628927a0b13d94014e12b144b7c", @ANYRES16=0x0, @ANYBLOB="00012bbd0000050000001b000000000023800c0004000201aaaaaaaaaaaa100023800c0004000201aaaaaaaaaaaa100023800c00040000000000000000f30f0023800c00040000000000000000000c0006000000000000000000"], 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000010) r5 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f0000000240)={'wpan0\x00'}) r7 = syz_open_dev$sg(&(0x7f0000000200), 0x5, 0x111000) ioctl$SCSI_IOCTL_SEND_COMMAND(r5, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000000000000004000000284e6fa64de45efb25d608471a2f5686da3325a2c0fcc13924d2ad49b315f4cd3e2ca25c0e608d3f51bf389c82ec0bf841190d6f6113cd5ca17523b7fa0162256cab6b98f3d1da382cd4c7766ea61b563f9576f577596e5793079fb7d4a935161fe8819e7c3d785da02a83936924b8dbc32ed98792be041e961d9168dc79b5"]) ioctl$SG_SET_RESERVED_SIZE(r7, 0x2275, &(0x7f0000000280)=0x4) syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r6) ioctl$SG_GET_COMMAND_Q(r5, 0x1267, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r5, 0x2287, &(0x7f0000000000)) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x1) [ 2122.559317][T31824] FAULT_INJECTION: forcing a failure. [ 2122.559317][T31824] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2122.572466][T31824] CPU: 0 PID: 31824 Comm: syz-executor.2 Not tainted 5.17.0-rc1-syzkaller #0 [ 2122.581250][T31824] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2122.591316][T31824] Call Trace: [ 2122.594600][T31824] [ 2122.597611][T31824] dump_stack_lvl+0xd6/0x122 [ 2122.602218][T31824] dump_stack+0x11/0x1b 20:27:10 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x20800) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f0000000080)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f0000000040)) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000000)) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:27:10 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f0000000000)) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r1, 0x2287, &(0x7f0000000040)=0x7f) 20:27:10 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x20800) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f0000000080)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f0000000040)) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000000)) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) [ 2122.606468][T31824] should_fail+0x23c/0x250 [ 2122.610908][T31824] should_fail_usercopy+0x16/0x20 [ 2122.615942][T31824] strncpy_from_user+0x21/0x250 [ 2122.617408][T31827] program syz-executor.5 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2122.620803][T31824] getname_flags+0xb8/0x3f0 [ 2122.634840][T31824] getname+0x15/0x20 [ 2122.638765][T31824] do_sys_openat2+0x6d/0x2b0 [ 2122.643367][T31824] __x64_sys_openat+0xef/0x110 [ 2122.648138][T31824] do_syscall_64+0x44/0xd0 [ 2122.652570][T31824] entry_SYSCALL_64_after_hwframe+0x44/0xae 20:27:10 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000000000f0001"], 0x1c}}, 0x0) 20:27:10 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x20800) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f0000000080)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f0000000040)) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000000)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) [ 2122.658476][T31824] RIP: 0033:0x7f2fe4d41f74 [ 2122.662960][T31824] Code: 84 00 00 00 00 00 44 89 54 24 0c e8 96 f9 ff ff 44 8b 54 24 0c 44 89 e2 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 89 44 24 0c e8 c8 f9 ff ff 8b 44 [ 2122.682576][T31824] RSP: 002b:00007f2fe3f04ca0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [ 2122.691038][T31824] RAX: ffffffffffffffda RBX: 6666666666666667 RCX: 00007f2fe4d41f74 [ 2122.699092][T31824] RDX: 0000000000000082 RSI: 00007f2fe3f04d40 RDI: 00000000ffffff9c 20:27:10 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (fail_nth: 3) 20:27:10 executing program 5: r0 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000004c0)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) sendmsg$IEEE802154_LLSEC_GETPARAMS(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20c02}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x54, r0, 0x0, 0x70bd2a, 0x25dfdbfc, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000004}, 0x20000000) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'wpan0\x00'}) sendmsg$NL802154_CMD_DEL_SEC_DEV(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f0000000540)=ANY=[@ANYBLOB="600000002679656a3e81fcb2997e6cf2c04fc90d495fc628927a0b13d94014e12b144b7c", @ANYRES16=0x0, @ANYBLOB="00012bbd0000050000001b000000000023800c0004000201aaaaaaaaaaaa100023800c0004000201aaaaaaaaaaaa100023800c00040000000000000000f30f0023800c00040000000000000000000c0006000000000000000000"], 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000010) r5 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f0000000240)={'wpan0\x00'}) r7 = syz_open_dev$sg(&(0x7f0000000200), 0x5, 0x111000) ioctl$SCSI_IOCTL_SEND_COMMAND(r5, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000000000000004000000284e6fa64de45efb25d608471a2f5686da3325a2c0fcc13924d2ad49b315f4cd3e2ca25c0e608d3f51bf389c82ec0bf841190d6f6113cd5ca17523b7fa0162256cab6b98f3d1da382cd4c7766ea61b563f9576f577596e5793079fb7d4a935161fe8819e7c3d785da02a83936924b8dbc32ed98792be041e961d9168dc79b5"]) ioctl$SG_SET_RESERVED_SIZE(r7, 0x2275, &(0x7f0000000280)=0x4) syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r6) ioctl$SG_GET_COMMAND_Q(r5, 0x1267, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r5, 0x2287, &(0x7f0000000000)) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x1) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000004c0)={'wpan1\x00'}) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) (async) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) (async) sendmsg$IEEE802154_LLSEC_GETPARAMS(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20c02}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x54, r0, 0x0, 0x70bd2a, 0x25dfdbfc, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000004}, 0x20000000) (async) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'wpan0\x00'}) (async) sendmsg$NL802154_CMD_DEL_SEC_DEV(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f0000000540)=ANY=[@ANYBLOB="600000002679656a3e81fcb2997e6cf2c04fc90d495fc628927a0b13d94014e12b144b7c", @ANYRES16=0x0, @ANYBLOB="00012bbd0000050000001b000000000023800c0004000201aaaaaaaaaaaa100023800c0004000201aaaaaaaaaaaa100023800c00040000000000000000f30f0023800c00040000000000000000000c0006000000000000000000"], 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000010) (async) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f0000000240)={'wpan0\x00'}) (async) syz_open_dev$sg(&(0x7f0000000200), 0x5, 0x111000) (async) ioctl$SCSI_IOCTL_SEND_COMMAND(r5, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000000000000004000000284e6fa64de45efb25d608471a2f5686da3325a2c0fcc13924d2ad49b315f4cd3e2ca25c0e608d3f51bf389c82ec0bf841190d6f6113cd5ca17523b7fa0162256cab6b98f3d1da382cd4c7766ea61b563f9576f577596e5793079fb7d4a935161fe8819e7c3d785da02a83936924b8dbc32ed98792be041e961d9168dc79b5"]) (async) ioctl$SG_SET_RESERVED_SIZE(r7, 0x2275, &(0x7f0000000280)=0x4) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r6) (async) ioctl$SG_GET_COMMAND_Q(r5, 0x1267, 0x0) (async) ioctl$SG_SET_KEEP_ORPHAN(r5, 0x2287, &(0x7f0000000000)) (async) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x1) (async) 20:27:10 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000200), 0x100, 0x2000) ioctl$EVIOCGPHYS(r0, 0x80404507, &(0x7f0000000240)=""/132) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x18400, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r2, 0x5) sendmsg$AUDIT_SIGNAL_INFO(r1, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x10, 0x3f2, 0x8, 0x70bd2a, 0x25dfdbfb, "", ["", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x8}, 0x4001) r3 = syz_open_dev$sg(&(0x7f0000000080), 0xffffffffffff5ea7, 0x80) ioctl$SG_SET_KEEP_ORPHAN(r3, 0x2287, &(0x7f00000000c0)=0x7fff) 20:27:10 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x200000000000000, 0x82) 20:27:10 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000100001"], 0x1c}}, 0x0) 20:27:10 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000180)) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r2, 0x2287, &(0x7f00000001c0)=0x1) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000000)) [ 2122.707249][T31824] RBP: 00007f2fe3f04d40 R08: 0000000000000000 R09: 0000000000000000 [ 2122.715266][T31824] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000082 [ 2122.723341][T31824] R13: 00007fff233cfdaf R14: 00007f2fe3f05300 R15: 0000000000022000 [ 2122.731370][T31824] [ 2122.749335][T31843] program syz-executor.5 is using a deprecated SCSI ioctl, please convert it to SG_IO 20:27:10 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x300000000000000, 0x82) 20:27:10 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000110001"], 0x1c}}, 0x0) 20:27:10 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000120001"], 0x1c}}, 0x0) 20:27:10 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x400000000000000, 0x82) [ 2122.762937][T31853] FAULT_INJECTION: forcing a failure. [ 2122.762937][T31853] name failslab, interval 1, probability 0, space 0, times 0 [ 2122.775595][T31853] CPU: 0 PID: 31853 Comm: syz-executor.2 Not tainted 5.17.0-rc1-syzkaller #0 [ 2122.784372][T31853] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2122.794438][T31853] Call Trace: [ 2122.797734][T31853] [ 2122.800673][T31853] dump_stack_lvl+0xd6/0x122 [ 2122.805275][T31853] dump_stack+0x11/0x1b 20:27:10 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000200), 0x100, 0x2000) ioctl$EVIOCGPHYS(r0, 0x80404507, &(0x7f0000000240)=""/132) (async) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x18400, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r2, 0x5) (async) sendmsg$AUDIT_SIGNAL_INFO(r1, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x10, 0x3f2, 0x8, 0x70bd2a, 0x25dfdbfb, "", ["", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x8}, 0x4001) (async) r3 = syz_open_dev$sg(&(0x7f0000000080), 0xffffffffffff5ea7, 0x80) ioctl$SG_SET_KEEP_ORPHAN(r3, 0x2287, &(0x7f00000000c0)=0x7fff) 20:27:10 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000250001"], 0x1c}}, 0x0) [ 2122.809443][T31853] should_fail+0x23c/0x250 [ 2122.813977][T31853] ? __alloc_file+0x2e/0x1a0 [ 2122.818680][T31853] __should_failslab+0x81/0x90 [ 2122.823508][T31853] should_failslab+0x5/0x20 [ 2122.828042][T31853] kmem_cache_alloc+0x4f/0x320 [ 2122.832819][T31853] __alloc_file+0x2e/0x1a0 [ 2122.837318][T31853] alloc_empty_file+0xcd/0x1c0 [ 2122.842092][T31853] path_openat+0x6a/0x1f30 [ 2122.846538][T31853] ? unlock_page_memcg+0xc3/0xe0 [ 2122.851549][T31853] ? next_uptodate_page+0x512/0x540 [ 2122.857043][T31853] ? __rcu_read_unlock+0x5c/0x290 [ 2122.862081][T31853] ? filemap_map_pages+0x892/0x8d0 [ 2122.867981][T31853] do_filp_open+0x105/0x220 [ 2122.872568][T31853] do_sys_openat2+0xb5/0x2b0 [ 2122.877173][T31853] __x64_sys_openat+0xef/0x110 [ 2122.882021][T31853] do_syscall_64+0x44/0xd0 [ 2122.886448][T31853] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2122.892362][T31853] RIP: 0033:0x7f2fe4d41f74 [ 2122.896800][T31853] Code: 84 00 00 00 00 00 44 89 54 24 0c e8 96 f9 ff ff 44 8b 54 24 0c 44 89 e2 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 89 44 24 0c e8 c8 f9 ff ff 8b 44 [ 2122.916410][T31853] RSP: 002b:00007f2fe3f04ca0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [ 2122.924849][T31853] RAX: ffffffffffffffda RBX: 6666666666666667 RCX: 00007f2fe4d41f74 [ 2122.932897][T31853] RDX: 0000000000000082 RSI: 00007f2fe3f04d40 RDI: 00000000ffffff9c [ 2122.940864][T31853] RBP: 00007f2fe3f04d40 R08: 0000000000000000 R09: 0000000000000000 [ 2122.948824][T31853] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000082 20:27:10 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (fail_nth: 4) 20:27:10 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000000d260001"], 0x1c}}, 0x0) 20:27:10 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x600000000000000, 0x82) 20:27:10 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000180)) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r2, 0x2287, &(0x7f00000001c0)=0x1) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000000)) 20:27:10 executing program 5: r0 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000004c0)={'wpan1\x00', 0x0}) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) (rerun: 64) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) sendmsg$IEEE802154_LLSEC_GETPARAMS(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20c02}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x54, r0, 0x0, 0x70bd2a, 0x25dfdbfc, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000004}, 0x20000000) (async) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'wpan0\x00'}) (async) sendmsg$NL802154_CMD_DEL_SEC_DEV(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f0000000540)=ANY=[@ANYBLOB="600000002679656a3e81fcb2997e6cf2c04fc90d495fc628927a0b13d94014e12b144b7c", @ANYRES16=0x0, @ANYBLOB="00012bbd0000050000001b000000000023800c0004000201aaaaaaaaaaaa100023800c0004000201aaaaaaaaaaaa100023800c00040000000000000000f30f0023800c00040000000000000000000c0006000000000000000000"], 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000010) (async) r5 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f0000000240)={'wpan0\x00'}) r7 = syz_open_dev$sg(&(0x7f0000000200), 0x5, 0x111000) ioctl$SCSI_IOCTL_SEND_COMMAND(r5, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000000000000004000000284e6fa64de45efb25d608471a2f5686da3325a2c0fcc13924d2ad49b315f4cd3e2ca25c0e608d3f51bf389c82ec0bf841190d6f6113cd5ca17523b7fa0162256cab6b98f3d1da382cd4c7766ea61b563f9576f577596e5793079fb7d4a935161fe8819e7c3d785da02a83936924b8dbc32ed98792be041e961d9168dc79b5"]) (async) ioctl$SG_SET_RESERVED_SIZE(r7, 0x2275, &(0x7f0000000280)=0x4) (async, rerun: 32) syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r6) (async, rerun: 32) ioctl$SG_GET_COMMAND_Q(r5, 0x1267, 0x0) (async) ioctl$SG_SET_KEEP_ORPHAN(r5, 0x2287, &(0x7f0000000000)) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x1) 20:27:10 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000200), 0x100, 0x2000) ioctl$EVIOCGPHYS(r0, 0x80404507, &(0x7f0000000240)=""/132) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x18400, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) (async) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r2, 0x5) sendmsg$AUDIT_SIGNAL_INFO(r1, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x10, 0x3f2, 0x8, 0x70bd2a, 0x25dfdbfb, "", ["", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x8}, 0x4001) (async) r3 = syz_open_dev$sg(&(0x7f0000000080), 0xffffffffffff5ea7, 0x80) ioctl$SG_SET_KEEP_ORPHAN(r3, 0x2287, &(0x7f00000000c0)=0x7fff) 20:27:10 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x1800000000000000, 0x82) [ 2122.956848][T31853] R13: 00007fff233cfdaf R14: 00007f2fe3f05300 R15: 0000000000022000 [ 2122.964869][T31853] [ 2123.000788][T31906] FAULT_INJECTION: forcing a failure. [ 2123.000788][T31906] name failslab, interval 1, probability 0, space 0, times 0 [ 2123.013566][T31906] CPU: 0 PID: 31906 Comm: syz-executor.2 Not tainted 5.17.0-rc1-syzkaller #0 [ 2123.022363][T31906] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2123.032427][T31906] Call Trace: [ 2123.035722][T31906] [ 2123.038661][T31906] dump_stack_lvl+0xd6/0x122 [ 2123.043270][T31906] dump_stack+0x11/0x1b 20:27:10 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000180)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) (async, rerun: 64) ioctl$SG_SET_KEEP_ORPHAN(r2, 0x2287, &(0x7f00000001c0)=0x1) (rerun: 64) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000000)) 20:27:10 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x1, 0x189000) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:27:10 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x3f00000000000000, 0x82) 20:27:10 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x1, 0x189000) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:27:11 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000480001"], 0x1c}}, 0x0) [ 2123.047439][T31906] should_fail+0x23c/0x250 [ 2123.051888][T31906] ? security_file_alloc+0x30/0x190 [ 2123.057179][T31906] __should_failslab+0x81/0x90 [ 2123.062028][T31906] should_failslab+0x5/0x20 [ 2123.066637][T31906] kmem_cache_alloc+0x4f/0x320 [ 2123.071425][T31906] security_file_alloc+0x30/0x190 [ 2123.076473][T31906] __alloc_file+0x83/0x1a0 [ 2123.080914][T31906] alloc_empty_file+0xcd/0x1c0 [ 2123.085726][T31906] path_openat+0x6a/0x1f30 [ 2123.086721][T31896] program syz-executor.5 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2123.090209][T31906] ? __this_cpu_preempt_check+0x18/0x20 [ 2123.105311][T31906] ? unlock_page_memcg+0xc3/0xe0 [ 2123.110264][T31906] ? next_uptodate_page+0x512/0x540 [ 2123.115477][T31906] ? __rcu_read_unlock+0x5c/0x290 [ 2123.120570][T31906] ? filemap_map_pages+0x892/0x8d0 [ 2123.125726][T31906] do_filp_open+0x105/0x220 [ 2123.130253][T31906] do_sys_openat2+0xb5/0x2b0 [ 2123.134857][T31906] __x64_sys_openat+0xef/0x110 [ 2123.139638][T31906] do_syscall_64+0x44/0xd0 [ 2123.144120][T31906] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2123.150028][T31906] RIP: 0033:0x7f2fe4d41f74 [ 2123.154446][T31906] Code: 84 00 00 00 00 00 44 89 54 24 0c e8 96 f9 ff ff 44 8b 54 24 0c 44 89 e2 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 89 44 24 0c e8 c8 f9 ff ff 8b 44 [ 2123.174047][T31906] RSP: 002b:00007f2fe3f04ca0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [ 2123.182556][T31906] RAX: ffffffffffffffda RBX: 6666666666666667 RCX: 00007f2fe4d41f74 [ 2123.191194][T31906] RDX: 0000000000000082 RSI: 00007f2fe3f04d40 RDI: 00000000ffffff9c 20:27:11 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (fail_nth: 5) 20:27:11 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x1, 0x189000) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:27:11 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x4000000000000000, 0x82) 20:27:11 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f0000000000)=0x20) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) r2 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r4, 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r4, 0x227d, &(0x7f0000000140)) ioctl$PTP_ENABLE_PPS(r2, 0x40043d04, 0x0) ioctl$PTP_PIN_SETFUNC2(r2, 0x40603d10, &(0x7f0000000080)={'\x00', 0x1, 0x0, 0x9}) 20:27:11 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000000004c0001"], 0x1c}}, 0x0) 20:27:11 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x10000, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x1274, 0x0) ioctl$SG_EMULATED_HOST(r0, 0x2203, &(0x7f0000000000)) [ 2123.200198][T31906] RBP: 00007f2fe3f04d40 R08: 0000000000000000 R09: 0000000000000000 [ 2123.208349][T31906] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000082 [ 2123.216315][T31906] R13: 00007fff233cfdaf R14: 00007f2fe3f05300 R15: 0000000000022000 [ 2123.224816][T31906] 20:27:11 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0xf6ffffff00000000, 0x82) 20:27:11 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) 20:27:11 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000600001"], 0x1c}}, 0x0) 20:27:11 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000680001"], 0x1c}}, 0x0) [ 2123.249280][T31927] FAULT_INJECTION: forcing a failure. [ 2123.249280][T31927] name failslab, interval 1, probability 0, space 0, times 0 [ 2123.262472][T31927] CPU: 0 PID: 31927 Comm: syz-executor.2 Not tainted 5.17.0-rc1-syzkaller #0 [ 2123.271923][T31927] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2123.282166][T31927] Call Trace: [ 2123.287185][T31927] [ 2123.290197][T31927] dump_stack_lvl+0xd6/0x122 [ 2123.295447][T31927] dump_stack+0x11/0x1b 20:27:11 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000000006c0001"], 0x1c}}, 0x0) 20:27:11 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000740001"], 0x1c}}, 0x0) [ 2123.299711][T31927] should_fail+0x23c/0x250 [ 2123.304204][T31927] ? sg_open+0x6fd/0xe00 [ 2123.308461][T31927] __should_failslab+0x81/0x90 [ 2123.313345][T31927] should_failslab+0x5/0x20 [ 2123.317911][T31927] kmem_cache_alloc_trace+0x52/0x350 [ 2123.323382][T31927] ? scsi_block_when_processing_errors+0x194/0x1d0 [ 2123.329904][T31927] sg_open+0x6fd/0xe00 [ 2123.334015][T31927] chrdev_open+0x362/0x3d0 [ 2123.338529][T31927] ? cd_forget+0xe0/0xe0 [ 2123.342839][T31927] do_dentry_open+0x52c/0x860 [ 2123.347533][T31927] vfs_open+0x43/0x50 [ 2123.351502][T31927] path_openat+0x170c/0x1f30 [ 2123.356094][T31927] ? next_uptodate_page+0x512/0x540 [ 2123.361455][T31927] do_filp_open+0x105/0x220 [ 2123.366375][T31927] do_sys_openat2+0xb5/0x2b0 [ 2123.371383][T31927] __x64_sys_openat+0xef/0x110 [ 2123.376703][T31927] do_syscall_64+0x44/0xd0 [ 2123.382078][T31927] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2123.390213][T31927] RIP: 0033:0x7f2fe4d41f74 [ 2123.396973][T31927] Code: 84 00 00 00 00 00 44 89 54 24 0c e8 96 f9 ff ff 44 8b 54 24 0c 44 89 e2 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 89 44 24 0c e8 c8 f9 ff ff 8b 44 [ 2123.418499][T31927] RSP: 002b:00007f2fe3f04ca0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [ 2123.427142][T31927] RAX: ffffffffffffffda RBX: 6666666666666667 RCX: 00007f2fe4d41f74 [ 2123.435285][T31927] RDX: 0000000000000082 RSI: 00007f2fe3f04d40 RDI: 00000000ffffff9c [ 2123.443245][T31927] RBP: 00007f2fe3f04d40 R08: 0000000000000000 R09: 0000000000000000 20:27:11 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (fail_nth: 6) 20:27:11 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000000007a0001"], 0x1c}}, 0x0) 20:27:11 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) [ 2123.451814][T31927] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000082 [ 2123.460505][T31927] R13: 00007fff233cfdaf R14: 00007f2fe3f05300 R15: 0000000000022000 [ 2123.470040][T31927] [ 2123.492292][T31950] FAULT_INJECTION: forcing a failure. 20:27:11 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async, rerun: 64) ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f0000000000)=0x20) (async, rerun: 64) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) r2 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) (async, rerun: 32) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (rerun: 32) write$vga_arbiter(r4, 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r4, 0x227d, &(0x7f0000000140)) (async, rerun: 32) ioctl$PTP_ENABLE_PPS(r2, 0x40043d04, 0x0) (async, rerun: 32) ioctl$PTP_PIN_SETFUNC2(r2, 0x40603d10, &(0x7f0000000080)={'\x00', 0x1, 0x0, 0x9}) 20:27:11 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0xffffffff00000000, 0x82) 20:27:11 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x10000, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x1274, 0x0) (async) ioctl$SG_EMULATED_HOST(r0, 0x2203, &(0x7f0000000000)) 20:27:11 executing program 3: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) ioctl$EVIOCGMASK(r0, 0x80104592, &(0x7f0000000140)={0x5, 0xc8, &(0x7f0000000040)="7d2f18b673bca41de007e2d56a16e926ceddb360e1977187c82909eed46b82317478f76a1cba494b6f2253cff6610f228bc46c6ffce84b863bd287d654d2f5ca181f1d4da8d791bf2dee833a1237d438fb2446b17ec2b00e44e401e80a6d46b0258a6ece962fc2d9b41a2e2fb1a0188489d6cd39ec1895e168f302dc4ae9a3557a6e90a8c85bbaadbd1e471471a164618d82f4f71dea59c3ebb60cff83285295ae8a6981a47c4b0a02df01ce7685770b3b4e0953ac34590d1e7764306de5f17ddb81a382157de21d"}) syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x82) [ 2123.492292][T31950] name failslab, interval 1, probability 0, space 0, times 0 [ 2123.505059][T31950] CPU: 0 PID: 31950 Comm: syz-executor.2 Not tainted 5.17.0-rc1-syzkaller #0 [ 2123.513829][T31950] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2123.523901][T31950] Call Trace: [ 2123.527185][T31950] [ 2123.530188][T31950] dump_stack_lvl+0xd6/0x122 [ 2123.534820][T31950] dump_stack+0x11/0x1b [ 2123.539009][T31950] should_fail+0x23c/0x250 [ 2123.543442][T31950] ? kzalloc+0x1d/0x30 [ 2123.547526][T31950] __should_failslab+0x81/0x90 20:27:11 executing program 3: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) ioctl$EVIOCGMASK(r0, 0x80104592, &(0x7f0000000140)={0x5, 0xc8, &(0x7f0000000040)="7d2f18b673bca41de007e2d56a16e926ceddb360e1977187c82909eed46b82317478f76a1cba494b6f2253cff6610f228bc46c6ffce84b863bd287d654d2f5ca181f1d4da8d791bf2dee833a1237d438fb2446b17ec2b00e44e401e80a6d46b0258a6ece962fc2d9b41a2e2fb1a0188489d6cd39ec1895e168f302dc4ae9a3557a6e90a8c85bbaadbd1e471471a164618d82f4f71dea59c3ebb60cff83285295ae8a6981a47c4b0a02df01ce7685770b3b4e0953ac34590d1e7764306de5f17ddb81a382157de21d"}) syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x82) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r0, 0x0, 0x0) (async) ioctl$EVIOCGMASK(r0, 0x80104592, &(0x7f0000000140)={0x5, 0xc8, &(0x7f0000000040)="7d2f18b673bca41de007e2d56a16e926ceddb360e1977187c82909eed46b82317478f76a1cba494b6f2253cff6610f228bc46c6ffce84b863bd287d654d2f5ca181f1d4da8d791bf2dee833a1237d438fb2446b17ec2b00e44e401e80a6d46b0258a6ece962fc2d9b41a2e2fb1a0188489d6cd39ec1895e168f302dc4ae9a3557a6e90a8c85bbaadbd1e471471a164618d82f4f71dea59c3ebb60cff83285295ae8a6981a47c4b0a02df01ce7685770b3b4e0953ac34590d1e7764306de5f17ddb81a382157de21d"}) (async) syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x82) (async) 20:27:11 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000ffffff9e0001"], 0x1c}}, 0x0) 20:27:11 executing program 3: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) (async, rerun: 64) ioctl$EVIOCGMASK(r0, 0x80104592, &(0x7f0000000140)={0x5, 0xc8, &(0x7f0000000040)="7d2f18b673bca41de007e2d56a16e926ceddb360e1977187c82909eed46b82317478f76a1cba494b6f2253cff6610f228bc46c6ffce84b863bd287d654d2f5ca181f1d4da8d791bf2dee833a1237d438fb2446b17ec2b00e44e401e80a6d46b0258a6ece962fc2d9b41a2e2fb1a0188489d6cd39ec1895e168f302dc4ae9a3557a6e90a8c85bbaadbd1e471471a164618d82f4f71dea59c3ebb60cff83285295ae8a6981a47c4b0a02df01ce7685770b3b4e0953ac34590d1e7764306de5f17ddb81a382157de21d"}) (rerun: 64) syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x82) 20:27:11 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000ffffffef0001"], 0x1c}}, 0x0) [ 2123.553411][T31950] should_failslab+0x5/0x20 [ 2123.557933][T31950] __kmalloc+0x6f/0x370 [ 2123.562229][T31950] ? save_fpregs_to_fpstate+0xf5/0x140 [ 2123.567707][T31950] kzalloc+0x1d/0x30 [ 2123.571629][T31950] sg_build_indirect+0x7c/0x4c0 [ 2123.576510][T31950] ? kmem_cache_alloc_trace+0x24b/0x350 [ 2123.582121][T31950] ? sg_open+0x6fd/0xe00 [ 2123.586380][T31950] ? preempt_count_add+0x4e/0x90 [ 2123.591333][T31950] sg_open+0xa03/0xe00 [ 2123.595500][T31950] ? init_wait_entry+0x30/0x30 20:27:11 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000fffffff00001"], 0x1c}}, 0x0) [ 2123.600371][T31950] chrdev_open+0x362/0x3d0 [ 2123.605913][T31950] ? cd_forget+0xe0/0xe0 [ 2123.610434][T31950] do_dentry_open+0x52c/0x860 [ 2123.615132][T31950] vfs_open+0x43/0x50 [ 2123.619207][T31950] path_openat+0x170c/0x1f30 [ 2123.623978][T31950] ? next_uptodate_page+0x512/0x540 [ 2123.629207][T31950] do_filp_open+0x105/0x220 [ 2123.633728][T31950] do_sys_openat2+0xb5/0x2b0 [ 2123.638423][T31950] __x64_sys_openat+0xef/0x110 [ 2123.643301][T31950] do_syscall_64+0x44/0xd0 [ 2123.647734][T31950] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2123.653668][T31950] RIP: 0033:0x7f2fe4d41f74 [ 2123.658196][T31950] Code: 84 00 00 00 00 00 44 89 54 24 0c e8 96 f9 ff ff 44 8b 54 24 0c 44 89 e2 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 89 44 24 0c e8 c8 f9 ff ff 8b 44 [ 2123.678196][T31950] RSP: 002b:00007f2fe3f04ca0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [ 2123.686609][T31950] RAX: ffffffffffffffda RBX: 6666666666666667 RCX: 00007f2fe4d41f74 [ 2123.694669][T31950] RDX: 0000000000000082 RSI: 00007f2fe3f04d40 RDI: 00000000ffffff9c 20:27:11 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (fail_nth: 7) 20:27:11 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000007fffffff0001"], 0x1c}}, 0x0) 20:27:11 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async, rerun: 64) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) (rerun: 64) 20:27:11 executing program 3: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000040), 0x8, 0x2) ioctl$SCSI_IOCTL_START_UNIT(r2, 0x5) 20:27:11 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x10000, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x1274, 0x0) ioctl$SG_EMULATED_HOST(r0, 0x2203, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x10000, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r1, 0x1274, 0x0) (async) ioctl$SG_EMULATED_HOST(r0, 0x2203, &(0x7f0000000000)) (async) 20:27:11 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f0000000000)=0x20) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) r2 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) (async) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r4, 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r4, 0x227d, &(0x7f0000000140)) ioctl$PTP_ENABLE_PPS(r2, 0x40043d04, 0x0) (async) ioctl$PTP_PIN_SETFUNC2(r2, 0x40603d10, &(0x7f0000000080)={'\x00', 0x1, 0x0, 0x9}) 20:27:11 executing program 5: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x240002, 0x0) ioctl$EVIOCGABS3F(r0, 0x8018457f, &(0x7f0000000040)=""/179) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(0xffffffffffffffff, 0x84, 0x21, &(0x7f0000000100)=0x9, 0x4) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x1267, 0x0) [ 2123.702809][T31950] RBP: 00007f2fe3f04d40 R08: 0000000000000000 R09: 0000000000000000 [ 2123.710769][T31950] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000082 [ 2123.718835][T31950] R13: 00007fff233cfdaf R14: 00007f2fe3f05300 R15: 0000000000022000 [ 2123.726811][T31950] 20:27:11 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000009effffff0001"], 0x1c}}, 0x0) 20:27:11 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = socket(0x11, 0xa, 0x8) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) sendmsg$NL80211_CMD_RADAR_DETECT(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x50, r2, 0x2, 0x4, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x5, 0x50}}}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x14}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_CHANNEL_WIDTH={0x8}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xc}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xffff}]}, 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x4040) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$IMSETDEVNAME(r1, 0x80184947, &(0x7f0000000240)={0x3f, 'syz0\x00'}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r1) sendmsg$NL80211_CMD_NEW_MPATH(r3, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x70, r4, 0x400, 0x70bd2b, 0x25dfdbfe, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}]}, 0x70}, 0x1, 0x0, 0x0, 0x41}, 0x10) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000000)) ioctl$SG_SET_DEBUG(0xffffffffffffffff, 0x227e, &(0x7f0000000500)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0), 0x801, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r6, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r7, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x36}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_SET_COALESCE(r5, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x3c, r7, 0x2, 0x70bd2c, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x5, 0x13}}}}, [@NL80211_ATTR_COALESCE_RULE_PKT_PATTERN={0x4}, @NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0x5}, @NL80211_ATTR_COALESCE_RULE_CONDITION={0x8, 0x2, 0x1}, @NL80211_ATTR_COALESCE_RULE_CONDITION={0x8, 0x2, 0x1}]}, 0x3c}}, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) r8 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r8, 0x0, 0x0) ioctl$SCSI_IOCTL_SYNC(r8, 0x4) 20:27:11 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0xfffffffffffffffd, 0x4202) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:27:11 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0xfffffffffffffffd, 0x4202) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:27:11 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0xfffffffffffffffd, 0x4202) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) [ 2123.784485][T32005] FAULT_INJECTION: forcing a failure. [ 2123.784485][T32005] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 2123.797834][T32005] CPU: 1 PID: 32005 Comm: syz-executor.2 Not tainted 5.17.0-rc1-syzkaller #0 [ 2123.806674][T32005] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2123.816821][T32005] Call Trace: [ 2123.820108][T32005] [ 2123.823117][T32005] dump_stack_lvl+0xd6/0x122 [ 2123.827786][T32005] dump_stack+0x11/0x1b [ 2123.832009][T32005] should_fail+0x23c/0x250 [ 2123.836572][T32005] __alloc_pages+0x102/0x330 [ 2123.841273][T32005] alloc_pages+0x316/0x420 [ 2123.845709][T32005] sg_build_indirect+0x1bd/0x4c0 [ 2123.850683][T32005] sg_open+0xa03/0xe00 [ 2123.854769][T32005] ? init_wait_entry+0x30/0x30 [ 2123.859733][T32005] chrdev_open+0x362/0x3d0 [ 2123.864166][T32005] ? cd_forget+0xe0/0xe0 [ 2123.868477][T32005] do_dentry_open+0x52c/0x860 [ 2123.873207][T32005] vfs_open+0x43/0x50 [ 2123.877224][T32005] path_openat+0x170c/0x1f30 [ 2123.881851][T32005] ? next_uptodate_page+0x512/0x540 [ 2123.887037][T32005] do_filp_open+0x105/0x220 [ 2123.891563][T32005] do_sys_openat2+0xb5/0x2b0 [ 2123.896192][T32005] __x64_sys_openat+0xef/0x110 [ 2123.901025][T32005] do_syscall_64+0x44/0xd0 [ 2123.905873][T32005] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2123.911826][T32005] RIP: 0033:0x7f2fe4d41f74 [ 2123.916225][T32005] Code: 84 00 00 00 00 00 44 89 54 24 0c e8 96 f9 ff ff 44 8b 54 24 0c 44 89 e2 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 89 44 24 0c e8 c8 f9 ff ff 8b 44 [ 2123.935900][T32005] RSP: 002b:00007f2fe3f04ca0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [ 2123.944317][T32005] RAX: ffffffffffffffda RBX: 6666666666666667 RCX: 00007f2fe4d41f74 [ 2123.952274][T32005] RDX: 0000000000000082 RSI: 00007f2fe3f04d40 RDI: 00000000ffffff9c [ 2123.960232][T32005] RBP: 00007f2fe3f04d40 R08: 0000000000000000 R09: 0000000000000000 [ 2123.968801][T32005] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000082 [ 2123.976783][T32005] R13: 00007fff233cfdaf R14: 00007f2fe3f05300 R15: 0000000000022000 20:27:11 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (fail_nth: 8) 20:27:11 executing program 3: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000040), 0x8, 0x2) ioctl$SCSI_IOCTL_START_UNIT(r2, 0x5) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r0, 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) (async) syz_open_dev$sg(&(0x7f0000000040), 0x8, 0x2) (async) ioctl$SCSI_IOCTL_START_UNIT(r2, 0x5) (async) 20:27:11 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000efffffff0001"], 0x1c}}, 0x0) 20:27:11 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x40c640, 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r1, 0x2) r2 = syz_open_dev$sg(&(0x7f0000000040), 0x6, 0x400) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) ioctl$SG_EMULATED_HOST(r3, 0x2203, &(0x7f00000000c0)) ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f0000000000)) [ 2123.984857][T32005] 20:27:11 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000f0ffffff0001"], 0x1c}}, 0x0) 20:27:11 executing program 3: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000040), 0x8, 0x2) ioctl$SCSI_IOCTL_START_UNIT(r2, 0x5) 20:27:11 executing program 5: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x240002, 0x0) ioctl$EVIOCGABS3F(r0, 0x8018457f, &(0x7f0000000040)=""/179) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(0xffffffffffffffff, 0x84, 0x21, &(0x7f0000000100)=0x9, 0x4) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x1267, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x240002, 0x0) (async) ioctl$EVIOCGABS3F(r0, 0x8018457f, &(0x7f0000000040)=""/179) (async) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(0xffffffffffffffff, 0x84, 0x21, &(0x7f0000000100)=0x9, 0x4) (async) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r1, 0x1267, 0x0) (async) 20:27:11 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$EVIOCSCLOCKID(0xffffffffffffffff, 0x400445a0, &(0x7f0000000040)=0x8000) ioctl$BINDER_GET_FROZEN_INFO(0xffffffffffffffff, 0xc00c620f, &(0x7f0000000080)={0xffffffffffffffff}) [ 2124.007351][T32031] FAULT_INJECTION: forcing a failure. [ 2124.007351][T32031] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2124.020613][T32031] CPU: 1 PID: 32031 Comm: syz-executor.2 Not tainted 5.17.0-rc1-syzkaller #0 [ 2124.029522][T32031] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2124.039582][T32031] Call Trace: [ 2124.042866][T32031] [ 2124.045802][T32031] dump_stack_lvl+0xd6/0x122 [ 2124.050469][T32031] dump_stack+0x11/0x1b 20:27:11 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = socket(0x11, 0xa, 0x8) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) sendmsg$NL80211_CMD_RADAR_DETECT(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x50, r2, 0x2, 0x4, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x5, 0x50}}}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x14}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_CHANNEL_WIDTH={0x8}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xc}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xffff}]}, 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x4040) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$IMSETDEVNAME(r1, 0x80184947, &(0x7f0000000240)={0x3f, 'syz0\x00'}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r1) sendmsg$NL80211_CMD_NEW_MPATH(r3, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x70, r4, 0x400, 0x70bd2b, 0x25dfdbfe, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}]}, 0x70}, 0x1, 0x0, 0x0, 0x41}, 0x10) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000000)) ioctl$SG_SET_DEBUG(0xffffffffffffffff, 0x227e, &(0x7f0000000500)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0), 0x801, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r6, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r7, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x36}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_SET_COALESCE(r5, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x3c, r7, 0x2, 0x70bd2c, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x5, 0x13}}}}, [@NL80211_ATTR_COALESCE_RULE_PKT_PATTERN={0x4}, @NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0x5}, @NL80211_ATTR_COALESCE_RULE_CONDITION={0x8, 0x2, 0x1}, @NL80211_ATTR_COALESCE_RULE_CONDITION={0x8, 0x2, 0x1}]}, 0x3c}}, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) r8 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r8, 0x0, 0x0) ioctl$SCSI_IOCTL_SYNC(r8, 0x4) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) socket(0x11, 0xa, 0x8) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) (async) sendmsg$NL80211_CMD_RADAR_DETECT(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x50, r2, 0x2, 0x4, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x5, 0x50}}}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x14}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_CHANNEL_WIDTH={0x8}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xc}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xffff}]}, 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x4040) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$IMSETDEVNAME(r1, 0x80184947, &(0x7f0000000240)={0x3f, 'syz0\x00'}) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r1) (async) sendmsg$NL80211_CMD_NEW_MPATH(r3, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x70, r4, 0x400, 0x70bd2b, 0x25dfdbfe, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}]}, 0x70}, 0x1, 0x0, 0x0, 0x41}, 0x10) (async) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000000)) (async) ioctl$SG_SET_DEBUG(0xffffffffffffffff, 0x227e, &(0x7f0000000500)) (async) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0), 0x801, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) sendmsg$NL80211_CMD_RADAR_DETECT(r6, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r7, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x36}]}, 0x24}}, 0x0) (async) sendmsg$NL80211_CMD_SET_COALESCE(r5, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x3c, r7, 0x2, 0x70bd2c, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x5, 0x13}}}}, [@NL80211_ATTR_COALESCE_RULE_PKT_PATTERN={0x4}, @NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0x5}, @NL80211_ATTR_COALESCE_RULE_CONDITION={0x8, 0x2, 0x1}, @NL80211_ATTR_COALESCE_RULE_CONDITION={0x8, 0x2, 0x1}]}, 0x3c}}, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r8, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_SYNC(r8, 0x4) (async) 20:27:12 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000200000001"], 0x1c}}, 0x0) 20:27:12 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000300000001"], 0x1c}}, 0x0) 20:27:12 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000400000001"], 0x1c}}, 0x0) [ 2124.054678][T32031] should_fail+0x23c/0x250 [ 2124.059108][T32031] should_fail_usercopy+0x16/0x20 [ 2124.064146][T32031] _copy_to_user+0x1c/0x90 [ 2124.068627][T32031] simple_read_from_buffer+0xab/0x120 [ 2124.074027][T32031] proc_fail_nth_read+0x10d/0x150 [ 2124.079142][T32031] ? proc_fault_inject_write+0x230/0x230 [ 2124.084861][T32031] vfs_read+0x1e6/0x750 [ 2124.089029][T32031] ? __fget_files+0x1d2/0x210 [ 2124.093749][T32031] ksys_read+0xd9/0x190 [ 2124.097947][T32031] __x64_sys_read+0x3e/0x50 [ 2124.102466][T32031] do_syscall_64+0x44/0xd0 [ 2124.106932][T32031] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2124.112847][T32031] RIP: 0033:0x7f2fe4d41c0c [ 2124.117263][T32031] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 [ 2124.136903][T32031] RSP: 002b:00007f2fe3f05160 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2124.145316][T32031] RAX: ffffffffffffffda RBX: 00007f2fe4ea1f60 RCX: 00007f2fe4d41c0c 20:27:12 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) 20:27:12 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000500000001"], 0x1c}}, 0x0) 20:27:12 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = socket(0x11, 0xa, 0x8) (async, rerun: 64) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) (rerun: 64) sendmsg$NL80211_CMD_RADAR_DETECT(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x50, r2, 0x2, 0x4, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x5, 0x50}}}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x14}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_CHANNEL_WIDTH={0x8}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xc}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xffff}]}, 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x4040) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$IMSETDEVNAME(r1, 0x80184947, &(0x7f0000000240)={0x3f, 'syz0\x00'}) (async) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r1) sendmsg$NL80211_CMD_NEW_MPATH(r3, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x70, r4, 0x400, 0x70bd2b, 0x25dfdbfe, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}]}, 0x70}, 0x1, 0x0, 0x0, 0x41}, 0x10) (async) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000000)) ioctl$SG_SET_DEBUG(0xffffffffffffffff, 0x227e, &(0x7f0000000500)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0), 0x801, 0x0) (async, rerun: 32) r6 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r6, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r7, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x36}]}, 0x24}}, 0x0) (async) sendmsg$NL80211_CMD_SET_COALESCE(r5, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x3c, r7, 0x2, 0x70bd2c, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x5, 0x13}}}}, [@NL80211_ATTR_COALESCE_RULE_PKT_PATTERN={0x4}, @NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0x5}, @NL80211_ATTR_COALESCE_RULE_CONDITION={0x8, 0x2, 0x1}, @NL80211_ATTR_COALESCE_RULE_CONDITION={0x8, 0x2, 0x1}]}, 0x3c}}, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) r8 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r8, 0x0, 0x0) (async, rerun: 32) ioctl$SCSI_IOCTL_SYNC(r8, 0x4) (rerun: 32) 20:27:12 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x40c640, 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r1, 0x2) r2 = syz_open_dev$sg(&(0x7f0000000040), 0x6, 0x400) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) (async) ioctl$SG_EMULATED_HOST(r3, 0x2203, &(0x7f00000000c0)) ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f0000000000)) 20:27:12 executing program 5: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x240002, 0x0) ioctl$EVIOCGABS3F(r0, 0x8018457f, &(0x7f0000000040)=""/179) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(0xffffffffffffffff, 0x84, 0x21, &(0x7f0000000100)=0x9, 0x4) (async) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x1267, 0x0) 20:27:12 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$EVIOCSCLOCKID(0xffffffffffffffff, 0x400445a0, &(0x7f0000000040)=0x8000) ioctl$BINDER_GET_FROZEN_INFO(0xffffffffffffffff, 0xc00c620f, &(0x7f0000000080)={0xffffffffffffffff}) 20:27:12 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000600000001"], 0x1c}}, 0x0) 20:27:12 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x40c640, 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r1, 0x2) (async) r2 = syz_open_dev$sg(&(0x7f0000000040), 0x6, 0x400) (async) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) (async) ioctl$SG_EMULATED_HOST(r3, 0x2203, &(0x7f00000000c0)) (async) ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f0000000000)) [ 2124.153281][T32031] RDX: 000000000000000f RSI: 00007f2fe3f051e0 RDI: 0000000000000003 [ 2124.161294][T32031] RBP: 00007f2fe3f051d0 R08: 0000000000000000 R09: 0000000000000000 [ 2124.169267][T32031] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2124.177242][T32031] R13: 00007fff233cfdaf R14: 00007f2fe3f05300 R15: 0000000000022000 [ 2124.185292][T32031] 20:27:12 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) ioctl$SG_NEXT_CMD_LEN(r1, 0x2283, &(0x7f0000000040)=0x8) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:27:12 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async, rerun: 32) ioctl$EVIOCSCLOCKID(0xffffffffffffffff, 0x400445a0, &(0x7f0000000040)=0x8000) (rerun: 32) ioctl$BINDER_GET_FROZEN_INFO(0xffffffffffffffff, 0xc00c620f, &(0x7f0000000080)={0xffffffffffffffff}) 20:27:12 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x90000, 0x0) ioctl$EVIOCGMASK(r1, 0x80104592, &(0x7f0000000140)={0x2, 0xd2, &(0x7f0000000040)="764e46ef08403d7aa7e973991eb8ba7cb105b1bf02dc6a9b3578ea3606f3a4bd475fc370bdd2195e3c64df6df99252780922a54285dc114d904c27d750da7124e9b6e2c3838939f74f7d16c544f5c9f973bfcdd3aa26e3a5e5f74f1f99163050a7b085ae039c9cb93e683602e577f9ad6bcfbfadbe98658bd615d7394ab8f6bcc569af7e6ec27fa73ce039d0ddf302054bacc5592d6977d81bc0f7a3fa4d7aa9d38745de646c187bdba6802f86bfb3a36a5febfd948a984af34651aceb90bfa5beebdc78f25455593368af0c84a44cf47ad5"}) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:27:12 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x2, 0x82) 20:27:12 executing program 1: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x123000, 0x0) write$vga_arbiter(r0, 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x80) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x10000) ioctl$SCSI_IOCTL_SYNC(r2, 0x4) ioctl$SG_GET_COMMAND_Q(r1, 0x1274, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x94902, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r3, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r4, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x36}]}, 0x24}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r6 = bpf$ITER_CREATE(0x21, &(0x7f0000000240)={r0}, 0x8) sendmsg$NL80211_CMD_RADAR_DETECT(r6, &(0x7f00000001c0)={&(0x7f0000000200), 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x30, r4, 0x400, 0x70bd2c, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r5}, @val={0xc, 0x99, {0x8000, 0x71}}}}, [@NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x3c5}]}, 0x30}, 0x1, 0x0, 0x0, 0x20040840}, 0x4000) 20:27:12 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x90000, 0x0) ioctl$EVIOCGMASK(r1, 0x80104592, &(0x7f0000000140)={0x2, 0xd2, &(0x7f0000000040)="764e46ef08403d7aa7e973991eb8ba7cb105b1bf02dc6a9b3578ea3606f3a4bd475fc370bdd2195e3c64df6df99252780922a54285dc114d904c27d750da7124e9b6e2c3838939f74f7d16c544f5c9f973bfcdd3aa26e3a5e5f74f1f99163050a7b085ae039c9cb93e683602e577f9ad6bcfbfadbe98658bd615d7394ab8f6bcc569af7e6ec27fa73ce039d0ddf302054bacc5592d6977d81bc0f7a3fa4d7aa9d38745de646c187bdba6802f86bfb3a36a5febfd948a984af34651aceb90bfa5beebdc78f25455593368af0c84a44cf47ad5"}) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:27:12 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000700000001"], 0x1c}}, 0x0) 20:27:12 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000800000001"], 0x1c}}, 0x0) 20:27:12 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x3, 0x82) 20:27:12 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000900000001"], 0x1c}}, 0x0) 20:27:12 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x4, 0x82) 20:27:12 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000a00000001"], 0x1c}}, 0x0) 20:27:13 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) ioctl$SG_NEXT_CMD_LEN(r1, 0x2283, &(0x7f0000000040)=0x8) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:27:13 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x6, 0x82) 20:27:13 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000b00000001"], 0x1c}}, 0x0) 20:27:13 executing program 3: ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000040)) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000080)) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xac8, 0x30000) ioctl$EVIOCGLED(r1, 0x80404519, &(0x7f0000000100)=""/183) 20:27:13 executing program 1: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x123000, 0x0) write$vga_arbiter(r0, 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x80) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x10000) ioctl$SCSI_IOCTL_SYNC(r2, 0x4) ioctl$SG_GET_COMMAND_Q(r1, 0x1274, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x94902, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r3, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r4, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x36}]}, 0x24}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r6 = bpf$ITER_CREATE(0x21, &(0x7f0000000240)={r0}, 0x8) sendmsg$NL80211_CMD_RADAR_DETECT(r6, &(0x7f00000001c0)={&(0x7f0000000200), 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x30, r4, 0x400, 0x70bd2c, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r5}, @val={0xc, 0x99, {0x8000, 0x71}}}}, [@NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x3c5}]}, 0x30}, 0x1, 0x0, 0x0, 0x20040840}, 0x4000) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x123000, 0x0) (async) write$vga_arbiter(r0, 0x0, 0x0) (async) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x80) (async) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x10000) (async) ioctl$SCSI_IOCTL_SYNC(r2, 0x4) (async) ioctl$SG_GET_COMMAND_Q(r1, 0x1274, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x94902, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) sendmsg$NL80211_CMD_RADAR_DETECT(r3, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r4, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x36}]}, 0x24}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00'}) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000240)={r0}, 0x8) (async) sendmsg$NL80211_CMD_RADAR_DETECT(r6, &(0x7f00000001c0)={&(0x7f0000000200), 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x30, r4, 0x400, 0x70bd2c, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r5}, @val={0xc, 0x99, {0x8000, 0x71}}}}, [@NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x3c5}]}, 0x30}, 0x1, 0x0, 0x0, 0x20040840}, 0x4000) (async) 20:27:13 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x90000, 0x0) ioctl$EVIOCGMASK(r1, 0x80104592, &(0x7f0000000140)={0x2, 0xd2, &(0x7f0000000040)="764e46ef08403d7aa7e973991eb8ba7cb105b1bf02dc6a9b3578ea3606f3a4bd475fc370bdd2195e3c64df6df99252780922a54285dc114d904c27d750da7124e9b6e2c3838939f74f7d16c544f5c9f973bfcdd3aa26e3a5e5f74f1f99163050a7b085ae039c9cb93e683602e577f9ad6bcfbfadbe98658bd615d7394ab8f6bcc569af7e6ec27fa73ce039d0ddf302054bacc5592d6977d81bc0f7a3fa4d7aa9d38745de646c187bdba6802f86bfb3a36a5febfd948a984af34651aceb90bfa5beebdc78f25455593368af0c84a44cf47ad5"}) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x90000, 0x0) (async) ioctl$EVIOCGMASK(r1, 0x80104592, &(0x7f0000000140)={0x2, 0xd2, &(0x7f0000000040)="764e46ef08403d7aa7e973991eb8ba7cb105b1bf02dc6a9b3578ea3606f3a4bd475fc370bdd2195e3c64df6df99252780922a54285dc114d904c27d750da7124e9b6e2c3838939f74f7d16c544f5c9f973bfcdd3aa26e3a5e5f74f1f99163050a7b085ae039c9cb93e683602e577f9ad6bcfbfadbe98658bd615d7394ab8f6bcc569af7e6ec27fa73ce039d0ddf302054bacc5592d6977d81bc0f7a3fa4d7aa9d38745de646c187bdba6802f86bfb3a36a5febfd948a984af34651aceb90bfa5beebdc78f25455593368af0c84a44cf47ad5"}) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) 20:27:13 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async, rerun: 64) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) (rerun: 64) ioctl$SG_NEXT_CMD_LEN(r1, 0x2283, &(0x7f0000000040)=0x8) (async, rerun: 64) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (rerun: 64) 20:27:13 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x18, 0x82) 20:27:13 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000c00000001"], 0x1c}}, 0x0) 20:27:13 executing program 3: ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000040)) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000080)) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xac8, 0x30000) ioctl$EVIOCGLED(r1, 0x80404519, &(0x7f0000000100)=""/183) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000040)) (async) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r0, 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000080)) (async) syz_open_dev$evdev(&(0x7f00000000c0), 0xac8, 0x30000) (async) ioctl$EVIOCGLED(r1, 0x80404519, &(0x7f0000000100)=""/183) (async) 20:27:13 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x300, 0x82) 20:27:13 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_GET_PCI(r0, 0x5387, &(0x7f0000000080)) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x200000) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000040)) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:27:13 executing program 1: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x123000, 0x0) write$vga_arbiter(r0, 0x0, 0x0) (async) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x80) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x10000) (async) ioctl$SCSI_IOCTL_SYNC(r2, 0x4) ioctl$SG_GET_COMMAND_Q(r1, 0x1274, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x94902, 0x0) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r3, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r4, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x36}]}, 0x24}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) (async) r6 = bpf$ITER_CREATE(0x21, &(0x7f0000000240)={r0}, 0x8) sendmsg$NL80211_CMD_RADAR_DETECT(r6, &(0x7f00000001c0)={&(0x7f0000000200), 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x30, r4, 0x400, 0x70bd2c, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r5}, @val={0xc, 0x99, {0x8000, 0x71}}}}, [@NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x3c5}]}, 0x30}, 0x1, 0x0, 0x0, 0x20040840}, 0x4000) 20:27:13 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000d00000001"], 0x1c}}, 0x0) 20:27:13 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x600, 0x82) 20:27:13 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x2, 0x80200) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x800000000000014, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) setsockopt$bt_hci_HCI_FILTER(r3, 0x0, 0x2, &(0x7f0000000100)={0xfff, [0x0, 0x3ff], 0x48dd}, 0x10) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r4, 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r4, 0x227d, &(0x7f0000000080)) 20:27:13 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000e00000001"], 0x1c}}, 0x0) 20:27:13 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r2, 0x5) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SCSI_IOCTL_GET_PCI(r0, 0x5387, &(0x7f00000000c0)) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0xfffffffffffffebf) ioctl$SG_EMULATED_HOST(r3, 0x2203, &(0x7f0000000080)) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000000)={r1, r1, 0xf}, 0x10) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) 20:27:13 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x1800, 0x82) 20:27:13 executing program 3: ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000040)) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000080)) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xac8, 0x30000) ioctl$EVIOCGLED(r1, 0x80404519, &(0x7f0000000100)=""/183) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000040)) (async) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r0, 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000080)) (async) syz_open_dev$evdev(&(0x7f00000000c0), 0xac8, 0x30000) (async) ioctl$EVIOCGLED(r1, 0x80404519, &(0x7f0000000100)=""/183) (async) 20:27:13 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_GET_PCI(r0, 0x5387, &(0x7f0000000080)) (async) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x200000) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000040)) (async, rerun: 32) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (rerun: 32) 20:27:13 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x2, 0x80200) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x800000000000014, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) setsockopt$bt_hci_HCI_FILTER(r3, 0x0, 0x2, &(0x7f0000000100)={0xfff, [0x0, 0x3ff], 0x48dd}, 0x10) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r4, 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r4, 0x227d, &(0x7f0000000080)) syz_open_dev$sg(&(0x7f0000000380), 0x2, 0x80200) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) syz_open_dev$sg(&(0x7f0000000000), 0x800000000000014, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r2, 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r3, 0x0, 0x0) (async) setsockopt$bt_hci_HCI_FILTER(r3, 0x0, 0x2, &(0x7f0000000100)={0xfff, [0x0, 0x3ff], 0x48dd}, 0x10) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r4, 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r4, 0x227d, &(0x7f0000000080)) (async) 20:27:13 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x2000, 0x82) 20:27:13 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r2, 0x5) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_GET_PCI(r0, 0x5387, &(0x7f00000000c0)) (async) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0xfffffffffffffebf) (async) ioctl$SG_EMULATED_HOST(r3, 0x2203, &(0x7f0000000080)) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000000)={r1, r1, 0xf}, 0x10) (async) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) 20:27:13 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000f00000001"], 0x1c}}, 0x0) 20:27:13 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_GET_PCI(r0, 0x5387, &(0x7f0000000080)) (async, rerun: 32) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x200000) (rerun: 32) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000040)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:27:13 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000001000000001"], 0x1c}}, 0x0) 20:27:13 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x3f00, 0x82) 20:27:13 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x2, 0x80200) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x800000000000014, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) setsockopt$bt_hci_HCI_FILTER(r3, 0x0, 0x2, &(0x7f0000000100)={0xfff, [0x0, 0x3ff], 0x48dd}, 0x10) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r4, 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r4, 0x227d, &(0x7f0000000080)) syz_open_dev$sg(&(0x7f0000000380), 0x2, 0x80200) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) syz_open_dev$sg(&(0x7f0000000000), 0x800000000000014, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r2, 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r3, 0x0, 0x0) (async) setsockopt$bt_hci_HCI_FILTER(r3, 0x0, 0x2, &(0x7f0000000100)={0xfff, [0x0, 0x3ff], 0x48dd}, 0x10) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r4, 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r4, 0x227d, &(0x7f0000000080)) (async) 20:27:13 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x4000, 0x82) 20:27:13 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000001100000001"], 0x1c}}, 0x0) 20:27:14 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000000)={r1}, 0x8) ioctl$SG_SET_DEBUG(r2, 0x227e, &(0x7f0000000100)) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) ioctl$EVIOCGABS0(r3, 0x80184540, &(0x7f0000000080)=""/99) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:27:14 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x200000, 0x82) 20:27:14 executing program 3: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5387, &(0x7f0000000040)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) 20:27:14 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000001200000001"], 0x1c}}, 0x0) 20:27:14 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_START_UNIT(r2, 0x5) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_GET_PCI(r0, 0x5387, &(0x7f00000000c0)) (async) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0xfffffffffffffebf) (async) ioctl$SG_EMULATED_HOST(r3, 0x2203, &(0x7f0000000080)) (async) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000000)={r1, r1, 0xf}, 0x10) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) 20:27:14 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x1000000, 0x82) 20:27:14 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000000)={r1}, 0x8) ioctl$SG_SET_DEBUG(r2, 0x227e, &(0x7f0000000100)) (async) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) (async) ioctl$EVIOCGABS0(r3, 0x80184540, &(0x7f0000000080)=""/99) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:27:14 executing program 0: socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) socket$nl_audit(0x10, 0x3, 0x9) write$vga_arbiter(r0, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) r1 = syz_open_dev$sg(&(0x7f0000000000), 0xffff, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x1276, 0x0) 20:27:14 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000002500000001"], 0x1c}}, 0x0) 20:27:14 executing program 0: socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) socket$nl_audit(0x10, 0x3, 0x9) write$vga_arbiter(r0, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) r1 = syz_open_dev$sg(&(0x7f0000000000), 0xffff, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x1276, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) socket$nl_audit(0x10, 0x3, 0x9) (async) write$vga_arbiter(r0, 0x0, 0x0) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) (async) syz_open_dev$sg(&(0x7f0000000000), 0xffff, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r1, 0x1276, 0x0) (async) 20:27:14 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x2000000, 0x82) 20:27:14 executing program 3: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5387, &(0x7f0000000040)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) 20:27:14 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) clock_gettime(0x2, &(0x7f0000000080)) ioctl$SG_NEXT_CMD_LEN(r1, 0x2283, &(0x7f0000000040)=0xce) ioctl$EVIOCGABS0(r1, 0x80184540, &(0x7f00000000c0)=""/52) 20:27:14 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000000)={r1}, 0x8) ioctl$SG_SET_DEBUG(r2, 0x227e, &(0x7f0000000100)) (async) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) (async) ioctl$EVIOCGABS0(r3, 0x80184540, &(0x7f0000000080)=""/99) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:27:14 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x3000000, 0x82) 20:27:14 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000004800000001"], 0x1c}}, 0x0) 20:27:14 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:27:14 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x4000000, 0x82) 20:27:14 executing program 0: socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) socket$nl_audit(0x10, 0x3, 0x9) (async) write$vga_arbiter(r0, 0x0, 0x0) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) (async) r1 = syz_open_dev$sg(&(0x7f0000000000), 0xffff, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x1276, 0x0) 20:27:14 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000004c00000001"], 0x1c}}, 0x0) 20:27:14 executing program 3: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5387, &(0x7f0000000040)) (async) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) 20:27:14 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) (async) clock_gettime(0x2, &(0x7f0000000080)) ioctl$SG_NEXT_CMD_LEN(r1, 0x2283, &(0x7f0000000040)=0xce) ioctl$EVIOCGABS0(r1, 0x80184540, &(0x7f00000000c0)=""/52) 20:27:14 executing program 0: sendmsg$AUDIT_TRIM(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x3f6, 0x0, 0x70bd27, 0x25dfdbfb, "", ["", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x4010}, 0x800) r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_TTY(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="10000000640400050000000000000000"], 0x10}}, 0x0) sendmsg$AUDIT_TTY_SET(r0, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x18, 0x3f9, 0x100, 0x70bd27, 0x25dfdbfe, {0x1}, ["", "", "", "", "", ""]}, 0x18}, 0x1, 0x0, 0x0, 0x8009}, 0x4004000) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_SCSI_ID(r1, 0x2276, &(0x7f0000000100)) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000240), 0x8) bind$rxrpc(r2, &(0x7f0000000280)=@in4={0x21, 0x3, 0x2, 0x10, {0x2, 0x4e20, @remote}}, 0x24) ioctl$SG_GET_COMMAND_Q(r1, 0x1276, 0x0) 20:27:14 executing program 3: r0 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_CONFIG(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, r0, 0x904, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_SERVICE={0x24, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}, @IPVS_SVC_ATTR_PROTOCOL={0x6}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e21}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000080}, 0x40000) socket$inet_sctp(0x2, 0x0, 0x84) syz_open_dev$sg(&(0x7f0000000040), 0x7f, 0x521182) 20:27:14 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) clock_gettime(0x2, &(0x7f0000000080)) (async) ioctl$SG_NEXT_CMD_LEN(r1, 0x2283, &(0x7f0000000040)=0xce) ioctl$EVIOCGABS0(r1, 0x80184540, &(0x7f00000000c0)=""/52) 20:27:14 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x6000000, 0x82) 20:27:14 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000006000000001"], 0x1c}}, 0x0) 20:27:14 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) 20:27:14 executing program 0: sendmsg$AUDIT_TRIM(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x3f6, 0x0, 0x70bd27, 0x25dfdbfb, "", ["", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x4010}, 0x800) (async, rerun: 64) r0 = socket$nl_audit(0x10, 0x3, 0x9) (rerun: 64) sendmsg$AUDIT_USER_TTY(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="10000000640400050000000000000000"], 0x10}}, 0x0) (async, rerun: 32) sendmsg$AUDIT_TTY_SET(r0, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x18, 0x3f9, 0x100, 0x70bd27, 0x25dfdbfe, {0x1}, ["", "", "", "", "", ""]}, 0x18}, 0x1, 0x0, 0x0, 0x8009}, 0x4004000) (async, rerun: 32) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_SCSI_ID(r1, 0x2276, &(0x7f0000000100)) (async) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000240), 0x8) bind$rxrpc(r2, &(0x7f0000000280)=@in4={0x21, 0x3, 0x2, 0x10, {0x2, 0x4e20, @remote}}, 0x24) (async) ioctl$SG_GET_COMMAND_Q(r1, 0x1276, 0x0) 20:27:14 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5387, &(0x7f0000000080)) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:27:14 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x18000000, 0x82) 20:27:14 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5387, &(0x7f0000000080)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:27:14 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000006800000001"], 0x1c}}, 0x0) 20:27:14 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:27:14 executing program 0: sendmsg$AUDIT_TRIM(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x3f6, 0x0, 0x70bd27, 0x25dfdbfb, "", ["", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x4010}, 0x800) (async, rerun: 64) r0 = socket$nl_audit(0x10, 0x3, 0x9) (rerun: 64) sendmsg$AUDIT_USER_TTY(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="10000000640400050000000000000000"], 0x10}}, 0x0) (async) sendmsg$AUDIT_TTY_SET(r0, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x18, 0x3f9, 0x100, 0x70bd27, 0x25dfdbfe, {0x1}, ["", "", "", "", "", ""]}, 0x18}, 0x1, 0x0, 0x0, 0x8009}, 0x4004000) (async) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_SCSI_ID(r1, 0x2276, &(0x7f0000000100)) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000240), 0x8) bind$rxrpc(r2, &(0x7f0000000280)=@in4={0x21, 0x3, 0x2, 0x10, {0x2, 0x4e20, @remote}}, 0x24) (async) ioctl$SG_GET_COMMAND_Q(r1, 0x1276, 0x0) 20:27:14 executing program 3: r0 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_CONFIG(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, r0, 0x904, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_SERVICE={0x24, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}, @IPVS_SVC_ATTR_PROTOCOL={0x6}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e21}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000080}, 0x40000) socket$inet_sctp(0x2, 0x0, 0x84) syz_open_dev$sg(&(0x7f0000000040), 0x7f, 0x521182) syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), 0xffffffffffffffff) (async) sendmsg$IPVS_CMD_GET_CONFIG(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, r0, 0x904, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_SERVICE={0x24, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}, @IPVS_SVC_ATTR_PROTOCOL={0x6}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e21}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000080}, 0x40000) (async) socket$inet_sctp(0x2, 0x0, 0x84) (async) syz_open_dev$sg(&(0x7f0000000040), 0x7f, 0x521182) (async) 20:27:14 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x3f000000, 0x82) 20:27:14 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000006c00000001"], 0x1c}}, 0x0) 20:27:14 executing program 1: sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000c29bd7000fbdbdf2511000000050012000800000005001200010000000c0006000200000000000000"], 0x30}, 0x1, 0x0, 0x0, 0x20000040}, 0x94) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:27:14 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5387, &(0x7f0000000080)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:27:14 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x40000000, 0x82) 20:27:14 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000040)={&(0x7f0000000000)='./file0\x00'}, 0x10) 20:27:14 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x40000) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000000)=0x2) 20:27:14 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000007400000001"], 0x1c}}, 0x0) 20:27:14 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0xf6ffffff, 0x82) 20:27:14 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000040)={&(0x7f0000000000)='./file0\x00'}, 0x10) 20:27:14 executing program 1: sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000c29bd7000fbdbdf2511000000050012000800000005001200010000000c0006000200000000000000"], 0x30}, 0x1, 0x0, 0x0, 0x20000040}, 0x94) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000c29bd7000fbdbdf2511000000050012000800000005001200010000000c0006000200000000000000"], 0x30}, 0x1, 0x0, 0x0, 0x20000040}, 0x94) (async) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) 20:27:14 executing program 3: r0 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_CONFIG(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, r0, 0x904, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_SERVICE={0x24, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}, @IPVS_SVC_ATTR_PROTOCOL={0x6}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e21}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000080}, 0x40000) socket$inet_sctp(0x2, 0x0, 0x84) syz_open_dev$sg(&(0x7f0000000040), 0x7f, 0x521182) syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), 0xffffffffffffffff) (async) sendmsg$IPVS_CMD_GET_CONFIG(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, r0, 0x904, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_SERVICE={0x24, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}, @IPVS_SVC_ATTR_PROTOCOL={0x6}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e21}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000080}, 0x40000) (async) socket$inet_sctp(0x2, 0x0, 0x84) (async) syz_open_dev$sg(&(0x7f0000000040), 0x7f, 0x521182) (async) 20:27:14 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x40000) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000000)=0x2) 20:27:14 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000007a00000001"], 0x1c}}, 0x0) 20:27:14 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000040)={&(0x7f0000000000)='./file0\x00'}, 0x10) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000040)={&(0x7f0000000000)='./file0\x00'}, 0x10) (async) 20:27:14 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0xfffffff6, 0x82) 20:27:14 executing program 1: sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000c29bd7000fbdbdf2511000000050012000800000005001200010000000c0006000200000000000000"], 0x30}, 0x1, 0x0, 0x0, 0x20000040}, 0x94) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000c29bd7000fbdbdf2511000000050012000800000005001200010000000c0006000200000000000000"], 0x30}, 0x1, 0x0, 0x0, 0x20000040}, 0x94) (async) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) 20:27:14 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x1000000000000, 0x82) 20:27:14 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x45, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:27:14 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000003000001"], 0x1c}}, 0x0) 20:27:14 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x40000) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000000)=0x2) 20:27:14 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400), r0) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000005e00000008000300", @ANYRES32=0x0, @ANYBLOB="05001802000000e1"], 0x24}}, 0x0) sendmsg$NL80211_CMD_RADAR_DETECT(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x24, r2, 0x1, 0x70bd2b, 0x25dfdbfb, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x804}, 0x841) r3 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r3, 0x1274, 0x0) r4 = syz_open_dev$sg(&(0x7f0000000040), 0x2000000001e3, 0x6cc0c2) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r5, 0x0, 0x0) setsockopt$RXRPC_SECURITY_KEYRING(r5, 0x110, 0x2, &(0x7f0000000200)='/dev/sg#\x00', 0x9) ioctl$SG_GET_REQUEST_TABLE(r4, 0x2286, &(0x7f0000000080)) ioctl$SG_NEXT_CMD_LEN(r3, 0x2283, &(0x7f0000000000)=0xc) r6 = syz_open_dev$sg(&(0x7f0000000240), 0xffffffffafd06edb, 0x40280) r7 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r7, 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x10, r7, 0x8000000) ioctl$SG_SET_RESERVED_SIZE(r6, 0x2275, &(0x7f0000000280)=0x200) 20:27:14 executing program 5: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x80, 0x0) write$vga_arbiter(r0, 0x0, 0x0) r1 = socket(0x2b, 0x1, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000), r1) syz_genetlink_get_family_id$wireguard(&(0x7f0000000000), r0) r2 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000080)) ioctl$SG_GET_COMMAND_Q(r2, 0x1267, 0x0) 20:27:14 executing program 3: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) ioctl$EVIOCSFF(r0, 0x40304580, &(0x7f0000000080)={0x53, 0x9, 0x3f, {0x5, 0x40}, {0x9, 0x5}, @period={0x0, 0x40, 0x6, 0x4000, 0x8, {0x0, 0xff, 0xfffd, 0x3}, 0x7, &(0x7f0000000040)=[0x200, 0x9, 0x5b0e, 0x1, 0x80, 0x6, 0x8]}}) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) 20:27:14 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x45, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:27:14 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x20000000000000, 0x82) 20:27:14 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000005000001"], 0x1c}}, 0x0) 20:27:14 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400), r0) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000005e00000008000300", @ANYRES32=0x0, @ANYBLOB="05001802000000e1"], 0x24}}, 0x0) (async) sendmsg$NL80211_CMD_RADAR_DETECT(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x24, r2, 0x1, 0x70bd2b, 0x25dfdbfb, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x804}, 0x841) (async) r3 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r3, 0x1274, 0x0) r4 = syz_open_dev$sg(&(0x7f0000000040), 0x2000000001e3, 0x6cc0c2) (async) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r5, 0x0, 0x0) (async) setsockopt$RXRPC_SECURITY_KEYRING(r5, 0x110, 0x2, &(0x7f0000000200)='/dev/sg#\x00', 0x9) (async) ioctl$SG_GET_REQUEST_TABLE(r4, 0x2286, &(0x7f0000000080)) ioctl$SG_NEXT_CMD_LEN(r3, 0x2283, &(0x7f0000000000)=0xc) (async) r6 = syz_open_dev$sg(&(0x7f0000000240), 0xffffffffafd06edb, 0x40280) (async) r7 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r7, 0x0, 0x0) (async) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x10, r7, 0x8000000) (async) ioctl$SG_SET_RESERVED_SIZE(r6, 0x2275, &(0x7f0000000280)=0x200) 20:27:14 executing program 5: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x80, 0x0) write$vga_arbiter(r0, 0x0, 0x0) (async) r1 = socket(0x2b, 0x1, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000), r1) (async) syz_genetlink_get_family_id$wireguard(&(0x7f0000000000), r0) (async) r2 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000080)) ioctl$SG_GET_COMMAND_Q(r2, 0x1267, 0x0) 20:27:14 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000006000001"], 0x1c}}, 0x0) 20:27:14 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x100000000000000, 0x82) 20:27:14 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x45, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) 20:27:14 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400), r0) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000005e00000008000300", @ANYRES32=0x0, @ANYBLOB="05001802000000e1"], 0x24}}, 0x0) sendmsg$NL80211_CMD_RADAR_DETECT(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x24, r2, 0x1, 0x70bd2b, 0x25dfdbfb, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x804}, 0x841) r3 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r3, 0x1274, 0x0) r4 = syz_open_dev$sg(&(0x7f0000000040), 0x2000000001e3, 0x6cc0c2) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r5, 0x0, 0x0) setsockopt$RXRPC_SECURITY_KEYRING(r5, 0x110, 0x2, &(0x7f0000000200)='/dev/sg#\x00', 0x9) ioctl$SG_GET_REQUEST_TABLE(r4, 0x2286, &(0x7f0000000080)) ioctl$SG_NEXT_CMD_LEN(r3, 0x2283, &(0x7f0000000000)=0xc) r6 = syz_open_dev$sg(&(0x7f0000000240), 0xffffffffafd06edb, 0x40280) r7 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r7, 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x10, r7, 0x8000000) ioctl$SG_SET_RESERVED_SIZE(r6, 0x2275, &(0x7f0000000280)=0x200) socket$nl_generic(0x10, 0x3, 0x10) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000400), r0) (async) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000005e00000008000300", @ANYRES32=0x0, @ANYBLOB="05001802000000e1"], 0x24}}, 0x0) (async) sendmsg$NL80211_CMD_RADAR_DETECT(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x24, r2, 0x1, 0x70bd2b, 0x25dfdbfb, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x804}, 0x841) (async) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r3, 0x1274, 0x0) (async) syz_open_dev$sg(&(0x7f0000000040), 0x2000000001e3, 0x6cc0c2) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r5, 0x0, 0x0) (async) setsockopt$RXRPC_SECURITY_KEYRING(r5, 0x110, 0x2, &(0x7f0000000200)='/dev/sg#\x00', 0x9) (async) ioctl$SG_GET_REQUEST_TABLE(r4, 0x2286, &(0x7f0000000080)) (async) ioctl$SG_NEXT_CMD_LEN(r3, 0x2283, &(0x7f0000000000)=0xc) (async) syz_open_dev$sg(&(0x7f0000000240), 0xffffffffafd06edb, 0x40280) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r7, 0x0, 0x0) (async) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x10, r7, 0x8000000) (async) ioctl$SG_SET_RESERVED_SIZE(r6, 0x2275, &(0x7f0000000280)=0x200) (async) 20:27:14 executing program 5: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x80, 0x0) write$vga_arbiter(r0, 0x0, 0x0) (async) r1 = socket(0x2b, 0x1, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000), r1) syz_genetlink_get_family_id$wireguard(&(0x7f0000000000), r0) r2 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000080)) (async) ioctl$SG_GET_COMMAND_Q(r2, 0x1267, 0x0) 20:27:14 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0xcc2086) ioctl$SG_GET_SCSI_ID(r1, 0x2276, &(0x7f0000000040)) 20:27:14 executing program 3: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) ioctl$EVIOCSFF(r0, 0x40304580, &(0x7f0000000080)={0x53, 0x9, 0x3f, {0x5, 0x40}, {0x9, 0x5}, @period={0x0, 0x40, 0x6, 0x4000, 0x8, {0x0, 0xff, 0xfffd, 0x3}, 0x7, &(0x7f0000000040)=[0x200, 0x9, 0x5b0e, 0x1, 0x80, 0x6, 0x8]}}) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) 20:27:14 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000007000001"], 0x1c}}, 0x0) 20:27:14 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x7, 0x40403) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x400000, 0x121000) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f0000000080)=0x1) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) 20:27:14 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0xcc2086) ioctl$SG_GET_SCSI_ID(r1, 0x2276, &(0x7f0000000040)) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0xcc2086) (async) ioctl$SG_GET_SCSI_ID(r1, 0x2276, &(0x7f0000000040)) (async) 20:27:14 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x200000000000000, 0x82) 20:27:14 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000000)) 20:27:14 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) (async) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000000)) 20:27:14 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000009000001"], 0x1c}}, 0x0) 20:27:14 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x300000000000000, 0x82) 20:27:14 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0xcc2086) ioctl$SG_GET_SCSI_ID(r1, 0x2276, &(0x7f0000000040)) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0xcc2086) (async) ioctl$SG_GET_SCSI_ID(r1, 0x2276, &(0x7f0000000040)) (async) 20:27:14 executing program 3: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) ioctl$EVIOCSFF(r0, 0x40304580, &(0x7f0000000080)={0x53, 0x9, 0x3f, {0x5, 0x40}, {0x9, 0x5}, @period={0x0, 0x40, 0x6, 0x4000, 0x8, {0x0, 0xff, 0xfffd, 0x3}, 0x7, &(0x7f0000000040)=[0x200, 0x9, 0x5b0e, 0x1, 0x80, 0x6, 0x8]}}) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r0, 0x0, 0x0) (async) ioctl$EVIOCSFF(r0, 0x40304580, &(0x7f0000000080)={0x53, 0x9, 0x3f, {0x5, 0x40}, {0x9, 0x5}, @period={0x0, 0x40, 0x6, 0x4000, 0x8, {0x0, 0xff, 0xfffd, 0x3}, 0x7, &(0x7f0000000040)=[0x200, 0x9, 0x5b0e, 0x1, 0x80, 0x6, 0x8]}}) (async) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) 20:27:14 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async, rerun: 64) syz_open_dev$sg(&(0x7f0000000000), 0x7, 0x40403) (async, rerun: 64) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x400000, 0x121000) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f0000000080)=0x1) (async, rerun: 32) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) (rerun: 32) 20:27:14 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000000a000001"], 0x1c}}, 0x0) 20:27:14 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x400000000000000, 0x82) 20:27:14 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000000b000001"], 0x1c}}, 0x0) 20:27:14 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x600000000000000, 0x82) 20:27:14 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000000c000001"], 0x1c}}, 0x0) 20:27:14 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x1800000000000000, 0x82) 20:27:15 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r2, 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r3, 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000000)) (async) 20:27:15 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000000d000001"], 0x1c}}, 0x0) 20:27:15 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x3f00000000000000, 0x82) 20:27:15 executing program 3: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), r1) sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0xb0, r2, 0x300, 0x70bd2d, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_SERVICE={0x4}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x21, 0x39}}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'sh\x00'}]}, @IPVS_CMD_ATTR_DEST={0x2c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x7}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7fff}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x7}]}, @IPVS_CMD_ATTR_DEST={0x28, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e24}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@local}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x80000001}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x271}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x4}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x8000}, 0x80) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) ioctl$EVIOCSMASK(r3, 0x40104593, &(0x7f00000002c0)={0x1f, 0x86, &(0x7f0000000200)="ca114722b2196e7884b8bbf8311aa390557d381343f747ea2f5e70df96cd3b5e05e49a3a6e6e567e399eb4f139dd9452f235b8f5b9d5d1aec1903b334c005da22c65d7d43edc4d610a375df216e01106454f494d9e321aa5b39cf2c8cf497edbb6c3a7bb137d0a9ca5060a8bbf6502bdbedc2fa03a9178fa020050d5f387e971410326ffac9c"}) syz_open_dev$sg(&(0x7f0000000300), 0xffffffffffffffd8, 0xa82) 20:27:15 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x7, 0x40403) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x400000, 0x121000) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f0000000080)=0x1) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1276, 0x0) (async) syz_open_dev$sg(&(0x7f0000000000), 0x7, 0x40403) (async) syz_open_dev$sg(&(0x7f0000000040), 0x400000, 0x121000) (async) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f0000000080)=0x1) (async) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) (async) 20:27:15 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_KEEP_ORPHAN(r1, 0x2288, &(0x7f0000000000)) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:27:15 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_KEEP_ORPHAN(r1, 0x2288, &(0x7f0000000000)) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_GET_KEEP_ORPHAN(r1, 0x2288, &(0x7f0000000000)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) 20:27:15 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x4000000000000000, 0x82) 20:27:15 executing program 1: geteuid() r0 = syz_open_dev$sg(&(0x7f0000000300), 0x100000000, 0x0) syz_open_dev$sg(&(0x7f0000000100), 0x4, 0x400e00) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) sendmsg$AUDIT_LIST_RULES(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x3f5, 0x200, 0x70bd27, 0x25dfdbff, "", [""]}, 0x10}, 0x1, 0x0, 0x0, 0x8000}, 0x40000) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_TX_POWER(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000fb000018ee72263576e6760c565329bec4693800000c0000000cf0000010000000000069ed0722e4ca1d1b", @ANYRES32=0x0, @ANYBLOB], 0x28}}, 0x0) r3 = syz_open_dev$sg(&(0x7f0000000180), 0x80000001, 0x81000) ioctl$SCSI_IOCTL_SYNC(r3, 0x4) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r4, 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000240), 0x1000, 0x101100) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000004, 0x8010, r4, 0x8000000) ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000140)) 20:27:15 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_KEEP_ORPHAN(r1, 0x2288, &(0x7f0000000000)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:27:15 executing program 0: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x123000, 0x0) write$vga_arbiter(r0, 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x80) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x10000) ioctl$SCSI_IOCTL_SYNC(r2, 0x4) ioctl$SG_GET_COMMAND_Q(r1, 0x1274, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x94902, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r3, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r4, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x36}]}, 0x24}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r6 = bpf$ITER_CREATE(0x21, &(0x7f0000000240)={r0}, 0x8) sendmsg$NL80211_CMD_RADAR_DETECT(r6, &(0x7f00000001c0)={&(0x7f0000000200), 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x30, r4, 0x400, 0x70bd2c, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r5}, @val={0xc, 0x99, {0x8000, 0x71}}}}, [@NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x3c5}]}, 0x30}, 0x1, 0x0, 0x0, 0x20040840}, 0x4000) 20:27:15 executing program 3: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), r1) sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0xb0, r2, 0x300, 0x70bd2d, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_SERVICE={0x4}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x21, 0x39}}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'sh\x00'}]}, @IPVS_CMD_ATTR_DEST={0x2c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x7}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7fff}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x7}]}, @IPVS_CMD_ATTR_DEST={0x28, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e24}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@local}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x80000001}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x271}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x4}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x8000}, 0x80) (async) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) (async) ioctl$EVIOCSMASK(r3, 0x40104593, &(0x7f00000002c0)={0x1f, 0x86, &(0x7f0000000200)="ca114722b2196e7884b8bbf8311aa390557d381343f747ea2f5e70df96cd3b5e05e49a3a6e6e567e399eb4f139dd9452f235b8f5b9d5d1aec1903b334c005da22c65d7d43edc4d610a375df216e01106454f494d9e321aa5b39cf2c8cf497edbb6c3a7bb137d0a9ca5060a8bbf6502bdbedc2fa03a9178fa020050d5f387e971410326ffac9c"}) (async) syz_open_dev$sg(&(0x7f0000000300), 0xffffffffffffffd8, 0xa82) 20:27:15 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000260d000001"], 0x1c}}, 0x0) [ 2127.562341][T32511] __nla_validate_parse: 54 callbacks suppressed [ 2127.562357][T32511] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:15 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0xf6ffffff00000000, 0x82) 20:27:15 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000000e000001"], 0x1c}}, 0x0) 20:27:15 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0xffffffff00000000, 0x82) 20:27:15 executing program 3: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), r1) sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0xb0, r2, 0x300, 0x70bd2d, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_SERVICE={0x4}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x21, 0x39}}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'sh\x00'}]}, @IPVS_CMD_ATTR_DEST={0x2c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x7}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7fff}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x7}]}, @IPVS_CMD_ATTR_DEST={0x28, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e24}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@local}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x80000001}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x271}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x4}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x8000}, 0x80) (async) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) (async) ioctl$EVIOCSMASK(r3, 0x40104593, &(0x7f00000002c0)={0x1f, 0x86, &(0x7f0000000200)="ca114722b2196e7884b8bbf8311aa390557d381343f747ea2f5e70df96cd3b5e05e49a3a6e6e567e399eb4f139dd9452f235b8f5b9d5d1aec1903b334c005da22c65d7d43edc4d610a375df216e01106454f494d9e321aa5b39cf2c8cf497edbb6c3a7bb137d0a9ca5060a8bbf6502bdbedc2fa03a9178fa020050d5f387e971410326ffac9c"}) syz_open_dev$sg(&(0x7f0000000300), 0xffffffffffffffd8, 0xa82) 20:27:15 executing program 1: geteuid() (async) r0 = syz_open_dev$sg(&(0x7f0000000300), 0x100000000, 0x0) syz_open_dev$sg(&(0x7f0000000100), 0x4, 0x400e00) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) sendmsg$AUDIT_LIST_RULES(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x3f5, 0x200, 0x70bd27, 0x25dfdbff, "", [""]}, 0x10}, 0x1, 0x0, 0x0, 0x8000}, 0x40000) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_TX_POWER(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000fb000018ee72263576e6760c565329bec4693800000c0000000cf0000010000000000069ed0722e4ca1d1b", @ANYRES32=0x0, @ANYBLOB], 0x28}}, 0x0) (async) r3 = syz_open_dev$sg(&(0x7f0000000180), 0x80000001, 0x81000) ioctl$SCSI_IOCTL_SYNC(r3, 0x4) (async) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r4, 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000240), 0x1000, 0x101100) (async) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000004, 0x8010, r4, 0x8000000) (async) ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000140)) 20:27:15 executing program 0: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x123000, 0x0) write$vga_arbiter(r0, 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x80) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x10000) ioctl$SCSI_IOCTL_SYNC(r2, 0x4) ioctl$SG_GET_COMMAND_Q(r1, 0x1274, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x94902, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r3, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r4, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x36}]}, 0x24}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r6 = bpf$ITER_CREATE(0x21, &(0x7f0000000240)={r0}, 0x8) sendmsg$NL80211_CMD_RADAR_DETECT(r6, &(0x7f00000001c0)={&(0x7f0000000200), 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x30, r4, 0x400, 0x70bd2c, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r5}, @val={0xc, 0x99, {0x8000, 0x71}}}}, [@NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x3c5}]}, 0x30}, 0x1, 0x0, 0x0, 0x20040840}, 0x4000) 20:27:15 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_MCAST_RATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="200ecd503462", @ANYRES16=r1, @ANYBLOB="110025bd7000fddbdf255c0000000c009900040000006c00000008006b006801000008006b00f000000008006b007800000018006b001dca3664d9326b003c00000008006b006e000000"], 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x20000000) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000000)) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_COALESCE(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000480)={&(0x7f0000000500)={0x124, r2, 0x2, 0x70bd28, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_COALESCE_RULE_CONDITION={0x8, 0x2, 0x1}, @NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0x7fff}, @NL80211_ATTR_COALESCE_RULE_PKT_PATTERN={0xec, 0x3, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, @NL80211_PKTPAT_OFFSET={0x8}}, {0xd0, 0x0, 0x0, 0x1, @NL80211_PKTPAT_PATTERN={0xc9, 0x2, "d70e9134ad9124c696d12d5f0f6a744f10a2efcb93449cf8521bb37ef5033637c01e71a41de3b5ae7de5b6375451d8895dea205c06ad0def5f60957e937e257f579759e10bcef9ab5384443f7d68bff716febbda5fd4e1fd907dbdb138a0970a69545c9a2962e6a6a4d989c3bc4ffaa6f9a8b2dcfc91d4d99265afb60cb2b4ac5592ee7e31863b1dbf6e6476c3f024f277b378b3a11fac5e8cf2bc3bfe87e9e1c105aadeef853165a3d5e3c0a9ad0bd29fe6aaff76b5125ed0b7a215183165fe9feaadaaf8"}}, {0xc, 0x0, 0x0, 0x1, @NL80211_PKTPAT_OFFSET={0x8, 0x3, 0x8}}]}, @NL80211_ATTR_COALESCE_RULE_PKT_PATTERN={0x4}, @NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0x5}, @NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0x16}]}, 0x124}, 0x1, 0x0, 0x0, 0x24}, 0x24000800) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000000240)={'wpan0\x00'}) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r4) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x28, r5, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x28}}, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f00000004c0)={'wpan1\x00', 0x0}) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r9, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r7}]}, 0x1c}}, 0x0) sendmsg$IEEE802154_LLSEC_GETPARAMS(r3, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000240)={0x4c, r5, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4004800}, 0x8810) [ 2127.633845][T32553] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:15 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0xfffffffffffff800, 0x82) 20:27:15 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0xfffffffffffffffc, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x1000, 0xe400) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f0000000080)) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f00000000c0)) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f0000000100)={0x1000, 0x0, 0xfff, "badcfdd7ab5be85c827f0a02534c534291b3f0099ed60d99bc496e4a82518ecabe3d6211ecf8d58bbed4da2cf59cc957420ab4776c8c7b22f4d6423a9c0e1ccb90b3bf4e03b4ebfe0a3d5cdf028317cc7e3d162c91544486711ca9c43c51d047317a338d21a72e3fb5ed909cb29d295800fbbed58ee728f9b29702f6821f8af922c705dcd08d8c58d2dfd7fa55f4d4f7bf7db245fdb53eb92c8a6a69982e9b8016b166d24dcd3ae3f25f6caac390ab1a000c39136149a7e4e02e6629487b3b185d7aebb7ea158be4c085e25333fae57c5f72d7ea5238df15c92d45c69d11e5bafeaeec4f239fbabc4864507facfe36819d620216b2e25ffd350e6ae98c4f0438e7daaa97739f69669b79f5cabf95d22c946dc0568e246089a390f63a891d5e9b6544cc5f82228ec892ed6311dbd7cfc6de0134aafb1c56456a54a1158afb806492b0780af6a52a2f132eb4d78c8f43d5c14a8891fcc5452631573dba812ee8efa0bd19638e9c8ba17887fcbacb81a01994cfac4d33d444200885370e786961d1131479c97133ed328572fc04b441fbba9a5c597dd7d38ddc2dc667c16c96f8faf66b19fba7581b9920b02b33818e1d64ae444c056e01a542a2c4fa27908c584085a426895abfcb3cb71c7f2cb5cc5b227216d193452f48eb6aaff68267a469f84625e94d6c908cdc0b7d9ab0ac8c8a14e587f33e5bf8f3487aa17337553cfbf750384ff535764aae80248190af5fa51cea8099cf46817689e804bc6272ab130197c1122573e6bc425ac4d61158d7bae5f472feef4dd3ce2fcc8ddbb6780ac9fb73bb127b8678cfc17d2d622d0b680236afb1cb04e6f580c57ee7c988ed339bfdb2bf2234ece522c8a53c599107d57179a291c7b8399b3647ebe7d17f0b594c5f57f7e09845085f02f4e2b12dab41c0a3dbc88be556ec56e208c7ac9913d00d8c6d5aaa5d32c2d1981a8aa56944836276380d98ab4fecde8cb6c975678451d54edee2d26dad9d415b303361adc5bae4593c447ab47082b97ed3ba12024b3fc67eea77f3a220d1871acb41a94b773b9c2975f96be702aa49b96675e633de470ca1c64c5a400c95dbe5a8e64b37c70157fc04894cb13edd5a2adce74dca0cea770397d63883e4d165360fca58ef5c572872736fac655d52fb8570a08b74223e91b894e0c2218e079017941d0c88b4ae8c675d75d1c45ee67604d0e716ee7d0fa0ea1159483fa4505b1c3e74b2881dc0602f6b7315b0584d6fc6599c76e2af6571d6be6ff049dac864c8354ef9ac57da202a608ca1dcb49b4dca5696f83c282ba5525354d3818b801b6a10bc9e392856a6ced7f6eba72378e903ef584527982c72033452702747da8e5714b38440e9256b6a1e8b2f0541f1bd4ae06842d916268bf86db60eebe75db43ff0d0bfc64447fa60da44f5cb75aeaeb4e1320216e2703592958ff4123f1e44696992a868c2fcabbbe61251c942b2d87eaaa20edcc42041dca12a13a6710a1912465c130297680de91969697eb22dbdd0e6054dbf94c6506f975dbc18f5ea2f06020b503701ad527640871f1e1a82500bb8085461c4afa6dc9fad6b063aa894f7285178c54d222c8b6baa288ec01ad94320fad6243331c1f8f17d9888971490ca8b30adcfb9694a6549bc5e3e1da9f83155100571b720d593e573072854835dcaf7b8c303a52a6155031f59b9770b469a51d9458c6dc354588ef92ad88c46418e3f49e94cfd0aa61595fb0aaac27d22793ee5338f9a3684c261ff23750da1f4b22c9295ed1ad7c967c0f89c64d73d40bd069d69d29751d468ba84a1288e4646c83f879b479945e76ea02d3b44ff1eabfb33defa2cb9984a8a9db87ffe66840d09b20b4fd396a9797e211bde83282a89edcd595f5f425de6f8610d0b8a503a4788118f51c5fa30f0c6680344bfc23ea3967ce93e2f7f0d4f18c29bc82bb4f568f8f204401c631bacab66eb5eaae395d270de761c85b0c525c461a32e0d602651e80e79ea337c5ca335679de3f6db929a006a16a5d00d4b22de460cddec46aec08c4e6198b92043883309b737650eca882db20da74112451472ae4c5efd09d227840e0461634ccdf3bfcba4aa8325fc0c9b2bb62b98b16ee064848645e573274658c837928a6abb60e54f02dbd8105b6b4a4924cfbd19c02a1dbb947a27e5f3a85079a5d692293e20ab5ea62bc5a1774a362084ae34730c491bc01054821f8d76bfaeb71fe35225026815ccbec1f024ceee71f5e466fa21a1e7343006c6e1dc6a79bd8d20a3a63dbec13c56d88038feef29ba14a6343530c385555d1584dd07a80c282451012b2bc8362a14640bdd8d74129b00e0043da5f84dd57992cfb5fda819cdf179b3eebdae3f2dcb22e13a1ef637ee5c387ff9cccb3b9224b6d9e00a999d0cba4ea67e60c16266652bf86f96b97994a3c35d69c62027e074be720da2c1b17f2bd3f5633fd1801dd7da1f18e316487fe42895940ec6e53d642c4198b6c698ccd986e502fbd42a21e2c4628e6b589b69cda949ab404e4658562a305c6e2663030d2874e87a152e3c154df1332b8dfa29bf3244557d97afa5897eb80be206897f0ad0ac3e1a22de16cbbb17004207b5a5e246ba1ad6e863683941cc62e4d7fa8106e2ff3ec38962e0d195de04219a7117275fb7f57ba57946de7e66c77fc72eb0565b407a1c9e63b291a214a38802dbeb22510b9975b565efaa13cb8feb96271eebd476adb7231a68b4fcbafa3eeb76722c50bc10d4b50f4d3855721b82a608c7402133b0e992343ed7e4781883a015864beacdb4ce7884fe2e91dfeed78fab7dd5c02679157186133f1fa207e0139f289bb083ba890333234be53b456acb25c26a17a5f138432d82215a08d432b730ae71aa943024da1a36ffcf0b104ff8a6fd0187c98d337358fd8fbc38fae59bd870ab4e3bbafdedc47a9b1257c45bb09cfe8b227f12493d63534f0ca4b4187e3140aba2821a1f7fa7645bb02e3e469acfed386db1757abc376643125227ce2f201f50c4fcbf68e145f65af87ad1ac711317eeb989f61626031f71a31fde11b5e8b35f8acf4cc3375f740714c1a21948b1930b06a3309cdecb32ad6b03f05dda071c0252ce984f9f584b6f7ade9764b8a90392d0f7f9cf96f26626b98e700aab611c6d745764736fe891545bc280c090c93ad84c15f97d04a398623a6e6c62ea2bac5ed9fdcc72624700a50ed49fb0f9e091a14f9e4168c930fe462d20593ba1b981fbe91171bd74d65238fa3b126ecfc3ebfd1828f4f287408061f73fa1cac88d49c15ff08fae5b54ccbc01c9dbbc961b0443a0b17a8b7d0b9b55ba2b3adaa32f802720b78dd82e7bc78091a45a7bb04a0ac690a57eef49a08a29be3f9a97e2039d968119f1c4c1148e91736ec04d31332d48c5ac77d5961e5a444c2ca65fa69bd349320f078dc5cb8d9e2aaf02e49b34f2840bc9ea6fa24e2a2f1f1403a9ceed93dac6207a190046047479cde8c7585b0eff02909221b27f29e04d7fff31d6cfd0634ac6729e48dcd0e48d810e38395cb878adef7403d7227a3369ff4b829c7ceb8be4e68bafe3f44eac2ec95a038a081681d587b5ef8ccbfbfd6009128b266c0de25e5f73f678166954b848a2004469faa32e99fb04f1b3ae36b112beb383560ed6cacdf76d77856f1141e5163176466209e8d80501356f94ec5e09a9ee5cbfb6b4c75a3b7ebfa1568090009505ff659a98cc12f0d106b19c228865d712ac5fbcb45ac1ca580980a05934cf8e923ddf05245f0f4c651cbfa44aca6e535c26a1de7b837fa9649911ba6d9b108756fca526f6c8445844f0191b9943dfc78115dbe0950626e8691606aada5d5d5b9e79bc25008b3b9b3750668a16c7a19b18e878abd2fbc2f97367a8da225b1f2c7145edbd89ec40dc99a2684e73046b93c320edbb4348fab2ab624b298ef50c1993332f87f22f14826a7a15a2b9b01e27340ba60b684f6dd65448d83a76dbf86ecb3429ffdeda572f09e8de3c23e329534e6261d76ffa930d6aed83080af931d24f7cbe2f5bebc44afc1110e8aa80ad48015c23a53c07b44a68483515a2c0febaa3cfed61055308c304afbde783a0ea3c37bf816083aa3ecf64a858ea965d9bd4a7d5975cd5dd4eb451998ae29799d699572087a16414efbda8b9e97ba614a52aea782be57f2dfe0b276f34667498d5eb2b867ccc46ad551c87bfb899ac3e9e5a77cb20a1703a8415310aa0306819f7f53da21652a7197cff5c4cdff7fd8588efcd4c15c0717f72978f92c1ed264e017fd20c1836f098f3cea2652f077822074f2ff81371c60c326954fa8d7b48a2f9b5e881c7094d12aa2e82b07f8a1b8798e6808f19a60ef9e28f88d371b888f5db29449a048c4aa44df578e6b8c3c9a4f1618cab1bd9845e6e96e48c67b7710944b46fcb684a134177732df05fbc1773dab0d20a73a47ac3bda4d733443276acd389e010ddd0bf65c6ff3c1a18129fcc43eb80a1b9248f1da542c118568f9ba81c4e58fee46d27a2d4bc2bd7099b237daf07109d8291893d1af1f2184dd5d9b0be9487aa2fdfadda687ccac8c6b5f7752edbea90201598599d2723385bda221216b006d788d5fb3204dd1eb1aafa6437a88a321da73ab2b766e21c1bf029c26cd9e5166f2a9144f028d730a14c2e8837d5587b77320efe34f138bfbc80c84a58ea88640ad8a877ecf49b805ba468d8a6fe972ea4a7c89489ade17ee93b9651bd23b1cef93beca1d0f256f631ad9414a7224c6e31588d798b81e697e0342cc83437b4827a665e227f111af930b6f5ac7e22d7e79e535a7928c3e1ee4392186c359b0ebb7916dcf4e89911ecb06eba0d6e1a9ebd0a0fbbaa1695d0e71a573bf5c91f924ee178291f232a103044206088cd7b6bcb162d3f59ebedd0cd3bc0b31bd1c5b1643342bf993d88823a282ef096d76a6264740b3433b59d6d2c88af4a56e2b1669a6cf1a4bfd62902cf7b22f138bde6bd869e335db24ae65676a89342933ad1ffaababe0c4ea1750f9b0596973e6796c45d4154aabf42fc4f466507c1c75e2200def84479bc545178f777552d07e8b3625485ac49e3fc0225a6208b0c82d09b3b3945f64fe211890a2e5ee1381cd9acf0fde4baac6b146782e8b81fd4e21626f459876848266c59234bc7e7ad4fcf8366ad95eb2d6a54e9651587abff98a5330a59afa8a06d245645926ecdaea0051b1b9dd51f24d5d67822e55e68f6b0e9975f39c196595ff80c0db6a0de20e0e62bac3d69bbfd878eba0f9d97fc926acc81ea3734604181d05f1ac12cf8d727f58298bbd7d7bd8256e160b67e5aa49d69604b724145ca9afab4d988449a4f169acd3108549081c26419ea1a250bbe9a540c3ebc6a0c5a008706122e8044b7c04342e19d2d4c474969936828e9da7047fcfc1e6e8c20018428bfc7180d1bff36f53a0d91ff0ddcd2597b74b15351783f1e99b939dc5aa87ce8d920d7511bf0442a5bce59e17fa80649f3a5251e88a3a5f6bec25f2875fe9d94eb982334e6a70cb76ea16c8b95677d17a418dfcc9032053957e871863d631a5fef69c1b9ef84a6973d62ae00773c2a1b06d52fcd051f6bc3b6ea14d9c1c0f4c82c6f5393f27d9ed2350690924f0fe4e0dea4edebcda655189bad26a4c7dd7c99a9b340538da8108ca469888a8eda6944b24e5e5445640dc2043e11d1b4cca51b68ce1025396812b7081e5581fcf0e12fca9cf4df808f19362c1b13807eb0a4ed754a2f3b86938c15c0d755e9aa6646ed58d34dee335f8885f4a615e0ece585d1ebcd9056da"}) r2 = syz_open_dev$sg(&(0x7f0000001140), 0x80000000, 0x400000) ioctl$SCSI_IOCTL_GET_PCI(r2, 0x5387, &(0x7f0000001180)) 20:27:15 executing program 1: geteuid() (async) r0 = syz_open_dev$sg(&(0x7f0000000300), 0x100000000, 0x0) syz_open_dev$sg(&(0x7f0000000100), 0x4, 0x400e00) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) sendmsg$AUDIT_LIST_RULES(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x3f5, 0x200, 0x70bd27, 0x25dfdbff, "", [""]}, 0x10}, 0x1, 0x0, 0x0, 0x8000}, 0x40000) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_TX_POWER(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000fb000018ee72263576e6760c565329bec4693800000c0000000cf0000010000000000069ed0722e4ca1d1b", @ANYRES32=0x0, @ANYBLOB], 0x28}}, 0x0) (async) r3 = syz_open_dev$sg(&(0x7f0000000180), 0x80000001, 0x81000) ioctl$SCSI_IOCTL_SYNC(r3, 0x4) (async) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r4, 0x0, 0x0) (async) syz_open_dev$sg(&(0x7f0000000240), 0x1000, 0x101100) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000004, 0x8010, r4, 0x8000000) (async) ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000140)) 20:27:15 executing program 0: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), r1) sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0xb0, r2, 0x300, 0x70bd2d, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_SERVICE={0x4}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x21, 0x39}}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'sh\x00'}]}, @IPVS_CMD_ATTR_DEST={0x2c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x7}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7fff}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x7}]}, @IPVS_CMD_ATTR_DEST={0x28, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e24}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@local}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x80000001}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x271}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x4}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x8000}, 0x80) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) ioctl$EVIOCSMASK(r3, 0x40104593, &(0x7f00000002c0)={0x1f, 0x86, &(0x7f0000000200)="ca114722b2196e7884b8bbf8311aa390557d381343f747ea2f5e70df96cd3b5e05e49a3a6e6e567e399eb4f139dd9452f235b8f5b9d5d1aec1903b334c005da22c65d7d43edc4d610a375df216e01106454f494d9e321aa5b39cf2c8cf497edbb6c3a7bb137d0a9ca5060a8bbf6502bdbedc2fa03a9178fa020050d5f387e971410326ffac9c"}) syz_open_dev$sg(&(0x7f0000000300), 0xffffffffffffffd8, 0xa82) 20:27:15 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_MCAST_RATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="200ecd503462", @ANYRES16=r1, @ANYBLOB="110025bd7000fddbdf255c0000000c009900040000006c00000008006b006801000008006b00f000000008006b007800000018006b001dca3664d9326b003c00000008006b006e000000"], 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x20000000) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000000)) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_COALESCE(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000480)={&(0x7f0000000500)={0x124, r2, 0x2, 0x70bd28, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_COALESCE_RULE_CONDITION={0x8, 0x2, 0x1}, @NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0x7fff}, @NL80211_ATTR_COALESCE_RULE_PKT_PATTERN={0xec, 0x3, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, @NL80211_PKTPAT_OFFSET={0x8}}, {0xd0, 0x0, 0x0, 0x1, @NL80211_PKTPAT_PATTERN={0xc9, 0x2, "d70e9134ad9124c696d12d5f0f6a744f10a2efcb93449cf8521bb37ef5033637c01e71a41de3b5ae7de5b6375451d8895dea205c06ad0def5f60957e937e257f579759e10bcef9ab5384443f7d68bff716febbda5fd4e1fd907dbdb138a0970a69545c9a2962e6a6a4d989c3bc4ffaa6f9a8b2dcfc91d4d99265afb60cb2b4ac5592ee7e31863b1dbf6e6476c3f024f277b378b3a11fac5e8cf2bc3bfe87e9e1c105aadeef853165a3d5e3c0a9ad0bd29fe6aaff76b5125ed0b7a215183165fe9feaadaaf8"}}, {0xc, 0x0, 0x0, 0x1, @NL80211_PKTPAT_OFFSET={0x8, 0x3, 0x8}}]}, @NL80211_ATTR_COALESCE_RULE_PKT_PATTERN={0x4}, @NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0x5}, @NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0x16}]}, 0x124}, 0x1, 0x0, 0x0, 0x24}, 0x24000800) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000000240)={'wpan0\x00'}) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r4) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x28, r5, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x28}}, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f00000004c0)={'wpan1\x00', 0x0}) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r9, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r7}]}, 0x1c}}, 0x0) sendmsg$IEEE802154_LLSEC_GETPARAMS(r3, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000240)={0x4c, r5, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4004800}, 0x8810) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) sendmsg$NL80211_CMD_SET_MCAST_RATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="200ecd503462", @ANYRES16=r1, @ANYBLOB="110025bd7000fddbdf255c0000000c009900040000006c00000008006b006801000008006b00f000000008006b007800000018006b001dca3664d9326b003c00000008006b006e000000"], 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x20000000) (async) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000000)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), 0xffffffffffffffff) (async) sendmsg$NL80211_CMD_SET_COALESCE(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000480)={&(0x7f0000000500)={0x124, r2, 0x2, 0x70bd28, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_COALESCE_RULE_CONDITION={0x8, 0x2, 0x1}, @NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0x7fff}, @NL80211_ATTR_COALESCE_RULE_PKT_PATTERN={0xec, 0x3, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, @NL80211_PKTPAT_OFFSET={0x8}}, {0xd0, 0x0, 0x0, 0x1, @NL80211_PKTPAT_PATTERN={0xc9, 0x2, "d70e9134ad9124c696d12d5f0f6a744f10a2efcb93449cf8521bb37ef5033637c01e71a41de3b5ae7de5b6375451d8895dea205c06ad0def5f60957e937e257f579759e10bcef9ab5384443f7d68bff716febbda5fd4e1fd907dbdb138a0970a69545c9a2962e6a6a4d989c3bc4ffaa6f9a8b2dcfc91d4d99265afb60cb2b4ac5592ee7e31863b1dbf6e6476c3f024f277b378b3a11fac5e8cf2bc3bfe87e9e1c105aadeef853165a3d5e3c0a9ad0bd29fe6aaff76b5125ed0b7a215183165fe9feaadaaf8"}}, {0xc, 0x0, 0x0, 0x1, @NL80211_PKTPAT_OFFSET={0x8, 0x3, 0x8}}]}, @NL80211_ATTR_COALESCE_RULE_PKT_PATTERN={0x4}, @NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0x5}, @NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0x16}]}, 0x124}, 0x1, 0x0, 0x0, 0x24}, 0x24000800) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000000240)={'wpan0\x00'}) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r4) (async) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x28, r5, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x28}}, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f00000004c0)={'wpan1\x00'}) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) (async) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r9, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r7}]}, 0x1c}}, 0x0) (async) sendmsg$IEEE802154_LLSEC_GETPARAMS(r3, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000240)={0x4c, r5, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4004800}, 0x8810) (async) 20:27:15 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0xfffffffffffff800, 0x82) 20:27:15 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000000f000001"], 0x1c}}, 0x0) 20:27:15 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0xfffffffffffffffc, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x1000, 0xe400) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f0000000080)) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f00000000c0)) (async) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f0000000100)={0x1000, 0x0, 0xfff, "badcfdd7ab5be85c827f0a02534c534291b3f0099ed60d99bc496e4a82518ecabe3d6211ecf8d58bbed4da2cf59cc957420ab4776c8c7b22f4d6423a9c0e1ccb90b3bf4e03b4ebfe0a3d5cdf028317cc7e3d162c91544486711ca9c43c51d047317a338d21a72e3fb5ed909cb29d295800fbbed58ee728f9b29702f6821f8af922c705dcd08d8c58d2dfd7fa55f4d4f7bf7db245fdb53eb92c8a6a69982e9b8016b166d24dcd3ae3f25f6caac390ab1a000c39136149a7e4e02e6629487b3b185d7aebb7ea158be4c085e25333fae57c5f72d7ea5238df15c92d45c69d11e5bafeaeec4f239fbabc4864507facfe36819d620216b2e25ffd350e6ae98c4f0438e7daaa97739f69669b79f5cabf95d22c946dc0568e246089a390f63a891d5e9b6544cc5f82228ec892ed6311dbd7cfc6de0134aafb1c56456a54a1158afb806492b0780af6a52a2f132eb4d78c8f43d5c14a8891fcc5452631573dba812ee8efa0bd19638e9c8ba17887fcbacb81a01994cfac4d33d444200885370e786961d1131479c97133ed328572fc04b441fbba9a5c597dd7d38ddc2dc667c16c96f8faf66b19fba7581b9920b02b33818e1d64ae444c056e01a542a2c4fa27908c584085a426895abfcb3cb71c7f2cb5cc5b227216d193452f48eb6aaff68267a469f84625e94d6c908cdc0b7d9ab0ac8c8a14e587f33e5bf8f3487aa17337553cfbf750384ff535764aae80248190af5fa51cea8099cf46817689e804bc6272ab130197c1122573e6bc425ac4d61158d7bae5f472feef4dd3ce2fcc8ddbb6780ac9fb73bb127b8678cfc17d2d622d0b680236afb1cb04e6f580c57ee7c988ed339bfdb2bf2234ece522c8a53c599107d57179a291c7b8399b3647ebe7d17f0b594c5f57f7e09845085f02f4e2b12dab41c0a3dbc88be556ec56e208c7ac9913d00d8c6d5aaa5d32c2d1981a8aa56944836276380d98ab4fecde8cb6c975678451d54edee2d26dad9d415b303361adc5bae4593c447ab47082b97ed3ba12024b3fc67eea77f3a220d1871acb41a94b773b9c2975f96be702aa49b96675e633de470ca1c64c5a400c95dbe5a8e64b37c70157fc04894cb13edd5a2adce74dca0cea770397d63883e4d165360fca58ef5c572872736fac655d52fb8570a08b74223e91b894e0c2218e079017941d0c88b4ae8c675d75d1c45ee67604d0e716ee7d0fa0ea1159483fa4505b1c3e74b2881dc0602f6b7315b0584d6fc6599c76e2af6571d6be6ff049dac864c8354ef9ac57da202a608ca1dcb49b4dca5696f83c282ba5525354d3818b801b6a10bc9e392856a6ced7f6eba72378e903ef584527982c72033452702747da8e5714b38440e9256b6a1e8b2f0541f1bd4ae06842d916268bf86db60eebe75db43ff0d0bfc64447fa60da44f5cb75aeaeb4e1320216e2703592958ff4123f1e44696992a868c2fcabbbe61251c942b2d87eaaa20edcc42041dca12a13a6710a1912465c130297680de91969697eb22dbdd0e6054dbf94c6506f975dbc18f5ea2f06020b503701ad527640871f1e1a82500bb8085461c4afa6dc9fad6b063aa894f7285178c54d222c8b6baa288ec01ad94320fad6243331c1f8f17d9888971490ca8b30adcfb9694a6549bc5e3e1da9f83155100571b720d593e573072854835dcaf7b8c303a52a6155031f59b9770b469a51d9458c6dc354588ef92ad88c46418e3f49e94cfd0aa61595fb0aaac27d22793ee5338f9a3684c261ff23750da1f4b22c9295ed1ad7c967c0f89c64d73d40bd069d69d29751d468ba84a1288e4646c83f879b479945e76ea02d3b44ff1eabfb33defa2cb9984a8a9db87ffe66840d09b20b4fd396a9797e211bde83282a89edcd595f5f425de6f8610d0b8a503a4788118f51c5fa30f0c6680344bfc23ea3967ce93e2f7f0d4f18c29bc82bb4f568f8f204401c631bacab66eb5eaae395d270de761c85b0c525c461a32e0d602651e80e79ea337c5ca335679de3f6db929a006a16a5d00d4b22de460cddec46aec08c4e6198b92043883309b737650eca882db20da74112451472ae4c5efd09d227840e0461634ccdf3bfcba4aa8325fc0c9b2bb62b98b16ee064848645e573274658c837928a6abb60e54f02dbd8105b6b4a4924cfbd19c02a1dbb947a27e5f3a85079a5d692293e20ab5ea62bc5a1774a362084ae34730c491bc01054821f8d76bfaeb71fe35225026815ccbec1f024ceee71f5e466fa21a1e7343006c6e1dc6a79bd8d20a3a63dbec13c56d88038feef29ba14a6343530c385555d1584dd07a80c282451012b2bc8362a14640bdd8d74129b00e0043da5f84dd57992cfb5fda819cdf179b3eebdae3f2dcb22e13a1ef637ee5c387ff9cccb3b9224b6d9e00a999d0cba4ea67e60c16266652bf86f96b97994a3c35d69c62027e074be720da2c1b17f2bd3f5633fd1801dd7da1f18e316487fe42895940ec6e53d642c4198b6c698ccd986e502fbd42a21e2c4628e6b589b69cda949ab404e4658562a305c6e2663030d2874e87a152e3c154df1332b8dfa29bf3244557d97afa5897eb80be206897f0ad0ac3e1a22de16cbbb17004207b5a5e246ba1ad6e863683941cc62e4d7fa8106e2ff3ec38962e0d195de04219a7117275fb7f57ba57946de7e66c77fc72eb0565b407a1c9e63b291a214a38802dbeb22510b9975b565efaa13cb8feb96271eebd476adb7231a68b4fcbafa3eeb76722c50bc10d4b50f4d3855721b82a608c7402133b0e992343ed7e4781883a015864beacdb4ce7884fe2e91dfeed78fab7dd5c02679157186133f1fa207e0139f289bb083ba890333234be53b456acb25c26a17a5f138432d82215a08d432b730ae71aa943024da1a36ffcf0b104ff8a6fd0187c98d337358fd8fbc38fae59bd870ab4e3bbafdedc47a9b1257c45bb09cfe8b227f12493d63534f0ca4b4187e3140aba2821a1f7fa7645bb02e3e469acfed386db1757abc376643125227ce2f201f50c4fcbf68e145f65af87ad1ac711317eeb989f61626031f71a31fde11b5e8b35f8acf4cc3375f740714c1a21948b1930b06a3309cdecb32ad6b03f05dda071c0252ce984f9f584b6f7ade9764b8a90392d0f7f9cf96f26626b98e700aab611c6d745764736fe891545bc280c090c93ad84c15f97d04a398623a6e6c62ea2bac5ed9fdcc72624700a50ed49fb0f9e091a14f9e4168c930fe462d20593ba1b981fbe91171bd74d65238fa3b126ecfc3ebfd1828f4f287408061f73fa1cac88d49c15ff08fae5b54ccbc01c9dbbc961b0443a0b17a8b7d0b9b55ba2b3adaa32f802720b78dd82e7bc78091a45a7bb04a0ac690a57eef49a08a29be3f9a97e2039d968119f1c4c1148e91736ec04d31332d48c5ac77d5961e5a444c2ca65fa69bd349320f078dc5cb8d9e2aaf02e49b34f2840bc9ea6fa24e2a2f1f1403a9ceed93dac6207a190046047479cde8c7585b0eff02909221b27f29e04d7fff31d6cfd0634ac6729e48dcd0e48d810e38395cb878adef7403d7227a3369ff4b829c7ceb8be4e68bafe3f44eac2ec95a038a081681d587b5ef8ccbfbfd6009128b266c0de25e5f73f678166954b848a2004469faa32e99fb04f1b3ae36b112beb383560ed6cacdf76d77856f1141e5163176466209e8d80501356f94ec5e09a9ee5cbfb6b4c75a3b7ebfa1568090009505ff659a98cc12f0d106b19c228865d712ac5fbcb45ac1ca580980a05934cf8e923ddf05245f0f4c651cbfa44aca6e535c26a1de7b837fa9649911ba6d9b108756fca526f6c8445844f0191b9943dfc78115dbe0950626e8691606aada5d5d5b9e79bc25008b3b9b3750668a16c7a19b18e878abd2fbc2f97367a8da225b1f2c7145edbd89ec40dc99a2684e73046b93c320edbb4348fab2ab624b298ef50c1993332f87f22f14826a7a15a2b9b01e27340ba60b684f6dd65448d83a76dbf86ecb3429ffdeda572f09e8de3c23e329534e6261d76ffa930d6aed83080af931d24f7cbe2f5bebc44afc1110e8aa80ad48015c23a53c07b44a68483515a2c0febaa3cfed61055308c304afbde783a0ea3c37bf816083aa3ecf64a858ea965d9bd4a7d5975cd5dd4eb451998ae29799d699572087a16414efbda8b9e97ba614a52aea782be57f2dfe0b276f34667498d5eb2b867ccc46ad551c87bfb899ac3e9e5a77cb20a1703a8415310aa0306819f7f53da21652a7197cff5c4cdff7fd8588efcd4c15c0717f72978f92c1ed264e017fd20c1836f098f3cea2652f077822074f2ff81371c60c326954fa8d7b48a2f9b5e881c7094d12aa2e82b07f8a1b8798e6808f19a60ef9e28f88d371b888f5db29449a048c4aa44df578e6b8c3c9a4f1618cab1bd9845e6e96e48c67b7710944b46fcb684a134177732df05fbc1773dab0d20a73a47ac3bda4d733443276acd389e010ddd0bf65c6ff3c1a18129fcc43eb80a1b9248f1da542c118568f9ba81c4e58fee46d27a2d4bc2bd7099b237daf07109d8291893d1af1f2184dd5d9b0be9487aa2fdfadda687ccac8c6b5f7752edbea90201598599d2723385bda221216b006d788d5fb3204dd1eb1aafa6437a88a321da73ab2b766e21c1bf029c26cd9e5166f2a9144f028d730a14c2e8837d5587b77320efe34f138bfbc80c84a58ea88640ad8a877ecf49b805ba468d8a6fe972ea4a7c89489ade17ee93b9651bd23b1cef93beca1d0f256f631ad9414a7224c6e31588d798b81e697e0342cc83437b4827a665e227f111af930b6f5ac7e22d7e79e535a7928c3e1ee4392186c359b0ebb7916dcf4e89911ecb06eba0d6e1a9ebd0a0fbbaa1695d0e71a573bf5c91f924ee178291f232a103044206088cd7b6bcb162d3f59ebedd0cd3bc0b31bd1c5b1643342bf993d88823a282ef096d76a6264740b3433b59d6d2c88af4a56e2b1669a6cf1a4bfd62902cf7b22f138bde6bd869e335db24ae65676a89342933ad1ffaababe0c4ea1750f9b0596973e6796c45d4154aabf42fc4f466507c1c75e2200def84479bc545178f777552d07e8b3625485ac49e3fc0225a6208b0c82d09b3b3945f64fe211890a2e5ee1381cd9acf0fde4baac6b146782e8b81fd4e21626f459876848266c59234bc7e7ad4fcf8366ad95eb2d6a54e9651587abff98a5330a59afa8a06d245645926ecdaea0051b1b9dd51f24d5d67822e55e68f6b0e9975f39c196595ff80c0db6a0de20e0e62bac3d69bbfd878eba0f9d97fc926acc81ea3734604181d05f1ac12cf8d727f58298bbd7d7bd8256e160b67e5aa49d69604b724145ca9afab4d988449a4f169acd3108549081c26419ea1a250bbe9a540c3ebc6a0c5a008706122e8044b7c04342e19d2d4c474969936828e9da7047fcfc1e6e8c20018428bfc7180d1bff36f53a0d91ff0ddcd2597b74b15351783f1e99b939dc5aa87ce8d920d7511bf0442a5bce59e17fa80649f3a5251e88a3a5f6bec25f2875fe9d94eb982334e6a70cb76ea16c8b95677d17a418dfcc9032053957e871863d631a5fef69c1b9ef84a6973d62ae00773c2a1b06d52fcd051f6bc3b6ea14d9c1c0f4c82c6f5393f27d9ed2350690924f0fe4e0dea4edebcda655189bad26a4c7dd7c99a9b340538da8108ca469888a8eda6944b24e5e5445640dc2043e11d1b4cca51b68ce1025396812b7081e5581fcf0e12fca9cf4df808f19362c1b13807eb0a4ed754a2f3b86938c15c0d755e9aa6646ed58d34dee335f8885f4a615e0ece585d1ebcd9056da"}) (async) r2 = syz_open_dev$sg(&(0x7f0000001140), 0x80000000, 0x400000) ioctl$SCSI_IOCTL_GET_PCI(r2, 0x5387, &(0x7f0000001180)) [ 2127.684608][T32568] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:15 executing program 0: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$EVIOCSCLOCKID(0xffffffffffffffff, 0x400445a0, &(0x7f0000000040)=0x8000) ioctl$BINDER_GET_FROZEN_INFO(0xffffffffffffffff, 0xc00c620f, &(0x7f0000000080)={0xffffffffffffffff}) 20:27:15 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r0, 0x2) 20:27:15 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0xfffffffffffff800, 0x82) 20:27:15 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r0, 0x2) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r0, 0x2) (async) 20:27:15 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0xfffffffffffffffc, 0x0) (async) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x1000, 0xe400) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f0000000080)) (async) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f00000000c0)) (async) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f0000000100)={0x1000, 0x0, 0xfff, "badcfdd7ab5be85c827f0a02534c534291b3f0099ed60d99bc496e4a82518ecabe3d6211ecf8d58bbed4da2cf59cc957420ab4776c8c7b22f4d6423a9c0e1ccb90b3bf4e03b4ebfe0a3d5cdf028317cc7e3d162c91544486711ca9c43c51d047317a338d21a72e3fb5ed909cb29d295800fbbed58ee728f9b29702f6821f8af922c705dcd08d8c58d2dfd7fa55f4d4f7bf7db245fdb53eb92c8a6a69982e9b8016b166d24dcd3ae3f25f6caac390ab1a000c39136149a7e4e02e6629487b3b185d7aebb7ea158be4c085e25333fae57c5f72d7ea5238df15c92d45c69d11e5bafeaeec4f239fbabc4864507facfe36819d620216b2e25ffd350e6ae98c4f0438e7daaa97739f69669b79f5cabf95d22c946dc0568e246089a390f63a891d5e9b6544cc5f82228ec892ed6311dbd7cfc6de0134aafb1c56456a54a1158afb806492b0780af6a52a2f132eb4d78c8f43d5c14a8891fcc5452631573dba812ee8efa0bd19638e9c8ba17887fcbacb81a01994cfac4d33d444200885370e786961d1131479c97133ed328572fc04b441fbba9a5c597dd7d38ddc2dc667c16c96f8faf66b19fba7581b9920b02b33818e1d64ae444c056e01a542a2c4fa27908c584085a426895abfcb3cb71c7f2cb5cc5b227216d193452f48eb6aaff68267a469f84625e94d6c908cdc0b7d9ab0ac8c8a14e587f33e5bf8f3487aa17337553cfbf750384ff535764aae80248190af5fa51cea8099cf46817689e804bc6272ab130197c1122573e6bc425ac4d61158d7bae5f472feef4dd3ce2fcc8ddbb6780ac9fb73bb127b8678cfc17d2d622d0b680236afb1cb04e6f580c57ee7c988ed339bfdb2bf2234ece522c8a53c599107d57179a291c7b8399b3647ebe7d17f0b594c5f57f7e09845085f02f4e2b12dab41c0a3dbc88be556ec56e208c7ac9913d00d8c6d5aaa5d32c2d1981a8aa56944836276380d98ab4fecde8cb6c975678451d54edee2d26dad9d415b303361adc5bae4593c447ab47082b97ed3ba12024b3fc67eea77f3a220d1871acb41a94b773b9c2975f96be702aa49b96675e633de470ca1c64c5a400c95dbe5a8e64b37c70157fc04894cb13edd5a2adce74dca0cea770397d63883e4d165360fca58ef5c572872736fac655d52fb8570a08b74223e91b894e0c2218e079017941d0c88b4ae8c675d75d1c45ee67604d0e716ee7d0fa0ea1159483fa4505b1c3e74b2881dc0602f6b7315b0584d6fc6599c76e2af6571d6be6ff049dac864c8354ef9ac57da202a608ca1dcb49b4dca5696f83c282ba5525354d3818b801b6a10bc9e392856a6ced7f6eba72378e903ef584527982c72033452702747da8e5714b38440e9256b6a1e8b2f0541f1bd4ae06842d916268bf86db60eebe75db43ff0d0bfc64447fa60da44f5cb75aeaeb4e1320216e2703592958ff4123f1e44696992a868c2fcabbbe61251c942b2d87eaaa20edcc42041dca12a13a6710a1912465c130297680de91969697eb22dbdd0e6054dbf94c6506f975dbc18f5ea2f06020b503701ad527640871f1e1a82500bb8085461c4afa6dc9fad6b063aa894f7285178c54d222c8b6baa288ec01ad94320fad6243331c1f8f17d9888971490ca8b30adcfb9694a6549bc5e3e1da9f83155100571b720d593e573072854835dcaf7b8c303a52a6155031f59b9770b469a51d9458c6dc354588ef92ad88c46418e3f49e94cfd0aa61595fb0aaac27d22793ee5338f9a3684c261ff23750da1f4b22c9295ed1ad7c967c0f89c64d73d40bd069d69d29751d468ba84a1288e4646c83f879b479945e76ea02d3b44ff1eabfb33defa2cb9984a8a9db87ffe66840d09b20b4fd396a9797e211bde83282a89edcd595f5f425de6f8610d0b8a503a4788118f51c5fa30f0c6680344bfc23ea3967ce93e2f7f0d4f18c29bc82bb4f568f8f204401c631bacab66eb5eaae395d270de761c85b0c525c461a32e0d602651e80e79ea337c5ca335679de3f6db929a006a16a5d00d4b22de460cddec46aec08c4e6198b92043883309b737650eca882db20da74112451472ae4c5efd09d227840e0461634ccdf3bfcba4aa8325fc0c9b2bb62b98b16ee064848645e573274658c837928a6abb60e54f02dbd8105b6b4a4924cfbd19c02a1dbb947a27e5f3a85079a5d692293e20ab5ea62bc5a1774a362084ae34730c491bc01054821f8d76bfaeb71fe35225026815ccbec1f024ceee71f5e466fa21a1e7343006c6e1dc6a79bd8d20a3a63dbec13c56d88038feef29ba14a6343530c385555d1584dd07a80c282451012b2bc8362a14640bdd8d74129b00e0043da5f84dd57992cfb5fda819cdf179b3eebdae3f2dcb22e13a1ef637ee5c387ff9cccb3b9224b6d9e00a999d0cba4ea67e60c16266652bf86f96b97994a3c35d69c62027e074be720da2c1b17f2bd3f5633fd1801dd7da1f18e316487fe42895940ec6e53d642c4198b6c698ccd986e502fbd42a21e2c4628e6b589b69cda949ab404e4658562a305c6e2663030d2874e87a152e3c154df1332b8dfa29bf3244557d97afa5897eb80be206897f0ad0ac3e1a22de16cbbb17004207b5a5e246ba1ad6e863683941cc62e4d7fa8106e2ff3ec38962e0d195de04219a7117275fb7f57ba57946de7e66c77fc72eb0565b407a1c9e63b291a214a38802dbeb22510b9975b565efaa13cb8feb96271eebd476adb7231a68b4fcbafa3eeb76722c50bc10d4b50f4d3855721b82a608c7402133b0e992343ed7e4781883a015864beacdb4ce7884fe2e91dfeed78fab7dd5c02679157186133f1fa207e0139f289bb083ba890333234be53b456acb25c26a17a5f138432d82215a08d432b730ae71aa943024da1a36ffcf0b104ff8a6fd0187c98d337358fd8fbc38fae59bd870ab4e3bbafdedc47a9b1257c45bb09cfe8b227f12493d63534f0ca4b4187e3140aba2821a1f7fa7645bb02e3e469acfed386db1757abc376643125227ce2f201f50c4fcbf68e145f65af87ad1ac711317eeb989f61626031f71a31fde11b5e8b35f8acf4cc3375f740714c1a21948b1930b06a3309cdecb32ad6b03f05dda071c0252ce984f9f584b6f7ade9764b8a90392d0f7f9cf96f26626b98e700aab611c6d745764736fe891545bc280c090c93ad84c15f97d04a398623a6e6c62ea2bac5ed9fdcc72624700a50ed49fb0f9e091a14f9e4168c930fe462d20593ba1b981fbe91171bd74d65238fa3b126ecfc3ebfd1828f4f287408061f73fa1cac88d49c15ff08fae5b54ccbc01c9dbbc961b0443a0b17a8b7d0b9b55ba2b3adaa32f802720b78dd82e7bc78091a45a7bb04a0ac690a57eef49a08a29be3f9a97e2039d968119f1c4c1148e91736ec04d31332d48c5ac77d5961e5a444c2ca65fa69bd349320f078dc5cb8d9e2aaf02e49b34f2840bc9ea6fa24e2a2f1f1403a9ceed93dac6207a190046047479cde8c7585b0eff02909221b27f29e04d7fff31d6cfd0634ac6729e48dcd0e48d810e38395cb878adef7403d7227a3369ff4b829c7ceb8be4e68bafe3f44eac2ec95a038a081681d587b5ef8ccbfbfd6009128b266c0de25e5f73f678166954b848a2004469faa32e99fb04f1b3ae36b112beb383560ed6cacdf76d77856f1141e5163176466209e8d80501356f94ec5e09a9ee5cbfb6b4c75a3b7ebfa1568090009505ff659a98cc12f0d106b19c228865d712ac5fbcb45ac1ca580980a05934cf8e923ddf05245f0f4c651cbfa44aca6e535c26a1de7b837fa9649911ba6d9b108756fca526f6c8445844f0191b9943dfc78115dbe0950626e8691606aada5d5d5b9e79bc25008b3b9b3750668a16c7a19b18e878abd2fbc2f97367a8da225b1f2c7145edbd89ec40dc99a2684e73046b93c320edbb4348fab2ab624b298ef50c1993332f87f22f14826a7a15a2b9b01e27340ba60b684f6dd65448d83a76dbf86ecb3429ffdeda572f09e8de3c23e329534e6261d76ffa930d6aed83080af931d24f7cbe2f5bebc44afc1110e8aa80ad48015c23a53c07b44a68483515a2c0febaa3cfed61055308c304afbde783a0ea3c37bf816083aa3ecf64a858ea965d9bd4a7d5975cd5dd4eb451998ae29799d699572087a16414efbda8b9e97ba614a52aea782be57f2dfe0b276f34667498d5eb2b867ccc46ad551c87bfb899ac3e9e5a77cb20a1703a8415310aa0306819f7f53da21652a7197cff5c4cdff7fd8588efcd4c15c0717f72978f92c1ed264e017fd20c1836f098f3cea2652f077822074f2ff81371c60c326954fa8d7b48a2f9b5e881c7094d12aa2e82b07f8a1b8798e6808f19a60ef9e28f88d371b888f5db29449a048c4aa44df578e6b8c3c9a4f1618cab1bd9845e6e96e48c67b7710944b46fcb684a134177732df05fbc1773dab0d20a73a47ac3bda4d733443276acd389e010ddd0bf65c6ff3c1a18129fcc43eb80a1b9248f1da542c118568f9ba81c4e58fee46d27a2d4bc2bd7099b237daf07109d8291893d1af1f2184dd5d9b0be9487aa2fdfadda687ccac8c6b5f7752edbea90201598599d2723385bda221216b006d788d5fb3204dd1eb1aafa6437a88a321da73ab2b766e21c1bf029c26cd9e5166f2a9144f028d730a14c2e8837d5587b77320efe34f138bfbc80c84a58ea88640ad8a877ecf49b805ba468d8a6fe972ea4a7c89489ade17ee93b9651bd23b1cef93beca1d0f256f631ad9414a7224c6e31588d798b81e697e0342cc83437b4827a665e227f111af930b6f5ac7e22d7e79e535a7928c3e1ee4392186c359b0ebb7916dcf4e89911ecb06eba0d6e1a9ebd0a0fbbaa1695d0e71a573bf5c91f924ee178291f232a103044206088cd7b6bcb162d3f59ebedd0cd3bc0b31bd1c5b1643342bf993d88823a282ef096d76a6264740b3433b59d6d2c88af4a56e2b1669a6cf1a4bfd62902cf7b22f138bde6bd869e335db24ae65676a89342933ad1ffaababe0c4ea1750f9b0596973e6796c45d4154aabf42fc4f466507c1c75e2200def84479bc545178f777552d07e8b3625485ac49e3fc0225a6208b0c82d09b3b3945f64fe211890a2e5ee1381cd9acf0fde4baac6b146782e8b81fd4e21626f459876848266c59234bc7e7ad4fcf8366ad95eb2d6a54e9651587abff98a5330a59afa8a06d245645926ecdaea0051b1b9dd51f24d5d67822e55e68f6b0e9975f39c196595ff80c0db6a0de20e0e62bac3d69bbfd878eba0f9d97fc926acc81ea3734604181d05f1ac12cf8d727f58298bbd7d7bd8256e160b67e5aa49d69604b724145ca9afab4d988449a4f169acd3108549081c26419ea1a250bbe9a540c3ebc6a0c5a008706122e8044b7c04342e19d2d4c474969936828e9da7047fcfc1e6e8c20018428bfc7180d1bff36f53a0d91ff0ddcd2597b74b15351783f1e99b939dc5aa87ce8d920d7511bf0442a5bce59e17fa80649f3a5251e88a3a5f6bec25f2875fe9d94eb982334e6a70cb76ea16c8b95677d17a418dfcc9032053957e871863d631a5fef69c1b9ef84a6973d62ae00773c2a1b06d52fcd051f6bc3b6ea14d9c1c0f4c82c6f5393f27d9ed2350690924f0fe4e0dea4edebcda655189bad26a4c7dd7c99a9b340538da8108ca469888a8eda6944b24e5e5445640dc2043e11d1b4cca51b68ce1025396812b7081e5581fcf0e12fca9cf4df808f19362c1b13807eb0a4ed754a2f3b86938c15c0d755e9aa6646ed58d34dee335f8885f4a615e0ece585d1ebcd9056da"}) (async) r2 = syz_open_dev$sg(&(0x7f0000001140), 0x80000000, 0x400000) ioctl$SCSI_IOCTL_GET_PCI(r2, 0x5387, &(0x7f0000001180)) 20:27:15 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x20082) 20:27:15 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_MCAST_RATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="200ecd503462", @ANYRES16=r1, @ANYBLOB="110025bd7000fddbdf255c0000000c009900040000006c00000008006b006801000008006b00f000000008006b007800000018006b001dca3664d9326b003c00000008006b006e000000"], 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x20000000) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000000)) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_COALESCE(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000480)={&(0x7f0000000500)={0x124, r2, 0x2, 0x70bd28, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_COALESCE_RULE_CONDITION={0x8, 0x2, 0x1}, @NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0x7fff}, @NL80211_ATTR_COALESCE_RULE_PKT_PATTERN={0xec, 0x3, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, @NL80211_PKTPAT_OFFSET={0x8}}, {0xd0, 0x0, 0x0, 0x1, @NL80211_PKTPAT_PATTERN={0xc9, 0x2, "d70e9134ad9124c696d12d5f0f6a744f10a2efcb93449cf8521bb37ef5033637c01e71a41de3b5ae7de5b6375451d8895dea205c06ad0def5f60957e937e257f579759e10bcef9ab5384443f7d68bff716febbda5fd4e1fd907dbdb138a0970a69545c9a2962e6a6a4d989c3bc4ffaa6f9a8b2dcfc91d4d99265afb60cb2b4ac5592ee7e31863b1dbf6e6476c3f024f277b378b3a11fac5e8cf2bc3bfe87e9e1c105aadeef853165a3d5e3c0a9ad0bd29fe6aaff76b5125ed0b7a215183165fe9feaadaaf8"}}, {0xc, 0x0, 0x0, 0x1, @NL80211_PKTPAT_OFFSET={0x8, 0x3, 0x8}}]}, @NL80211_ATTR_COALESCE_RULE_PKT_PATTERN={0x4}, @NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0x5}, @NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0x16}]}, 0x124}, 0x1, 0x0, 0x0, 0x24}, 0x24000800) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000000240)={'wpan0\x00'}) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r4) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x28, r5, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x28}}, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f00000004c0)={'wpan1\x00', 0x0}) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r9, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r7}]}, 0x1c}}, 0x0) sendmsg$IEEE802154_LLSEC_GETPARAMS(r3, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000240)={0x4c, r5, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4004800}, 0x8810) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) sendmsg$NL80211_CMD_SET_MCAST_RATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="200ecd503462", @ANYRES16=r1, @ANYBLOB="110025bd7000fddbdf255c0000000c009900040000006c00000008006b006801000008006b00f000000008006b007800000018006b001dca3664d9326b003c00000008006b006e000000"], 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x20000000) (async) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000000)) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), 0xffffffffffffffff) (async) sendmsg$NL80211_CMD_SET_COALESCE(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000480)={&(0x7f0000000500)={0x124, r2, 0x2, 0x70bd28, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_COALESCE_RULE_CONDITION={0x8, 0x2, 0x1}, @NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0x7fff}, @NL80211_ATTR_COALESCE_RULE_PKT_PATTERN={0xec, 0x3, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, @NL80211_PKTPAT_OFFSET={0x8}}, {0xd0, 0x0, 0x0, 0x1, @NL80211_PKTPAT_PATTERN={0xc9, 0x2, "d70e9134ad9124c696d12d5f0f6a744f10a2efcb93449cf8521bb37ef5033637c01e71a41de3b5ae7de5b6375451d8895dea205c06ad0def5f60957e937e257f579759e10bcef9ab5384443f7d68bff716febbda5fd4e1fd907dbdb138a0970a69545c9a2962e6a6a4d989c3bc4ffaa6f9a8b2dcfc91d4d99265afb60cb2b4ac5592ee7e31863b1dbf6e6476c3f024f277b378b3a11fac5e8cf2bc3bfe87e9e1c105aadeef853165a3d5e3c0a9ad0bd29fe6aaff76b5125ed0b7a215183165fe9feaadaaf8"}}, {0xc, 0x0, 0x0, 0x1, @NL80211_PKTPAT_OFFSET={0x8, 0x3, 0x8}}]}, @NL80211_ATTR_COALESCE_RULE_PKT_PATTERN={0x4}, @NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0x5}, @NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0x16}]}, 0x124}, 0x1, 0x0, 0x0, 0x24}, 0x24000800) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000000240)={'wpan0\x00'}) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r4) (async) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x28, r5, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x28}}, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f00000004c0)={'wpan1\x00'}) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) (async) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r9, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r7}]}, 0x1c}}, 0x0) (async) sendmsg$IEEE802154_LLSEC_GETPARAMS(r3, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000240)={0x4c, r5, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4004800}, 0x8810) (async) 20:27:15 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = socket(0x11, 0xa, 0x8) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) sendmsg$NL80211_CMD_RADAR_DETECT(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x50, r2, 0x2, 0x4, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x5, 0x50}}}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x14}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_CHANNEL_WIDTH={0x8}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xc}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xffff}]}, 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x4040) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$IMSETDEVNAME(r1, 0x80184947, &(0x7f0000000240)={0x3f, 'syz0\x00'}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r1) sendmsg$NL80211_CMD_NEW_MPATH(r3, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x70, r4, 0x400, 0x70bd2b, 0x25dfdbfe, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}]}, 0x70}, 0x1, 0x0, 0x0, 0x41}, 0x10) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000000)) ioctl$SG_SET_DEBUG(0xffffffffffffffff, 0x227e, &(0x7f0000000500)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0), 0x801, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r6, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r7, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x36}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_SET_COALESCE(r5, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x3c, r7, 0x2, 0x70bd2c, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x5, 0x13}}}}, [@NL80211_ATTR_COALESCE_RULE_PKT_PATTERN={0x4}, @NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0x5}, @NL80211_ATTR_COALESCE_RULE_CONDITION={0x8, 0x2, 0x1}, @NL80211_ATTR_COALESCE_RULE_CONDITION={0x8, 0x2, 0x1}]}, 0x3c}}, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) r8 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r8, 0x0, 0x0) ioctl$SCSI_IOCTL_SYNC(r8, 0x4) 20:27:15 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000011000001"], 0x1c}}, 0x0) [ 2127.763873][T32590] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:15 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r0, 0x2) 20:27:15 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0xfffffffffffffffd, 0x82) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000040)) 20:27:15 executing program 5: r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) sendmsg$AUDIT_TRIM(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x10, 0x3f6, 0x200, 0x70bd2b, 0x25dfdbfb, "", ["", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x7fba7b7cf8b77ed5}, 0x40000c0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) r2 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000180), r0) sendmsg$WG_CMD_GET_DEVICE(r1, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x54, r2, 0x400, 0x70bd27, 0x25dfdbfd, {}, [@WGDEVICE_A_PRIVATE_KEY={0x24, 0x3, @a}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x1}, 0x10) r3 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r3, 0x1267, 0x0) 20:27:15 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = socket(0x11, 0xa, 0x8) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) sendmsg$NL80211_CMD_RADAR_DETECT(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x50, r2, 0x2, 0x4, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x5, 0x50}}}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x14}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_CHANNEL_WIDTH={0x8}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xc}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xffff}]}, 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x4040) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$IMSETDEVNAME(r1, 0x80184947, &(0x7f0000000240)={0x3f, 'syz0\x00'}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r1) sendmsg$NL80211_CMD_NEW_MPATH(r3, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x70, r4, 0x400, 0x70bd2b, 0x25dfdbfe, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}]}, 0x70}, 0x1, 0x0, 0x0, 0x41}, 0x10) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000000)) ioctl$SG_SET_DEBUG(0xffffffffffffffff, 0x227e, &(0x7f0000000500)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0), 0x801, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r6, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r7, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x36}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_SET_COALESCE(r5, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x3c, r7, 0x2, 0x70bd2c, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x5, 0x13}}}}, [@NL80211_ATTR_COALESCE_RULE_PKT_PATTERN={0x4}, @NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0x5}, @NL80211_ATTR_COALESCE_RULE_CONDITION={0x8, 0x2, 0x1}, @NL80211_ATTR_COALESCE_RULE_CONDITION={0x8, 0x2, 0x1}]}, 0x3c}}, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) r8 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r8, 0x0, 0x0) ioctl$SCSI_IOCTL_SYNC(r8, 0x4) 20:27:15 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x0, 0x7ff, 0x9, 0x200}, 0x48) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:27:15 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x20082) 20:27:15 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0xfffffffffffffffd, 0x82) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000040)) 20:27:15 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000012000001"], 0x1c}}, 0x0) 20:27:15 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = socket(0x11, 0xa, 0x8) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) sendmsg$NL80211_CMD_RADAR_DETECT(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x50, r2, 0x2, 0x4, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x5, 0x50}}}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x14}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_CHANNEL_WIDTH={0x8}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xc}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xffff}]}, 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x4040) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$IMSETDEVNAME(r1, 0x80184947, &(0x7f0000000240)={0x3f, 'syz0\x00'}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r1) sendmsg$NL80211_CMD_NEW_MPATH(r3, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x70, r4, 0x400, 0x70bd2b, 0x25dfdbfe, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}]}, 0x70}, 0x1, 0x0, 0x0, 0x41}, 0x10) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000000)) ioctl$SG_SET_DEBUG(0xffffffffffffffff, 0x227e, &(0x7f0000000500)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0), 0x801, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r6, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r7, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x36}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_SET_COALESCE(r5, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x3c, r7, 0x2, 0x70bd2c, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x5, 0x13}}}}, [@NL80211_ATTR_COALESCE_RULE_PKT_PATTERN={0x4}, @NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0x5}, @NL80211_ATTR_COALESCE_RULE_CONDITION={0x8, 0x2, 0x1}, @NL80211_ATTR_COALESCE_RULE_CONDITION={0x8, 0x2, 0x1}]}, 0x3c}}, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) r8 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r8, 0x0, 0x0) ioctl$SCSI_IOCTL_SYNC(r8, 0x4) 20:27:15 executing program 5: r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) sendmsg$AUDIT_TRIM(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x10, 0x3f6, 0x200, 0x70bd2b, 0x25dfdbfb, "", ["", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x7fba7b7cf8b77ed5}, 0x40000c0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) r2 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000180), r0) sendmsg$WG_CMD_GET_DEVICE(r1, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x54, r2, 0x400, 0x70bd27, 0x25dfdbfd, {}, [@WGDEVICE_A_PRIVATE_KEY={0x24, 0x3, @a}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x1}, 0x10) r3 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r3, 0x1267, 0x0) bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) (async) sendmsg$AUDIT_TRIM(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x10, 0x3f6, 0x200, 0x70bd2b, 0x25dfdbfb, "", ["", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x7fba7b7cf8b77ed5}, 0x40000c0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) syz_genetlink_get_family_id$wireguard(&(0x7f0000000180), r0) (async) sendmsg$WG_CMD_GET_DEVICE(r1, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x54, r2, 0x400, 0x70bd27, 0x25dfdbfd, {}, [@WGDEVICE_A_PRIVATE_KEY={0x24, 0x3, @a}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x1}, 0x10) (async) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r3, 0x1267, 0x0) (async) [ 2127.831921][T32640] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:15 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x20082) 20:27:15 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0xfffffffffffffffd, 0x82) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000040)) syz_open_dev$sg(&(0x7f0000000000), 0xfffffffffffffffd, 0x82) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000040)) (async) 20:27:15 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x0, 0x7ff, 0x9, 0x200}, 0x48) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:27:15 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x0, 0x7ff, 0x9, 0x200}, 0x48) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:27:15 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000025000001"], 0x1c}}, 0x0) 20:27:15 executing program 5: r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) sendmsg$AUDIT_TRIM(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x10, 0x3f6, 0x200, 0x70bd2b, 0x25dfdbfb, "", ["", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x7fba7b7cf8b77ed5}, 0x40000c0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) r2 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000180), r0) sendmsg$WG_CMD_GET_DEVICE(r1, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x54, r2, 0x400, 0x70bd27, 0x25dfdbfd, {}, [@WGDEVICE_A_PRIVATE_KEY={0x24, 0x3, @a}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x1}, 0x10) r3 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r3, 0x1267, 0x0) 20:27:15 executing program 3: syz_open_dev$sg(&(0x7f0000000040), 0x200000000000002, 0x82) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0100000000000000"], 0xb3, 0x0, &(0x7f0000000080)="253433100621f918b4b4cece852dd45c4a15277267d493c4c78e8ef9db757c3d042a6bd5981c75d97f484212d1323265febe3bec53264e4497fd18302bfcffbf8a44bc2c02e56a29dea11330f589a21e3e4d2c791bea51aa1742dfecdb5ce8ee3d813dd300607544e36a84cf7d063e5ffc12e12bcdf0600dfff70bb52a2b36a508190045c65b550a1db07eec9d6f3c6731a24bebfb77daa8fdd1a1d8455b4e6bfb1d30ea176e0baf1964290a056631cde57770"}) mmap$binder(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0xfffc) 20:27:15 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f0000000040)) 20:27:15 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = socket(0x11, 0xa, 0x8) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) sendmsg$NL80211_CMD_RADAR_DETECT(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x50, r2, 0x2, 0x4, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x5, 0x50}}}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x14}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_CHANNEL_WIDTH={0x8}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xc}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xffff}]}, 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x4040) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$IMSETDEVNAME(r1, 0x80184947, &(0x7f0000000240)={0x3f, 'syz0\x00'}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r1) sendmsg$NL80211_CMD_NEW_MPATH(r3, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x70, r4, 0x400, 0x70bd2b, 0x25dfdbfe, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}]}, 0x70}, 0x1, 0x0, 0x0, 0x41}, 0x10) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000000)) ioctl$SG_SET_DEBUG(0xffffffffffffffff, 0x227e, &(0x7f0000000500)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0), 0x801, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r6, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r7, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x36}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_SET_COALESCE(r5, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x3c, r7, 0x2, 0x70bd2c, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x5, 0x13}}}}, [@NL80211_ATTR_COALESCE_RULE_PKT_PATTERN={0x4}, @NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0x5}, @NL80211_ATTR_COALESCE_RULE_CONDITION={0x8, 0x2, 0x1}, @NL80211_ATTR_COALESCE_RULE_CONDITION={0x8, 0x2, 0x1}]}, 0x3c}}, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) r8 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r8, 0x0, 0x0) [ 2127.897450][T32656] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:15 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x8002) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000000)) 20:27:15 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f0000000040)) 20:27:15 executing program 3: syz_open_dev$sg(&(0x7f0000000040), 0x200000000000002, 0x82) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0100000000000000"], 0xb3, 0x0, &(0x7f0000000080)="253433100621f918b4b4cece852dd45c4a15277267d493c4c78e8ef9db757c3d042a6bd5981c75d97f484212d1323265febe3bec53264e4497fd18302bfcffbf8a44bc2c02e56a29dea11330f589a21e3e4d2c791bea51aa1742dfecdb5ce8ee3d813dd300607544e36a84cf7d063e5ffc12e12bcdf0600dfff70bb52a2b36a508190045c65b550a1db07eec9d6f3c6731a24bebfb77daa8fdd1a1d8455b4e6bfb1d30ea176e0baf1964290a056631cde57770"}) mmap$binder(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0xfffc) syz_open_dev$sg(&(0x7f0000000040), 0x200000000000002, 0x82) (async) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0100000000000000"], 0xb3, 0x0, &(0x7f0000000080)="253433100621f918b4b4cece852dd45c4a15277267d493c4c78e8ef9db757c3d042a6bd5981c75d97f484212d1323265febe3bec53264e4497fd18302bfcffbf8a44bc2c02e56a29dea11330f589a21e3e4d2c791bea51aa1742dfecdb5ce8ee3d813dd300607544e36a84cf7d063e5ffc12e12bcdf0600dfff70bb52a2b36a508190045c65b550a1db07eec9d6f3c6731a24bebfb77daa8fdd1a1d8455b4e6bfb1d30ea176e0baf1964290a056631cde57770"}) (async) mmap$binder(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0xfffc) (async) 20:27:15 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = socket(0x11, 0xa, 0x8) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) sendmsg$NL80211_CMD_RADAR_DETECT(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x50, r2, 0x2, 0x4, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x5, 0x50}}}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x14}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_CHANNEL_WIDTH={0x8}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xc}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xffff}]}, 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x4040) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$IMSETDEVNAME(r1, 0x80184947, &(0x7f0000000240)={0x3f, 'syz0\x00'}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r1) sendmsg$NL80211_CMD_NEW_MPATH(r3, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x70, r4, 0x400, 0x70bd2b, 0x25dfdbfe, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}]}, 0x70}, 0x1, 0x0, 0x0, 0x41}, 0x10) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000000)) ioctl$SG_SET_DEBUG(0xffffffffffffffff, 0x227e, &(0x7f0000000500)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0), 0x801, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r6, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r7, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x36}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_SET_COALESCE(r5, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x3c, r7, 0x2, 0x70bd2c, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x5, 0x13}}}}, [@NL80211_ATTR_COALESCE_RULE_PKT_PATTERN={0x4}, @NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0x5}, @NL80211_ATTR_COALESCE_RULE_CONDITION={0x8, 0x2, 0x1}, @NL80211_ATTR_COALESCE_RULE_CONDITION={0x8, 0x2, 0x1}]}, 0x3c}}, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) 20:27:15 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x8002) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000000)) 20:27:15 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x4, 0x214001) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r2 = socket$nl_audit(0x10, 0x3, 0x9) r3 = bpf$ITER_CREATE(0x21, &(0x7f00000003c0), 0x8) ioctl$SCSI_IOCTL_GET_PCI(r3, 0x5387, &(0x7f0000000400)) sendmsg$AUDIT_USER_TTY(r2, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x10}, 0x10}}, 0x0) sendmsg$AUDIT_USER_TTY(r2, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0xac, 0x464, 0x400, 0x70bd26, 0x25dfdbfd, "dd253f97343166d15bf2b9bb30d122ef01dfcc6c0c9b5926ee3bdb9e7cad079672ab16510032bb2b4ac8785321a0d8a25daa21ef775a7481f5df072e0c73b5c28c25406c91bb7403c3bb358d37a917abf170df25d1e0d4d25bc196e2763d3d7a436a8b73e70ce4900b3f677d2747cca96dc7671d55079330053b80523b13bc45bf7883f6ba2d675d83dcd1c14b32e5ee734e16ac3e7b0071485790c4", ["", "", "", "", "", ""]}, 0xac}, 0x1, 0x0, 0x0, 0x14}, 0x20008010) r4 = syz_open_dev$sg(&(0x7f00000001c0), 0x7ff, 0x8041) ioctl$SG_GET_TIMEOUT(r4, 0x2202, 0x0) write$vga_arbiter(r1, 0x0, 0x0) sendmsg$AUDIT_SET(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, 0x3e9, 0x200, 0x70bd2a, 0x25dfdbfe, {0x40, 0x1, 0x0, 0x0, 0x8, 0x1, 0x5, 0x3, 0x0, 0x1c8, 0x1}, ["", ""]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) ioctl$EVIOCGSND(r1, 0x8040451a, &(0x7f0000000000)=""/141) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:27:15 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000d26000001"], 0x1c}}, 0x0) [ 2127.957629][T32685] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:15 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f0000000040)) 20:27:15 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x4, 0x214001) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r2 = socket$nl_audit(0x10, 0x3, 0x9) r3 = bpf$ITER_CREATE(0x21, &(0x7f00000003c0), 0x8) ioctl$SCSI_IOCTL_GET_PCI(r3, 0x5387, &(0x7f0000000400)) sendmsg$AUDIT_USER_TTY(r2, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x10}, 0x10}}, 0x0) sendmsg$AUDIT_USER_TTY(r2, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0xac, 0x464, 0x400, 0x70bd26, 0x25dfdbfd, "dd253f97343166d15bf2b9bb30d122ef01dfcc6c0c9b5926ee3bdb9e7cad079672ab16510032bb2b4ac8785321a0d8a25daa21ef775a7481f5df072e0c73b5c28c25406c91bb7403c3bb358d37a917abf170df25d1e0d4d25bc196e2763d3d7a436a8b73e70ce4900b3f677d2747cca96dc7671d55079330053b80523b13bc45bf7883f6ba2d675d83dcd1c14b32e5ee734e16ac3e7b0071485790c4", ["", "", "", "", "", ""]}, 0xac}, 0x1, 0x0, 0x0, 0x14}, 0x20008010) r4 = syz_open_dev$sg(&(0x7f00000001c0), 0x7ff, 0x8041) ioctl$SG_GET_TIMEOUT(r4, 0x2202, 0x0) write$vga_arbiter(r1, 0x0, 0x0) sendmsg$AUDIT_SET(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, 0x3e9, 0x200, 0x70bd2a, 0x25dfdbfe, {0x40, 0x1, 0x0, 0x0, 0x8, 0x1, 0x5, 0x3, 0x0, 0x1c8, 0x1}, ["", ""]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) ioctl$EVIOCGSND(r1, 0x8040451a, &(0x7f0000000000)=""/141) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x4, 0x214001) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) socket$nl_audit(0x10, 0x3, 0x9) (async) bpf$ITER_CREATE(0x21, &(0x7f00000003c0), 0x8) (async) ioctl$SCSI_IOCTL_GET_PCI(r3, 0x5387, &(0x7f0000000400)) (async) sendmsg$AUDIT_USER_TTY(r2, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x10}, 0x10}}, 0x0) (async) sendmsg$AUDIT_USER_TTY(r2, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0xac, 0x464, 0x400, 0x70bd26, 0x25dfdbfd, "dd253f97343166d15bf2b9bb30d122ef01dfcc6c0c9b5926ee3bdb9e7cad079672ab16510032bb2b4ac8785321a0d8a25daa21ef775a7481f5df072e0c73b5c28c25406c91bb7403c3bb358d37a917abf170df25d1e0d4d25bc196e2763d3d7a436a8b73e70ce4900b3f677d2747cca96dc7671d55079330053b80523b13bc45bf7883f6ba2d675d83dcd1c14b32e5ee734e16ac3e7b0071485790c4", ["", "", "", "", "", ""]}, 0xac}, 0x1, 0x0, 0x0, 0x14}, 0x20008010) (async) syz_open_dev$sg(&(0x7f00000001c0), 0x7ff, 0x8041) (async) ioctl$SG_GET_TIMEOUT(r4, 0x2202, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) sendmsg$AUDIT_SET(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, 0x3e9, 0x200, 0x70bd2a, 0x25dfdbfe, {0x40, 0x1, 0x0, 0x0, 0x8, 0x1, 0x5, 0x3, 0x0, 0x1c8, 0x1}, ["", ""]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) (async) ioctl$EVIOCGSND(r1, 0x8040451a, &(0x7f0000000000)=""/141) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) 20:27:15 executing program 3: syz_open_dev$sg(&(0x7f0000000040), 0x200000000000002, 0x82) (async) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0100000000000000"], 0xb3, 0x0, &(0x7f0000000080)="253433100621f918b4b4cece852dd45c4a15277267d493c4c78e8ef9db757c3d042a6bd5981c75d97f484212d1323265febe3bec53264e4497fd18302bfcffbf8a44bc2c02e56a29dea11330f589a21e3e4d2c791bea51aa1742dfecdb5ce8ee3d813dd300607544e36a84cf7d063e5ffc12e12bcdf0600dfff70bb52a2b36a508190045c65b550a1db07eec9d6f3c6731a24bebfb77daa8fdd1a1d8455b4e6bfb1d30ea176e0baf1964290a056631cde57770"}) (async) mmap$binder(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0xfffc) 20:27:15 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x8002) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000000)) 20:27:15 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = socket(0x11, 0xa, 0x8) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) sendmsg$NL80211_CMD_RADAR_DETECT(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x50, r2, 0x2, 0x4, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x5, 0x50}}}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x14}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_CHANNEL_WIDTH={0x8}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xc}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xffff}]}, 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x4040) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$IMSETDEVNAME(r1, 0x80184947, &(0x7f0000000240)={0x3f, 'syz0\x00'}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r1) sendmsg$NL80211_CMD_NEW_MPATH(r3, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x70, r4, 0x400, 0x70bd2b, 0x25dfdbfe, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}]}, 0x70}, 0x1, 0x0, 0x0, 0x41}, 0x10) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000000)) ioctl$SG_SET_DEBUG(0xffffffffffffffff, 0x227e, &(0x7f0000000500)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0), 0x801, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r6, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r7, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x36}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_SET_COALESCE(r5, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x3c, r7, 0x2, 0x70bd2c, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x5, 0x13}}}}, [@NL80211_ATTR_COALESCE_RULE_PKT_PATTERN={0x4}, @NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0x5}, @NL80211_ATTR_COALESCE_RULE_CONDITION={0x8, 0x2, 0x1}, @NL80211_ATTR_COALESCE_RULE_CONDITION={0x8, 0x2, 0x1}]}, 0x3c}}, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:27:15 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(0xffffffffffffffff, 0x84, 0xc, &(0x7f0000000040), &(0x7f0000000080)=0x4) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f00000000c0), &(0x7f0000000100)=0x4) 20:27:16 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) ioctl$SG_GET_RESERVED_SIZE(r0, 0x2272, &(0x7f0000000040)) [ 2128.013491][T32703] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:16 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000048000001"], 0x1c}}, 0x0) 20:27:16 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x4, 0x214001) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r2 = socket$nl_audit(0x10, 0x3, 0x9) (async, rerun: 64) r3 = bpf$ITER_CREATE(0x21, &(0x7f00000003c0), 0x8) (rerun: 64) ioctl$SCSI_IOCTL_GET_PCI(r3, 0x5387, &(0x7f0000000400)) (async) sendmsg$AUDIT_USER_TTY(r2, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x10}, 0x10}}, 0x0) (async) sendmsg$AUDIT_USER_TTY(r2, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0xac, 0x464, 0x400, 0x70bd26, 0x25dfdbfd, "dd253f97343166d15bf2b9bb30d122ef01dfcc6c0c9b5926ee3bdb9e7cad079672ab16510032bb2b4ac8785321a0d8a25daa21ef775a7481f5df072e0c73b5c28c25406c91bb7403c3bb358d37a917abf170df25d1e0d4d25bc196e2763d3d7a436a8b73e70ce4900b3f677d2747cca96dc7671d55079330053b80523b13bc45bf7883f6ba2d675d83dcd1c14b32e5ee734e16ac3e7b0071485790c4", ["", "", "", "", "", ""]}, 0xac}, 0x1, 0x0, 0x0, 0x14}, 0x20008010) r4 = syz_open_dev$sg(&(0x7f00000001c0), 0x7ff, 0x8041) ioctl$SG_GET_TIMEOUT(r4, 0x2202, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) sendmsg$AUDIT_SET(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, 0x3e9, 0x200, 0x70bd2a, 0x25dfdbfe, {0x40, 0x1, 0x0, 0x0, 0x8, 0x1, 0x5, 0x3, 0x0, 0x1c8, 0x1}, ["", ""]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) (async, rerun: 32) ioctl$EVIOCGSND(r1, 0x8040451a, &(0x7f0000000000)=""/141) (rerun: 32) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:27:16 executing program 1: r0 = getpid() prlimit64(r0, 0x0, 0x0, &(0x7f0000000000)) prctl$PR_SET_PTRACER(0x59616d61, r0) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x20000) 20:27:16 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000004c000001"], 0x1c}}, 0x0) 20:27:16 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000100), 0x2, 0x0) ioctl$SG_NEXT_CMD_LEN(r1, 0x2283, &(0x7f0000000040)=0x88) pselect6(0x40, &(0x7f0000000180), &(0x7f00000002c0)={0x6}, 0x0, &(0x7f0000000380), 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000140)=0x8) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) r3 = getpid() prlimit64(r3, 0x0, 0x0, &(0x7f0000000000)) ioctl$BINDER_GET_FROZEN_INFO(r2, 0xc00c620f, &(0x7f0000000000)={r3}) 20:27:16 executing program 1: r0 = getpid() prlimit64(r0, 0x0, 0x0, &(0x7f0000000000)) prctl$PR_SET_PTRACER(0x59616d61, r0) (async, rerun: 32) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x20000) (rerun: 32) 20:27:16 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(0xffffffffffffffff, 0x84, 0xc, &(0x7f0000000040), &(0x7f0000000080)=0x4) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f00000000c0), &(0x7f0000000100)=0x4) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(0xffffffffffffffff, 0x84, 0xc, &(0x7f0000000040), &(0x7f0000000080)=0x4) (async) socket$inet6_sctp(0xa, 0x5, 0x84) (async) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) (async) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f00000000c0), &(0x7f0000000100)=0x4) (async) 20:27:16 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) ioctl$SG_GET_RESERVED_SIZE(r0, 0x2272, &(0x7f0000000040)) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r0, 0x0, 0x0) (async) ioctl$SG_GET_RESERVED_SIZE(r0, 0x2272, &(0x7f0000000040)) (async) 20:27:16 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = socket(0x11, 0xa, 0x8) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) sendmsg$NL80211_CMD_RADAR_DETECT(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x50, r2, 0x2, 0x4, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x5, 0x50}}}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x14}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_CHANNEL_WIDTH={0x8}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xc}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xffff}]}, 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x4040) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$IMSETDEVNAME(r1, 0x80184947, &(0x7f0000000240)={0x3f, 'syz0\x00'}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r1) sendmsg$NL80211_CMD_NEW_MPATH(r3, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x70, r4, 0x400, 0x70bd2b, 0x25dfdbfe, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}]}, 0x70}, 0x1, 0x0, 0x0, 0x41}, 0x10) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000000)) ioctl$SG_SET_DEBUG(0xffffffffffffffff, 0x227e, &(0x7f0000000500)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0), 0x801, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r6, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r7, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x36}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_SET_COALESCE(r5, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x3c, r7, 0x2, 0x70bd2c, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x5, 0x13}}}}, [@NL80211_ATTR_COALESCE_RULE_PKT_PATTERN={0x4}, @NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0x5}, @NL80211_ATTR_COALESCE_RULE_CONDITION={0x8, 0x2, 0x1}, @NL80211_ATTR_COALESCE_RULE_CONDITION={0x8, 0x2, 0x1}]}, 0x3c}}, 0x0) 20:27:16 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000100), 0x2, 0x0) ioctl$SG_NEXT_CMD_LEN(r1, 0x2283, &(0x7f0000000040)=0x88) pselect6(0x40, &(0x7f0000000180), &(0x7f00000002c0)={0x6}, 0x0, &(0x7f0000000380), 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000140)=0x8) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) r3 = getpid() prlimit64(r3, 0x0, 0x0, &(0x7f0000000000)) ioctl$BINDER_GET_FROZEN_INFO(r2, 0xc00c620f, &(0x7f0000000000)={r3}) syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) (async) syz_open_dev$sg(&(0x7f0000000100), 0x2, 0x0) (async) ioctl$SG_NEXT_CMD_LEN(r1, 0x2283, &(0x7f0000000040)=0x88) (async) pselect6(0x40, &(0x7f0000000180), &(0x7f00000002c0)={0x6}, 0x0, &(0x7f0000000380), 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8) (async) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000140)=0x8) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r2, 0x0, 0x0) (async) getpid() (async) prlimit64(r3, 0x0, 0x0, &(0x7f0000000000)) (async) ioctl$BINDER_GET_FROZEN_INFO(r2, 0xc00c620f, &(0x7f0000000000)={r3}) (async) [ 2128.081809][T32732] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2128.119592][T32743] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:16 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000060000001"], 0x1c}}, 0x0) 20:27:16 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = socket(0x11, 0xa, 0x8) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) sendmsg$NL80211_CMD_RADAR_DETECT(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x50, r2, 0x2, 0x4, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x5, 0x50}}}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x14}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_CHANNEL_WIDTH={0x8}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xc}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xffff}]}, 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x4040) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$IMSETDEVNAME(r1, 0x80184947, &(0x7f0000000240)={0x3f, 'syz0\x00'}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r1) sendmsg$NL80211_CMD_NEW_MPATH(r3, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x70, r4, 0x400, 0x70bd2b, 0x25dfdbfe, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}]}, 0x70}, 0x1, 0x0, 0x0, 0x41}, 0x10) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000000)) ioctl$SG_SET_DEBUG(0xffffffffffffffff, 0x227e, &(0x7f0000000500)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0), 0x801, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r5, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r6, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x36}]}, 0x24}}, 0x0) 20:27:16 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000068000001"], 0x1c}}, 0x0) 20:27:16 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000006c000001"], 0x1c}}, 0x0) 20:27:16 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000074000001"], 0x1c}}, 0x0) 20:27:16 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000007a000001"], 0x1c}}, 0x0) 20:27:16 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000100), 0x2, 0x0) ioctl$SG_NEXT_CMD_LEN(r1, 0x2283, &(0x7f0000000040)=0x88) (async) pselect6(0x40, &(0x7f0000000180), &(0x7f00000002c0)={0x6}, 0x0, &(0x7f0000000380), 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8) (async) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000140)=0x8) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) (async) r3 = getpid() prlimit64(r3, 0x0, 0x0, &(0x7f0000000000)) ioctl$BINDER_GET_FROZEN_INFO(r2, 0xc00c620f, &(0x7f0000000000)={r3}) 20:27:16 executing program 1: r0 = getpid() prlimit64(r0, 0x0, 0x0, &(0x7f0000000000)) prctl$PR_SET_PTRACER(0x59616d61, r0) (async) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x20000) 20:27:16 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(0xffffffffffffffff, 0x84, 0xc, &(0x7f0000000040), &(0x7f0000000080)=0x4) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f00000000c0), &(0x7f0000000100)=0x4) 20:27:16 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) (async) ioctl$SG_GET_RESERVED_SIZE(r0, 0x2272, &(0x7f0000000040)) 20:27:16 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000030001"], 0x1c}}, 0x0) 20:27:16 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = socket(0x11, 0xa, 0x8) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) sendmsg$NL80211_CMD_RADAR_DETECT(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x50, r2, 0x2, 0x4, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x5, 0x50}}}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x14}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_CHANNEL_WIDTH={0x8}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xc}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xffff}]}, 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x4040) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$IMSETDEVNAME(r1, 0x80184947, &(0x7f0000000240)={0x3f, 'syz0\x00'}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r1) sendmsg$NL80211_CMD_NEW_MPATH(r3, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x70, r4, 0x400, 0x70bd2b, 0x25dfdbfe, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}]}, 0x70}, 0x1, 0x0, 0x0, 0x41}, 0x10) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000000)) ioctl$SG_SET_DEBUG(0xffffffffffffffff, 0x227e, &(0x7f0000000500)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0), 0x801, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) 20:27:16 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000), r1) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:27:16 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000040030001"], 0x1c}}, 0x0) 20:27:16 executing program 1: sendmsg$AUDIT_GET(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x3e8, 0x8, 0x70bd25, 0x25dfdbfb, "", ["", "", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x24008045}, 0x1) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:27:16 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000003400001"], 0x1c}}, 0x0) 20:27:17 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = socket(0x11, 0xa, 0x8) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) sendmsg$NL80211_CMD_RADAR_DETECT(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x50, r2, 0x2, 0x4, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x5, 0x50}}}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x14}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_CHANNEL_WIDTH={0x8}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xc}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xffff}]}, 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x4040) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$IMSETDEVNAME(r1, 0x80184947, &(0x7f0000000240)={0x3f, 'syz0\x00'}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r1) sendmsg$NL80211_CMD_NEW_MPATH(r3, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x70, r4, 0x400, 0x70bd2b, 0x25dfdbfe, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}]}, 0x70}, 0x1, 0x0, 0x0, 0x41}, 0x10) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000000)) ioctl$SG_SET_DEBUG(0xffffffffffffffff, 0x227e, &(0x7f0000000500)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0), 0x801, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 20:27:17 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000), r1) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000), r1) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) 20:27:17 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x4082) 20:27:17 executing program 2: sendmsg$AUDIT_DEL_RULE(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000004c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="30040000f403000226bd7000fddbdf2501000000000000001d000000a398000009000000020000000000010009000000040000003f0000000000000007000000ff7f000001000000d4bd0000ff7f0000ff0f0000050000001f00000004000000f9ffffff0500000023080000090000000100000062000000080000000700000002000000e8000000ffffffff0900000005000000010001000400000003000000400000000200000001000000070000000900000074000000010000003f0000001a0000000600000000000080020000000008000001000000bc3fff7d0800000009000000070000001f0000000200000000000080010000001200000011950000fbffffff000000000004000005000000e30900000700000003000000010b00003f000000faffffff03000000070000000200000005000000040000000200000009000000060000003b53000001000100b5000000ffffff7ff20000000300000001800000f9ffffff050000004000000000004800090000000100010080000000030000000f0000000700000004000000070000000700000000000000090000000000008000000000000021000100000007000000ffffff7f75000000ffffffffffff00000300000000100000090000000200000003000000020000005600000004000000390a000009000000130000000400000000801b001c00000000000000400000000700000009000000e4090000030000000700000000f0ffff220000000000000000040000b54d0000e7080000070000000000008000010000040000001b000000010000000400000005000000060000000800000006000000400000002000000000000080ee010000ffff00000300000000000000f6464c7009000000000020000800000062570000040000000001000002000000810000000300000081000000010000004000000000100000ffff0000e0ffffff3f00000000000080060000004a000000ff0100000100000081000000000800008bb300000500000006000000000000000600000002000000030000005b0000000500000006000000060000000000000009000000000100000100000000fcffff00010000090000000000008000000080ff0f000002100000050000000500000000000100090000000400000006000000ff7f0000ff03000001000000030000000900000007000000040000000000000002000000ac9b0e1b00020000000400006e66747668b681f7c5573e240400000003000000060000006c0f000008000000040000007f0000004cda1817ff7f0000000000000010000009000000020000000100000009000000c40d00000200000002000000b70e000034bf000000040000000000803f000000a31e000001040000000000000500000001000000000000000300000000000080b201f806060000000100000001000000f7670000c6059a73d6f8030000537900000000000004000000000800000d000000002b5e002f6465762f73672300000000"], 0x430}, 0x1, 0x0, 0x0, 0x8041}, 0x240040c0) r0 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x38, r0, 0x4, 0x70bd28, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_SERVICE={0x1c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x17}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x4}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x24000814}, 0x80) ioctl$PTP_ENABLE_PPS(0xffffffffffffffff, 0x40043d04, 0x1) syz_open_dev$sg(&(0x7f0000000000), 0x5, 0x0) 20:27:17 executing program 1: sendmsg$AUDIT_GET(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x3e8, 0x8, 0x70bd25, 0x25dfdbfb, "", ["", "", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x24008045}, 0x1) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) sendmsg$AUDIT_GET(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x3e8, 0x8, 0x70bd25, 0x25dfdbfb, "", ["", "", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x24008045}, 0x1) (async) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) 20:27:17 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = socket(0x11, 0xa, 0x8) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) sendmsg$NL80211_CMD_RADAR_DETECT(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x50, r2, 0x2, 0x4, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x5, 0x50}}}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x14}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_CHANNEL_WIDTH={0x8}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xc}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xffff}]}, 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x4040) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$IMSETDEVNAME(r1, 0x80184947, &(0x7f0000000240)={0x3f, 'syz0\x00'}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r1) sendmsg$NL80211_CMD_NEW_MPATH(r3, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x70, r4, 0x400, 0x70bd2b, 0x25dfdbfe, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}]}, 0x70}, 0x1, 0x0, 0x0, 0x41}, 0x10) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000000)) ioctl$SG_SET_DEBUG(0xffffffffffffffff, 0x227e, &(0x7f0000000500)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0), 0x801, 0x0) 20:27:17 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000), r1) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:27:17 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x4082) 20:27:17 executing program 2: sendmsg$AUDIT_DEL_RULE(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000004c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="30040000f403000226bd7000fddbdf2501000000000000001d000000a398000009000000020000000000010009000000040000003f0000000000000007000000ff7f000001000000d4bd0000ff7f0000ff0f0000050000001f00000004000000f9ffffff0500000023080000090000000100000062000000080000000700000002000000e8000000ffffffff0900000005000000010001000400000003000000400000000200000001000000070000000900000074000000010000003f0000001a0000000600000000000080020000000008000001000000bc3fff7d0800000009000000070000001f0000000200000000000080010000001200000011950000fbffffff000000000004000005000000e30900000700000003000000010b00003f000000faffffff03000000070000000200000005000000040000000200000009000000060000003b53000001000100b5000000ffffff7ff20000000300000001800000f9ffffff050000004000000000004800090000000100010080000000030000000f0000000700000004000000070000000700000000000000090000000000008000000000000021000100000007000000ffffff7f75000000ffffffffffff00000300000000100000090000000200000003000000020000005600000004000000390a000009000000130000000400000000801b001c00000000000000400000000700000009000000e4090000030000000700000000f0ffff220000000000000000040000b54d0000e7080000070000000000008000010000040000001b000000010000000400000005000000060000000800000006000000400000002000000000000080ee010000ffff00000300000000000000f6464c7009000000000020000800000062570000040000000001000002000000810000000300000081000000010000004000000000100000ffff0000e0ffffff3f00000000000080060000004a000000ff0100000100000081000000000800008bb300000500000006000000000000000600000002000000030000005b0000000500000006000000060000000000000009000000000100000100000000fcffff00010000090000000000008000000080ff0f000002100000050000000500000000000100090000000400000006000000ff7f0000ff03000001000000030000000900000007000000040000000000000002000000ac9b0e1b00020000000400006e66747668b681f7c5573e240400000003000000060000006c0f000008000000040000007f0000004cda1817ff7f0000000000000010000009000000020000000100000009000000c40d00000200000002000000b70e000034bf000000040000000000803f000000a31e000001040000000000000500000001000000000000000300000000000080b201f806060000000100000001000000f7670000c6059a73d6f8030000537900000000000004000000000800000d000000002b5e002f6465762f73672300000000"], 0x430}, 0x1, 0x0, 0x0, 0x8041}, 0x240040c0) r0 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x38, r0, 0x4, 0x70bd28, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_SERVICE={0x1c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x17}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x4}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x24000814}, 0x80) (async) ioctl$PTP_ENABLE_PPS(0xffffffffffffffff, 0x40043d04, 0x1) (async) syz_open_dev$sg(&(0x7f0000000000), 0x5, 0x0) 20:27:17 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000101"], 0x1c}}, 0x0) 20:27:17 executing program 1: sendmsg$AUDIT_GET(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x3e8, 0x8, 0x70bd25, 0x25dfdbfb, "", ["", "", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x24008045}, 0x1) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) sendmsg$AUDIT_GET(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x3e8, 0x8, 0x70bd25, 0x25dfdbfb, "", ["", "", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x24008045}, 0x1) (async) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) 20:27:17 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000201"], 0x1c}}, 0x0) 20:27:17 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x4082) 20:27:17 executing program 2: sendmsg$AUDIT_DEL_RULE(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000004c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="30040000f403000226bd7000fddbdf2501000000000000001d000000a398000009000000020000000000010009000000040000003f0000000000000007000000ff7f000001000000d4bd0000ff7f0000ff0f0000050000001f00000004000000f9ffffff0500000023080000090000000100000062000000080000000700000002000000e8000000ffffffff0900000005000000010001000400000003000000400000000200000001000000070000000900000074000000010000003f0000001a0000000600000000000080020000000008000001000000bc3fff7d0800000009000000070000001f0000000200000000000080010000001200000011950000fbffffff000000000004000005000000e30900000700000003000000010b00003f000000faffffff03000000070000000200000005000000040000000200000009000000060000003b53000001000100b5000000ffffff7ff20000000300000001800000f9ffffff050000004000000000004800090000000100010080000000030000000f0000000700000004000000070000000700000000000000090000000000008000000000000021000100000007000000ffffff7f75000000ffffffffffff00000300000000100000090000000200000003000000020000005600000004000000390a000009000000130000000400000000801b001c00000000000000400000000700000009000000e4090000030000000700000000f0ffff220000000000000000040000b54d0000e7080000070000000000008000010000040000001b000000010000000400000005000000060000000800000006000000400000002000000000000080ee010000ffff00000300000000000000f6464c7009000000000020000800000062570000040000000001000002000000810000000300000081000000010000004000000000100000ffff0000e0ffffff3f00000000000080060000004a000000ff0100000100000081000000000800008bb300000500000006000000000000000600000002000000030000005b0000000500000006000000060000000000000009000000000100000100000000fcffff00010000090000000000008000000080ff0f000002100000050000000500000000000100090000000400000006000000ff7f0000ff03000001000000030000000900000007000000040000000000000002000000ac9b0e1b00020000000400006e66747668b681f7c5573e240400000003000000060000006c0f000008000000040000007f0000004cda1817ff7f0000000000000010000009000000020000000100000009000000c40d00000200000002000000b70e000034bf000000040000000000803f000000a31e000001040000000000000500000001000000000000000300000000000080b201f806060000000100000001000000f7670000c6059a73d6f8030000537900000000000004000000000800000d000000002b5e002f6465762f73672300000000"], 0x430}, 0x1, 0x0, 0x0, 0x8041}, 0x240040c0) r0 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x38, r0, 0x4, 0x70bd28, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_SERVICE={0x1c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x17}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x4}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x24000814}, 0x80) ioctl$PTP_ENABLE_PPS(0xffffffffffffffff, 0x40043d04, 0x1) syz_open_dev$sg(&(0x7f0000000000), 0x5, 0x0) sendmsg$AUDIT_DEL_RULE(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000004c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="30040000f403000226bd7000fddbdf2501000000000000001d000000a398000009000000020000000000010009000000040000003f0000000000000007000000ff7f000001000000d4bd0000ff7f0000ff0f0000050000001f00000004000000f9ffffff0500000023080000090000000100000062000000080000000700000002000000e8000000ffffffff0900000005000000010001000400000003000000400000000200000001000000070000000900000074000000010000003f0000001a0000000600000000000080020000000008000001000000bc3fff7d0800000009000000070000001f0000000200000000000080010000001200000011950000fbffffff000000000004000005000000e30900000700000003000000010b00003f000000faffffff03000000070000000200000005000000040000000200000009000000060000003b53000001000100b5000000ffffff7ff20000000300000001800000f9ffffff050000004000000000004800090000000100010080000000030000000f0000000700000004000000070000000700000000000000090000000000008000000000000021000100000007000000ffffff7f75000000ffffffffffff00000300000000100000090000000200000003000000020000005600000004000000390a000009000000130000000400000000801b001c00000000000000400000000700000009000000e4090000030000000700000000f0ffff220000000000000000040000b54d0000e7080000070000000000008000010000040000001b000000010000000400000005000000060000000800000006000000400000002000000000000080ee010000ffff00000300000000000000f6464c7009000000000020000800000062570000040000000001000002000000810000000300000081000000010000004000000000100000ffff0000e0ffffff3f00000000000080060000004a000000ff0100000100000081000000000800008bb300000500000006000000000000000600000002000000030000005b0000000500000006000000060000000000000009000000000100000100000000fcffff00010000090000000000008000000080ff0f000002100000050000000500000000000100090000000400000006000000ff7f0000ff03000001000000030000000900000007000000040000000000000002000000ac9b0e1b00020000000400006e66747668b681f7c5573e240400000003000000060000006c0f000008000000040000007f0000004cda1817ff7f0000000000000010000009000000020000000100000009000000c40d00000200000002000000b70e000034bf000000040000000000803f000000a31e000001040000000000000500000001000000000000000300000000000080b201f806060000000100000001000000f7670000c6059a73d6f8030000537900000000000004000000000800000d000000002b5e002f6465762f73672300000000"], 0x430}, 0x1, 0x0, 0x0, 0x8041}, 0x240040c0) (async) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), 0xffffffffffffffff) (async) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x38, r0, 0x4, 0x70bd28, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_SERVICE={0x1c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x17}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x4}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x24000814}, 0x80) (async) ioctl$PTP_ENABLE_PPS(0xffffffffffffffff, 0x40043d04, 0x1) (async) syz_open_dev$sg(&(0x7f0000000000), 0x5, 0x0) (async) 20:27:17 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = socket(0x11, 0xa, 0x8) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) sendmsg$NL80211_CMD_RADAR_DETECT(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x50, r2, 0x2, 0x4, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x5, 0x50}}}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x14}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_CHANNEL_WIDTH={0x8}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xc}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xffff}]}, 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x4040) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$IMSETDEVNAME(r1, 0x80184947, &(0x7f0000000240)={0x3f, 'syz0\x00'}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r1) sendmsg$NL80211_CMD_NEW_MPATH(r3, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x70, r4, 0x400, 0x70bd2b, 0x25dfdbfe, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}]}, 0x70}, 0x1, 0x0, 0x0, 0x41}, 0x10) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000000)) ioctl$SG_SET_DEBUG(0xffffffffffffffff, 0x227e, &(0x7f0000000500)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 20:27:17 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x3, 0x800000) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:27:17 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f0000000000)=0x1) 20:27:17 executing program 2: socket$rxrpc(0x21, 0x2, 0xa) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) 20:27:17 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000301"], 0x1c}}, 0x0) 20:27:17 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x3, 0x800000) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x3, 0x800000) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) (async) 20:27:17 executing program 3: ioctl$EVIOCSCLOCKID(0xffffffffffffffff, 0x400445a0, &(0x7f0000000040)=0x3) syz_open_dev$sg(&(0x7f0000000000), 0x2, 0x103002) 20:27:17 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = socket(0x11, 0xa, 0x8) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) sendmsg$NL80211_CMD_RADAR_DETECT(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x50, r2, 0x2, 0x4, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x5, 0x50}}}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x14}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_CHANNEL_WIDTH={0x8}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xc}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xffff}]}, 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x4040) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$IMSETDEVNAME(r1, 0x80184947, &(0x7f0000000240)={0x3f, 'syz0\x00'}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r1) sendmsg$NL80211_CMD_NEW_MPATH(r3, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x70, r4, 0x400, 0x70bd2b, 0x25dfdbfe, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}]}, 0x70}, 0x1, 0x0, 0x0, 0x41}, 0x10) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000000)) ioctl$SG_SET_DEBUG(0xffffffffffffffff, 0x227e, &(0x7f0000000500)) 20:27:17 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f0000000000)=0x1) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f0000000000)=0x1) (async) 20:27:17 executing program 2: socket$rxrpc(0x21, 0x2, 0xa) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) socket$rxrpc(0x21, 0x2, 0xa) (async) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) 20:27:17 executing program 3: ioctl$EVIOCSCLOCKID(0xffffffffffffffff, 0x400445a0, &(0x7f0000000040)=0x3) syz_open_dev$sg(&(0x7f0000000000), 0x2, 0x103002) 20:27:17 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f0000000000)=0x1) 20:27:17 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = socket(0x11, 0xa, 0x8) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) sendmsg$NL80211_CMD_RADAR_DETECT(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x50, r2, 0x2, 0x4, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x5, 0x50}}}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x14}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_CHANNEL_WIDTH={0x8}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xc}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xffff}]}, 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x4040) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$IMSETDEVNAME(r1, 0x80184947, &(0x7f0000000240)={0x3f, 'syz0\x00'}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r1) sendmsg$NL80211_CMD_NEW_MPATH(r3, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x70, r4, 0x400, 0x70bd2b, 0x25dfdbfe, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}]}, 0x70}, 0x1, 0x0, 0x0, 0x41}, 0x10) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000000)) 20:27:17 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x3, 0x800000) ioctl$SG_GET_COMMAND_Q(r0, 0x1274, 0x0) 20:27:17 executing program 3: ioctl$EVIOCSCLOCKID(0xffffffffffffffff, 0x400445a0, &(0x7f0000000040)=0x3) syz_open_dev$sg(&(0x7f0000000000), 0x2, 0x103002) ioctl$EVIOCSCLOCKID(0xffffffffffffffff, 0x400445a0, &(0x7f0000000040)=0x3) (async) syz_open_dev$sg(&(0x7f0000000000), 0x2, 0x103002) (async) 20:27:17 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000100), 0xb, 0x809c0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$EVIOCGKEYCODE(r1, 0x80084504, &(0x7f0000000040)=""/191) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f0000000000)) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) 20:27:17 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000401"], 0x1c}}, 0x0) 20:27:17 executing program 1: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x4082) 20:27:17 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000100), 0xb, 0x809c0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async, rerun: 64) ioctl$EVIOCGKEYCODE(r1, 0x80084504, &(0x7f0000000040)=""/191) (rerun: 64) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f0000000000)) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) 20:27:17 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x8082) 20:27:17 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000501"], 0x1c}}, 0x0) 20:27:18 executing program 2: socket$rxrpc(0x21, 0x2, 0xa) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) 20:27:18 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000100), 0xb, 0x809c0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$EVIOCGKEYCODE(r1, 0x80084504, &(0x7f0000000040)=""/191) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f0000000000)) (async) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) 20:27:18 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000601"], 0x1c}}, 0x0) 20:27:18 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = socket(0x11, 0xa, 0x8) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) sendmsg$NL80211_CMD_RADAR_DETECT(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x50, r2, 0x2, 0x4, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x5, 0x50}}}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x14}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_CHANNEL_WIDTH={0x8}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xc}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xffff}]}, 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x4040) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$IMSETDEVNAME(r1, 0x80184947, &(0x7f0000000240)={0x3f, 'syz0\x00'}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r1) sendmsg$NL80211_CMD_NEW_MPATH(r3, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x70, r4, 0x400, 0x70bd2b, 0x25dfdbfe, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}]}, 0x70}, 0x1, 0x0, 0x0, 0x41}, 0x10) 20:27:18 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000701"], 0x1c}}, 0x0) 20:27:18 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x8082) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x8082) (async) 20:27:18 executing program 1: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x4082) 20:27:18 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x800000000, 0x0) syz_open_dev$sg(&(0x7f0000000100), 0x100, 0x2a4a83) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0), 0x600, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000080)) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(0xffffffffffffffff, 0x40046210, &(0x7f0000000000)) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) 20:27:18 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x644104, 0x0) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000080)=0x1) 20:27:18 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = socket(0x11, 0xa, 0x8) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) sendmsg$NL80211_CMD_RADAR_DETECT(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x50, r2, 0x2, 0x4, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x5, 0x50}}}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x14}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_CHANNEL_WIDTH={0x8}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xc}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xffff}]}, 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x4040) socket$nl_generic(0x10, 0x3, 0x10) ioctl$IMSETDEVNAME(r1, 0x80184947, &(0x7f0000000240)={0x3f, 'syz0\x00'}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r1) 20:27:18 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x644104, 0x0) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000080)=0x1) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x644104, 0x0) (async) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000080)=0x1) (async) 20:27:18 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000801"], 0x1c}}, 0x0) 20:27:18 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x800000000, 0x0) syz_open_dev$sg(&(0x7f0000000100), 0x100, 0x2a4a83) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0), 0x600, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000080)) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(0xffffffffffffffff, 0x40046210, &(0x7f0000000000)) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) syz_open_dev$sg(&(0x7f0000000380), 0x800000000, 0x0) (async) syz_open_dev$sg(&(0x7f0000000100), 0x100, 0x2a4a83) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0), 0x600, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000080)) (async) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(0xffffffffffffffff, 0x40046210, &(0x7f0000000000)) (async) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) (async) 20:27:18 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000901"], 0x1c}}, 0x0) 20:27:18 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x800000000, 0x0) (async) syz_open_dev$sg(&(0x7f0000000100), 0x100, 0x2a4a83) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0), 0x600, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000080)) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(0xffffffffffffffff, 0x40046210, &(0x7f0000000000)) (async) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) 20:27:18 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x644104, 0x0) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000080)=0x1) 20:27:18 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000a01"], 0x1c}}, 0x0) 20:27:18 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x8082) 20:27:18 executing program 1: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x4082) 20:27:18 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x60082, 0x0) write$vga_arbiter(r0, 0x0, 0x0) ioctl$SCSI_IOCTL_GET_PCI(r0, 0x5387, &(0x7f0000000040)) 20:27:18 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x1000000000010001, 0x501000) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:27:18 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000b01"], 0x1c}}, 0x0) 20:27:18 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = socket(0x11, 0xa, 0x8) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) sendmsg$NL80211_CMD_RADAR_DETECT(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x50, r2, 0x2, 0x4, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x5, 0x50}}}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x14}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_CHANNEL_WIDTH={0x8}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xc}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xffff}]}, 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x4040) socket$nl_generic(0x10, 0x3, 0x10) ioctl$IMSETDEVNAME(r1, 0x80184947, &(0x7f0000000240)={0x3f, 'syz0\x00'}) 20:27:18 executing program 1: syz_open_dev$sg(0x0, 0x0, 0x4082) 20:27:18 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = socket(0x11, 0xa, 0x8) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) sendmsg$NL80211_CMD_RADAR_DETECT(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x50, r2, 0x2, 0x4, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x5, 0x50}}}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x14}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_CHANNEL_WIDTH={0x8}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xc}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xffff}]}, 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x4040) ioctl$IMSETDEVNAME(r1, 0x80184947, &(0x7f0000000240)={0x3f, 'syz0\x00'}) 20:27:18 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000180)=0x10000) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100), 0x4000, 0x0) ioctl$SG_GET_SCSI_ID(r1, 0x2276, &(0x7f0000000140)) r2 = syz_open_dev$sg(&(0x7f0000000040), 0xffffffffffffff81, 0xc000) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x10080, 0x0) ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f00000000c0)) ioctl$SG_GET_NUM_WAITING(r2, 0x227d, &(0x7f00000001c0)) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200), 0x200000, 0x0) sendmsg$key(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x2, 0x8, 0x1, 0x6, 0x15, 0x0, 0x70bd25, 0x25dfdbfd, [@sadb_ident={0x2, 0xb, 0x1, 0x0, 0x6}, @sadb_sa={0x2, 0x1, 0x4d5, 0xfa, 0x20, 0x49, 0x1, 0x20000001}, @sadb_x_filter={0x5, 0x1a, @in6=@loopback, @in=@rand_addr=0x64010101, 0x2b, 0x10, 0x4}, @sadb_address={0x3, 0x6, 0xc4, 0x0, 0x0, @in={0x2, 0x4e22, @local}}, @sadb_x_kmaddress={0x5, 0x19, 0x0, @in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x2b}}}, @sadb_spirange={0x2, 0x10, 0x4d6, 0x4d6}]}, 0xa8}}, 0x0) 20:27:18 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x60082, 0x0) write$vga_arbiter(r0, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_GET_PCI(r0, 0x5387, &(0x7f0000000040)) 20:27:18 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x1000000000010001, 0x501000) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x1000000000010001, 0x501000) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) 20:27:18 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000c01"], 0x1c}}, 0x0) 20:27:18 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000180)=0x10000) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100), 0x4000, 0x0) ioctl$SG_GET_SCSI_ID(r1, 0x2276, &(0x7f0000000140)) (async) r2 = syz_open_dev$sg(&(0x7f0000000040), 0xffffffffffffff81, 0xc000) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x10080, 0x0) ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f00000000c0)) (async) ioctl$SG_GET_NUM_WAITING(r2, 0x227d, &(0x7f00000001c0)) (async) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200), 0x200000, 0x0) sendmsg$key(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x2, 0x8, 0x1, 0x6, 0x15, 0x0, 0x70bd25, 0x25dfdbfd, [@sadb_ident={0x2, 0xb, 0x1, 0x0, 0x6}, @sadb_sa={0x2, 0x1, 0x4d5, 0xfa, 0x20, 0x49, 0x1, 0x20000001}, @sadb_x_filter={0x5, 0x1a, @in6=@loopback, @in=@rand_addr=0x64010101, 0x2b, 0x10, 0x4}, @sadb_address={0x3, 0x6, 0xc4, 0x0, 0x0, @in={0x2, 0x4e22, @local}}, @sadb_x_kmaddress={0x5, 0x19, 0x0, @in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x2b}}}, @sadb_spirange={0x2, 0x10, 0x4d6, 0x4d6}]}, 0xa8}}, 0x0) 20:27:18 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r1 = socket(0x11, 0xa, 0x8) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) ioctl$IMSETDEVNAME(r1, 0x80184947, &(0x7f0000000240)={0x3f, 'syz0\x00'}) 20:27:18 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x60082, 0x0) write$vga_arbiter(r0, 0x0, 0x0) ioctl$SCSI_IOCTL_GET_PCI(r0, 0x5387, &(0x7f0000000040)) 20:27:18 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000d01"], 0x1c}}, 0x0) 20:27:18 executing program 1: syz_open_dev$sg(0x0, 0x0, 0x4082) 20:27:18 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x1000000000010001, 0x501000) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) 20:27:19 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000180)=0x10000) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100), 0x4000, 0x0) ioctl$SG_GET_SCSI_ID(r1, 0x2276, &(0x7f0000000140)) r2 = syz_open_dev$sg(&(0x7f0000000040), 0xffffffffffffff81, 0xc000) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x10080, 0x0) ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f00000000c0)) ioctl$SG_GET_NUM_WAITING(r2, 0x227d, &(0x7f00000001c0)) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200), 0x200000, 0x0) sendmsg$key(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x2, 0x8, 0x1, 0x6, 0x15, 0x0, 0x70bd25, 0x25dfdbfd, [@sadb_ident={0x2, 0xb, 0x1, 0x0, 0x6}, @sadb_sa={0x2, 0x1, 0x4d5, 0xfa, 0x20, 0x49, 0x1, 0x20000001}, @sadb_x_filter={0x5, 0x1a, @in6=@loopback, @in=@rand_addr=0x64010101, 0x2b, 0x10, 0x4}, @sadb_address={0x3, 0x6, 0xc4, 0x0, 0x0, @in={0x2, 0x4e22, @local}}, @sadb_x_kmaddress={0x5, 0x19, 0x0, @in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x2b}}}, @sadb_spirange={0x2, 0x10, 0x4d6, 0x4d6}]}, 0xa8}}, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000180)=0x10000) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100), 0x4000, 0x0) (async) ioctl$SG_GET_SCSI_ID(r1, 0x2276, &(0x7f0000000140)) (async) syz_open_dev$sg(&(0x7f0000000040), 0xffffffffffffff81, 0xc000) (async) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x10080, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f00000000c0)) (async) ioctl$SG_GET_NUM_WAITING(r2, 0x227d, &(0x7f00000001c0)) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200), 0x200000, 0x0) (async) sendmsg$key(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x2, 0x8, 0x1, 0x6, 0x15, 0x0, 0x70bd25, 0x25dfdbfd, [@sadb_ident={0x2, 0xb, 0x1, 0x0, 0x6}, @sadb_sa={0x2, 0x1, 0x4d5, 0xfa, 0x20, 0x49, 0x1, 0x20000001}, @sadb_x_filter={0x5, 0x1a, @in6=@loopback, @in=@rand_addr=0x64010101, 0x2b, 0x10, 0x4}, @sadb_address={0x3, 0x6, 0xc4, 0x0, 0x0, @in={0x2, 0x4e22, @local}}, @sadb_x_kmaddress={0x5, 0x19, 0x0, @in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x2b}}}, @sadb_spirange={0x2, 0x10, 0x4d6, 0x4d6}]}, 0xa8}}, 0x0) (async) 20:27:19 executing program 0: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r0 = socket(0x11, 0xa, 0x8) ioctl$IMSETDEVNAME(r0, 0x80184947, &(0x7f0000000240)={0x3f, 'syz0\x00'}) 20:27:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000e01"], 0x1c}}, 0x0) 20:27:19 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) syz_open_dev$sg(&(0x7f0000000040), 0x5, 0x0) 20:27:19 executing program 5: bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000000)={0x3ff, 0x0}, 0x8) bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000040)=r0, 0x4) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x1267, 0x0) 20:27:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000f01"], 0x1c}}, 0x0) 20:27:19 executing program 1: syz_open_dev$sg(0x0, 0x0, 0x4082) 20:27:19 executing program 0: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$IMSETDEVNAME(0xffffffffffffffff, 0x80184947, &(0x7f0000000240)={0x3f, 'syz0\x00'}) 20:27:19 executing program 3: syz_open_dev$sg(&(0x7f0000000040), 0x5313, 0x82) 20:27:19 executing program 3: syz_open_dev$sg(&(0x7f0000000040), 0x5313, 0x82) 20:27:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000001001"], 0x1c}}, 0x0) 20:27:19 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) syz_open_dev$sg(&(0x7f0000000040), 0x5, 0x0) 20:27:19 executing program 5: bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000000)={0x3ff, 0x0}, 0x8) bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000040)=r0, 0x4) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x1267, 0x0) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000000)={0x3ff}, 0x8) (async) bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000040)=r0, 0x4) (async) syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) (async) ioctl$SG_GET_COMMAND_Q(r1, 0x1267, 0x0) (async) 20:27:19 executing program 0: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$IMSETDEVNAME(0xffffffffffffffff, 0x80184947, &(0x7f0000000240)={0x3f, 'syz0\x00'}) 20:27:19 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) syz_open_dev$sg(&(0x7f0000000040), 0x5, 0x0) 20:27:19 executing program 1: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) 20:27:19 executing program 3: syz_open_dev$sg(&(0x7f0000000040), 0x5313, 0x82) syz_open_dev$sg(&(0x7f0000000040), 0x5313, 0x82) (async) 20:27:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000001101"], 0x1c}}, 0x0) 20:27:19 executing program 5: bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000000)={0x3ff, 0x0}, 0x8) bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000040)=r0, 0x4) (async) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x1267, 0x0) 20:27:19 executing program 0: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$IMSETDEVNAME(0xffffffffffffffff, 0x80184947, &(0x7f0000000240)={0x3f, 'syz0\x00'}) 20:27:19 executing program 1: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) 20:27:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000001201"], 0x1c}}, 0x0) 20:27:19 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x7, 0x400041) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x24, r2, 0x200, 0x70bd25, 0x25dfdbff, {{}, {}, {0x8, 0x2, 0x8}}, ["", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x20000000) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) ioctl$SG_GET_REQUEST_TABLE(r3, 0x2286, &(0x7f0000000100)) sendmsg$AUDIT_SET(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x3c, 0x3e9, 0x100, 0x70bd29, 0x25dfdbfe, {0x5a, 0x1, 0x3, 0x0, 0x3, 0x4, 0x1, 0x2, 0x0, 0x4}, [""]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x8014) modify_ldt$write(0x1, &(0x7f0000000300)={0x5, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x10) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000280), 0x202140, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r4, 0x2287, &(0x7f00000002c0)) 20:27:19 executing program 3: clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_RINGS_SET(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB='t\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="20002dbd7000ffdbdf251000000008000800ff030000500001800800030002000000140002006970365f76746930000000000000000008000100", @ANYRES32=0x0, @ANYBLOB="140c0200697032e6f4766c616e300000200000000004140729af59a6f3766c616e300000000000000000000800060000000000"], 0x74}, 0x1, 0x0, 0x0, 0x20048004}, 0x40040) clock_settime(0x2, &(0x7f0000000080)={r0, r1+60000000}) syz_open_dev$sg(&(0x7f0000000000), 0x8, 0x6f2383) 20:27:19 executing program 0: r0 = socket(0x11, 0xa, 0x8) ioctl$IMSETDEVNAME(r0, 0x80184947, &(0x7f0000000240)={0x3f, 'syz0\x00'}) 20:27:19 executing program 1: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) 20:27:19 executing program 3: clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_RINGS_SET(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB='t\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="20002dbd7000ffdbdf251000000008000800ff030000500001800800030002000000140002006970365f76746930000000000000000008000100", @ANYRES32=0x0, @ANYBLOB="140c0200697032e6f4766c616e300000200000000004140729af59a6f3766c616e300000000000000000000800060000000000"], 0x74}, 0x1, 0x0, 0x0, 0x20048004}, 0x40040) clock_settime(0x2, &(0x7f0000000080)={r0, r1+60000000}) syz_open_dev$sg(&(0x7f0000000000), 0x8, 0x6f2383) clock_gettime(0x0, &(0x7f0000000040)) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), 0xffffffffffffffff) (async) sendmsg$ETHTOOL_MSG_RINGS_SET(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB='t\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="20002dbd7000ffdbdf251000000008000800ff030000500001800800030002000000140002006970365f76746930000000000000000008000100", @ANYRES32=0x0, @ANYBLOB="140c0200697032e6f4766c616e300000200000000004140729af59a6f3766c616e300000000000000000000800060000000000"], 0x74}, 0x1, 0x0, 0x0, 0x20048004}, 0x40040) (async) clock_settime(0x2, &(0x7f0000000080)={r0, r1+60000000}) (async) syz_open_dev$sg(&(0x7f0000000000), 0x8, 0x6f2383) (async) 20:27:19 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x7, 0x400041) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x24, r2, 0x200, 0x70bd25, 0x25dfdbff, {{}, {}, {0x8, 0x2, 0x8}}, ["", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x20000000) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) ioctl$SG_GET_REQUEST_TABLE(r3, 0x2286, &(0x7f0000000100)) sendmsg$AUDIT_SET(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x3c, 0x3e9, 0x100, 0x70bd29, 0x25dfdbfe, {0x5a, 0x1, 0x3, 0x0, 0x3, 0x4, 0x1, 0x2, 0x0, 0x4}, [""]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x8014) modify_ldt$write(0x1, &(0x7f0000000300)={0x5, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x10) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000280), 0x202140, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r4, 0x2287, &(0x7f00000002c0)) syz_open_dev$sg(&(0x7f0000000380), 0x7, 0x400041) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$tipc(&(0x7f00000003c0), 0xffffffffffffffff) (async) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x24, r2, 0x200, 0x70bd25, 0x25dfdbff, {{}, {}, {0x8, 0x2, 0x8}}, ["", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x20000000) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r3, 0x0, 0x0) (async) ioctl$SG_GET_REQUEST_TABLE(r3, 0x2286, &(0x7f0000000100)) (async) sendmsg$AUDIT_SET(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x3c, 0x3e9, 0x100, 0x70bd29, 0x25dfdbfe, {0x5a, 0x1, 0x3, 0x0, 0x3, 0x4, 0x1, 0x2, 0x0, 0x4}, [""]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x8014) (async) modify_ldt$write(0x1, &(0x7f0000000300)={0x5, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x10) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000280), 0x202140, 0x0) (async) ioctl$SG_SET_KEEP_ORPHAN(r4, 0x2287, &(0x7f00000002c0)) (async) 20:27:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000002501"], 0x1c}}, 0x0) 20:27:19 executing program 0: r0 = socket(0x0, 0xa, 0x8) ioctl$IMSETDEVNAME(r0, 0x80184947, &(0x7f0000000240)={0x3f, 'syz0\x00'}) 20:27:19 executing program 1: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) syz_open_dev$sg(&(0x7f0000000040), 0x5, 0x0) 20:27:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000000000d2601"], 0x1c}}, 0x0) 20:27:19 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan0\x00'}) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000100), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f00000004c0)={'wpan1\x00', 0x0}) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r5, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x6c, r1, 0x100, 0x70bd2c, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_DEVICE={0x10, 0x23, 0x0, 0x1, {0xc, 0x4, {0xaaaaaaaaaaaa0002}}}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x6c}, 0x1, 0x0, 0x0, 0x63ec05e842e137b0}, 0x20000080) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r6 = syz_open_dev$sg(&(0x7f0000000040), 0x80000000, 0x600200) ioctl$SG_SET_KEEP_ORPHAN(r6, 0x2287, &(0x7f0000000080)=0x400) 20:27:19 executing program 3: clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_RINGS_SET(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB='t\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="20002dbd7000ffdbdf251000000008000800ff030000500001800800030002000000140002006970365f76746930000000000000000008000100", @ANYRES32=0x0, @ANYBLOB="140c0200697032e6f4766c616e300000200000000004140729af59a6f3766c616e300000000000000000000800060000000000"], 0x74}, 0x1, 0x0, 0x0, 0x20048004}, 0x40040) clock_settime(0x2, &(0x7f0000000080)={r0, r1+60000000}) syz_open_dev$sg(&(0x7f0000000000), 0x8, 0x6f2383) clock_gettime(0x0, &(0x7f0000000040)) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), 0xffffffffffffffff) (async) sendmsg$ETHTOOL_MSG_RINGS_SET(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB='t\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="20002dbd7000ffdbdf251000000008000800ff030000500001800800030002000000140002006970365f76746930000000000000000008000100", @ANYRES32=0x0, @ANYBLOB="140c0200697032e6f4766c616e300000200000000004140729af59a6f3766c616e300000000000000000000800060000000000"], 0x74}, 0x1, 0x0, 0x0, 0x20048004}, 0x40040) (async) clock_settime(0x2, &(0x7f0000000080)={r0, r1+60000000}) (async) syz_open_dev$sg(&(0x7f0000000000), 0x8, 0x6f2383) (async) 20:27:19 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x7, 0x400041) ioctl$SG_GET_COMMAND_Q(r0, 0x1267, 0x0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x24, r2, 0x200, 0x70bd25, 0x25dfdbff, {{}, {}, {0x8, 0x2, 0x8}}, ["", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x20000000) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) (async) ioctl$SG_GET_REQUEST_TABLE(r3, 0x2286, &(0x7f0000000100)) (async) sendmsg$AUDIT_SET(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x3c, 0x3e9, 0x100, 0x70bd29, 0x25dfdbfe, {0x5a, 0x1, 0x3, 0x0, 0x3, 0x4, 0x1, 0x2, 0x0, 0x4}, [""]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x8014) modify_ldt$write(0x1, &(0x7f0000000300)={0x5, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x10) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000280), 0x202140, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r4, 0x2287, &(0x7f00000002c0)) 20:27:19 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan0\x00'}) (async) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000100), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f00000004c0)={'wpan1\x00', 0x0}) (async) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r5, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) (async) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x6c, r1, 0x100, 0x70bd2c, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_DEVICE={0x10, 0x23, 0x0, 0x1, {0xc, 0x4, {0xaaaaaaaaaaaa0002}}}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x6c}, 0x1, 0x0, 0x0, 0x63ec05e842e137b0}, 0x20000080) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) r6 = syz_open_dev$sg(&(0x7f0000000040), 0x80000000, 0x600200) ioctl$SG_SET_KEEP_ORPHAN(r6, 0x2287, &(0x7f0000000080)=0x400) 20:27:19 executing program 0: r0 = socket(0x0, 0xa, 0x8) ioctl$IMSETDEVNAME(r0, 0x80184947, &(0x7f0000000240)={0x3f, 'syz0\x00'}) 20:27:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000004801"], 0x1c}}, 0x0) 20:27:19 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000180)=0x10000) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100), 0x4000, 0x0) ioctl$SG_GET_SCSI_ID(r1, 0x2276, &(0x7f0000000140)) r2 = syz_open_dev$sg(&(0x7f0000000040), 0xffffffffffffff81, 0xc000) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x10080, 0x0) ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f00000000c0)) ioctl$SG_GET_NUM_WAITING(r2, 0x227d, &(0x7f00000001c0)) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200), 0x200000, 0x0) sendmsg$key(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x2, 0x8, 0x1, 0x6, 0x15, 0x0, 0x70bd25, 0x25dfdbfd, [@sadb_ident={0x2, 0xb, 0x1, 0x0, 0x6}, @sadb_sa={0x2, 0x1, 0x4d5, 0xfa, 0x20, 0x49, 0x1, 0x20000001}, @sadb_x_filter={0x5, 0x1a, @in6=@loopback, @in=@rand_addr=0x64010101, 0x2b, 0x10, 0x4}, @sadb_address={0x3, 0x6, 0xc4, 0x0, 0x0, @in={0x2, 0x4e22, @local}}, @sadb_x_kmaddress={0x5, 0x19, 0x0, @in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x2b}}}, @sadb_spirange={0x2, 0x10, 0x4d6, 0x4d6}]}, 0xa8}}, 0x0) 20:27:19 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f0000000040)) 20:27:19 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan0\x00'}) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000100), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f00000004c0)={'wpan1\x00', 0x0}) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r5, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x6c, r1, 0x100, 0x70bd2c, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_DEVICE={0x10, 0x23, 0x0, 0x1, {0xc, 0x4, {0xaaaaaaaaaaaa0002}}}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x6c}, 0x1, 0x0, 0x0, 0x63ec05e842e137b0}, 0x20000080) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r6 = syz_open_dev$sg(&(0x7f0000000040), 0x80000000, 0x600200) ioctl$SG_SET_KEEP_ORPHAN(r6, 0x2287, &(0x7f0000000080)=0x400) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan0\x00'}) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000100), 0xffffffffffffffff) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f00000004c0)={'wpan1\x00'}) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) (async) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r5, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) (async) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x6c, r1, 0x100, 0x70bd2c, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_DEVICE={0x10, 0x23, 0x0, 0x1, {0xc, 0x4, {0xaaaaaaaaaaaa0002}}}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x6c}, 0x1, 0x0, 0x0, 0x63ec05e842e137b0}, 0x20000080) (async) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) syz_open_dev$sg(&(0x7f0000000040), 0x80000000, 0x600200) (async) ioctl$SG_SET_KEEP_ORPHAN(r6, 0x2287, &(0x7f0000000080)=0x400) (async) 20:27:19 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040), 0x880, 0x0) r0 = socket(0x30, 0x80000, 0xfffffff8) r1 = getpid() prlimit64(r1, 0x0, 0x0, &(0x7f0000000000)) sendmsg$AUDIT_SET(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x3c, 0x3e9, 0x800, 0x70bd2a, 0x25dfdbfd, {0x40, 0x0, 0x1, r1, 0xe3, 0x0, 0x8, 0x6, 0x0, 0xfff, 0x811d}, [""]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x80) 20:27:19 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f0000000040)) 20:27:19 executing program 0: r0 = socket(0x0, 0xa, 0x8) ioctl$IMSETDEVNAME(r0, 0x80184947, &(0x7f0000000240)={0x3f, 'syz0\x00'}) 20:27:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000004c01"], 0x1c}}, 0x0) 20:27:19 executing program 2: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) 20:27:19 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000180)=0x10000) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100), 0x4000, 0x0) ioctl$SG_GET_SCSI_ID(r1, 0x2276, &(0x7f0000000140)) r2 = syz_open_dev$sg(&(0x7f0000000040), 0xffffffffffffff81, 0xc000) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x10080, 0x0) ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f00000000c0)) ioctl$SG_GET_NUM_WAITING(r2, 0x227d, &(0x7f00000001c0)) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200), 0x200000, 0x0) sendmsg$key(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x2, 0x8, 0x1, 0x6, 0x15, 0x0, 0x70bd25, 0x25dfdbfd, [@sadb_ident={0x2, 0xb, 0x1, 0x0, 0x6}, @sadb_sa={0x2, 0x1, 0x4d5, 0xfa, 0x20, 0x49, 0x1, 0x20000001}, @sadb_x_filter={0x5, 0x1a, @in6=@loopback, @in=@rand_addr=0x64010101, 0x2b, 0x10, 0x4}, @sadb_address={0x3, 0x6, 0xc4, 0x0, 0x0, @in={0x2, 0x4e22, @local}}, @sadb_x_kmaddress={0x5, 0x19, 0x0, @in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x2b}}}, @sadb_spirange={0x2, 0x10, 0x4d6, 0x4d6}]}, 0xa8}}, 0x0) 20:27:19 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040), 0x880, 0x0) (async) r0 = socket(0x30, 0x80000, 0xfffffff8) r1 = getpid() prlimit64(r1, 0x0, 0x0, &(0x7f0000000000)) sendmsg$AUDIT_SET(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x3c, 0x3e9, 0x800, 0x70bd2a, 0x25dfdbfd, {0x40, 0x0, 0x1, r1, 0xe3, 0x0, 0x8, 0x6, 0x0, 0xfff, 0x811d}, [""]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x80) 20:27:19 executing program 0: r0 = socket(0x11, 0x0, 0x8) ioctl$IMSETDEVNAME(r0, 0x80184947, &(0x7f0000000240)={0x3f, 'syz0\x00'}) 20:27:19 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000180)=0x10000) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100), 0x4000, 0x0) ioctl$SG_GET_SCSI_ID(r1, 0x2276, &(0x7f0000000140)) r2 = syz_open_dev$sg(&(0x7f0000000040), 0xffffffffffffff81, 0xc000) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x10080, 0x0) ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f00000000c0)) ioctl$SG_GET_NUM_WAITING(r2, 0x227d, &(0x7f00000001c0)) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200), 0x200000, 0x0) sendmsg$key(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x2, 0x8, 0x1, 0x6, 0x15, 0x0, 0x70bd25, 0x25dfdbfd, [@sadb_ident={0x2, 0xb, 0x1, 0x0, 0x6}, @sadb_sa={0x2, 0x1, 0x4d5, 0xfa, 0x20, 0x49, 0x1, 0x20000001}, @sadb_x_filter={0x5, 0x1a, @in6=@loopback, @in=@rand_addr=0x64010101, 0x2b, 0x10, 0x4}, @sadb_address={0x3, 0x6, 0xc4, 0x0, 0x0, @in={0x2, 0x4e22, @local}}, @sadb_x_kmaddress={0x5, 0x19, 0x0, @in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x2b}}}, @sadb_spirange={0x2, 0x10, 0x4d6, 0x4d6}]}, 0xa8}}, 0x0) 20:27:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000006001"], 0x1c}}, 0x0) 20:27:19 executing program 2: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) 20:27:19 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f0000000040)) 20:27:19 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) 20:27:19 executing program 2: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) 20:27:19 executing program 0: r0 = socket(0x11, 0x0, 0x8) ioctl$IMSETDEVNAME(r0, 0x80184947, &(0x7f0000000240)={0x3f, 'syz0\x00'}) 20:27:19 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040), 0x880, 0x0) (async) r0 = socket(0x30, 0x80000, 0xfffffff8) r1 = getpid() prlimit64(r1, 0x0, 0x0, &(0x7f0000000000)) sendmsg$AUDIT_SET(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x3c, 0x3e9, 0x800, 0x70bd2a, 0x25dfdbfd, {0x40, 0x0, 0x1, r1, 0xe3, 0x0, 0x8, 0x6, 0x0, 0xfff, 0x811d}, [""]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x80) 20:27:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000006801"], 0x1c}}, 0x0) 20:27:19 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000180)=0x10000) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100), 0x4000, 0x0) ioctl$SG_GET_SCSI_ID(r1, 0x2276, &(0x7f0000000140)) r2 = syz_open_dev$sg(&(0x7f0000000040), 0xffffffffffffff81, 0xc000) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x10080, 0x0) ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f00000000c0)) ioctl$SG_GET_NUM_WAITING(r2, 0x227d, &(0x7f00000001c0)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200), 0x200000, 0x0) 20:27:19 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000180)=0x10000) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100), 0x4000, 0x0) ioctl$SG_GET_SCSI_ID(r1, 0x2276, &(0x7f0000000140)) r2 = syz_open_dev$sg(&(0x7f0000000040), 0xffffffffffffff81, 0xc000) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x10080, 0x0) ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f00000000c0)) ioctl$SG_GET_NUM_WAITING(r2, 0x227d, &(0x7f00000001c0)) 20:27:19 executing program 0: r0 = socket(0x11, 0x0, 0x8) ioctl$IMSETDEVNAME(r0, 0x80184947, &(0x7f0000000240)={0x3f, 'syz0\x00'}) 20:27:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000006c01"], 0x1c}}, 0x0) 20:27:19 executing program 3: syz_open_dev$sg(&(0x7f0000000040), 0x1, 0x4082) 20:27:19 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x36}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_JOIN_OCB(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x68, r1, 0x200, 0x70bd2c, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x5, 0x80}}}}, [@NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x3b}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x6}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x87}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x401}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x6}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x54}]}, 0x68}, 0x1, 0x0, 0x0, 0x800}, 0x4004000) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$IMGETCOUNT(r2, 0x80044943, &(0x7f0000000040)) 20:27:19 executing program 5: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) 20:27:19 executing program 0: r0 = socket(0x11, 0xa, 0x0) ioctl$IMSETDEVNAME(r0, 0x80184947, &(0x7f0000000240)={0x3f, 'syz0\x00'}) 20:27:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000007401"], 0x1c}}, 0x0) 20:27:19 executing program 3: syz_open_dev$sg(&(0x7f0000000040), 0x1, 0x4082) syz_open_dev$sg(&(0x7f0000000040), 0x1, 0x4082) (async) 20:27:19 executing program 5: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) 20:27:19 executing program 0: socket(0x11, 0xa, 0x0) ioctl$IMSETDEVNAME(0xffffffffffffffff, 0x80184947, &(0x7f0000000240)={0x3f, 'syz0\x00'}) 20:27:19 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x36}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_JOIN_OCB(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x68, r1, 0x200, 0x70bd2c, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x5, 0x80}}}}, [@NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x3b}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x6}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x87}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x401}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x6}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x54}]}, 0x68}, 0x1, 0x0, 0x0, 0x800}, 0x4004000) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$IMGETCOUNT(r2, 0x80044943, &(0x7f0000000040)) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x36}]}, 0x24}}, 0x0) (async) sendmsg$NL80211_CMD_JOIN_OCB(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x68, r1, 0x200, 0x70bd2c, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x5, 0x80}}}}, [@NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x3b}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x6}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x87}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x401}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x6}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x54}]}, 0x68}, 0x1, 0x0, 0x0, 0x800}, 0x4004000) (async) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r2, 0x0, 0x0) (async) ioctl$IMGETCOUNT(r2, 0x80044943, &(0x7f0000000040)) (async) 20:27:19 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000180)=0x10000) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100), 0x4000, 0x0) ioctl$SG_GET_SCSI_ID(r1, 0x2276, &(0x7f0000000140)) r2 = syz_open_dev$sg(&(0x7f0000000040), 0xffffffffffffff81, 0xc000) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x10080, 0x0) ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f00000000c0)) 20:27:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000007a01"], 0x1c}}, 0x0) 20:27:19 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000180)=0x10000) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100), 0x4000, 0x0) ioctl$SG_GET_SCSI_ID(r1, 0x2276, &(0x7f0000000140)) r2 = syz_open_dev$sg(&(0x7f0000000040), 0xffffffffffffff81, 0xc000) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x10080, 0x0) 20:27:19 executing program 3: syz_open_dev$sg(&(0x7f0000000040), 0x1, 0x4082) 20:27:19 executing program 5: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) 20:27:19 executing program 0: socket(0x11, 0xa, 0x0) ioctl$IMSETDEVNAME(0xffffffffffffffff, 0x80184947, &(0x7f0000000240)={0x3f, 'syz0\x00'}) 20:27:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000ffffff9e01"], 0x1c}}, 0x0) 20:27:19 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x36}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_JOIN_OCB(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x68, r1, 0x200, 0x70bd2c, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x5, 0x80}}}}, [@NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x3b}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x6}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x87}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x401}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x6}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x54}]}, 0x68}, 0x1, 0x0, 0x0, 0x800}, 0x4004000) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) (async, rerun: 32) ioctl$IMGETCOUNT(r2, 0x80044943, &(0x7f0000000040)) (rerun: 32) 20:27:19 executing program 3: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) sendmsg$NL80211_CMD_SET_COALESCE(r0, &(0x7f0000000400)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0xd2fc122717fd56e5}, 0xc, &(0x7f00000003c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="480001001851d3808f9a081d51fb515a1ee9e0bedfc1256136aa4a16ec407232b3e4dd1976e00b27308272ed4ef723cf21802b5e2e8632a7ae957d0afd8727b96b0c9905f30003159e763e1d0101e99a997fc24c3759cea7627ba42bb737fee72e0b00014043e62480c576651174a1b195c35acac142134fb636320e9268614305f0c1de71ff07000000000000828364cfa40a3a2d89580000000000005bfa2db037d10ad923cb1c990021a55c20", @ANYBLOB="4e762b36e9fefe97c256207b91bd1d4904f93eae0ca1cea71fe0d2dd213847cfb403e1330aa9490a07659422da34658b696ca95b6abedcac98a4836b59c25ed9d0cd1587cd45f44970d14916743ad2d03f4395c7bcb6147d65b23a225a1077beee78807ef7ca2d3a380e7ecc7d9a29755aba8bffa7ca8df492d5afe0e53abc2dfeadce2ebe52b22c12ab1040e04db81cb2768b032af228c060ce141d7c293102475724a12363ccf18d48e63d", @ANYRES16=r3, @ANYRES32=r2, @ANYRES32=r1], 0x108}, 0x1, 0x0, 0x0, 0x20004894}, 0x440d0) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r4, 0x0, 0x0) sendmsg$NL80211_CMD_GET_SURVEY(r4, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x28, r1, 0x200, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x4, 0x25}}}}, [""]}, 0x28}, 0x1, 0x0, 0x0, 0x4000014}, 0x805) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r6, 0x0, 0x0) setsockopt$RXRPC_UPGRADEABLE_SERVICE(r6, 0x110, 0x5, &(0x7f0000000280)=[0x1, 0x3], 0x2) write$vga_arbiter(r5, 0x0, 0x0) ioctl$EVIOCREVOKE(r5, 0x40044591, &(0x7f0000000040)=0x10000) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r7 = syz_open_dev$evdev(&(0x7f0000000080), 0x3, 0x400000) ioctl$EVIOCGLED(r7, 0x80404519, &(0x7f00000000c0)=""/242) 20:27:19 executing program 5: r0 = syz_open_dev$sg(0x0, 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) 20:27:19 executing program 0: socket(0x11, 0xa, 0x0) ioctl$IMSETDEVNAME(0xffffffffffffffff, 0x80184947, &(0x7f0000000240)={0x3f, 'syz0\x00'}) 20:27:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000ffffffef01"], 0x1c}}, 0x0) 20:27:19 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000180)=0x10000) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100), 0x4000, 0x0) ioctl$SG_GET_SCSI_ID(r1, 0x2276, &(0x7f0000000140)) r2 = syz_open_dev$sg(&(0x7f0000000040), 0xffffffffffffff81, 0xc000) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) 20:27:19 executing program 5: r0 = syz_open_dev$sg(0x0, 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) 20:27:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000fffffff001"], 0x1c}}, 0x0) 20:27:19 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000180)=0x10000) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100), 0x4000, 0x0) ioctl$SG_GET_SCSI_ID(r1, 0x2276, &(0x7f0000000140)) syz_open_dev$sg(&(0x7f0000000040), 0xffffffffffffff81, 0xc000) 20:27:19 executing program 0: r0 = socket(0x11, 0xa, 0x0) ioctl$IMSETDEVNAME(r0, 0x80184947, 0x0) 20:27:19 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x40c5c2) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r0, 0x2) 20:27:19 executing program 5: r0 = syz_open_dev$sg(0x0, 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) 20:27:19 executing program 3: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) sendmsg$NL80211_CMD_SET_COALESCE(r0, &(0x7f0000000400)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0xd2fc122717fd56e5}, 0xc, &(0x7f00000003c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="480001001851d3808f9a081d51fb515a1ee9e0bedfc1256136aa4a16ec407232b3e4dd1976e00b27308272ed4ef723cf21802b5e2e8632a7ae957d0afd8727b96b0c9905f30003159e763e1d0101e99a997fc24c3759cea7627ba42bb737fee72e0b00014043e62480c576651174a1b195c35acac142134fb636320e9268614305f0c1de71ff07000000000000828364cfa40a3a2d89580000000000005bfa2db037d10ad923cb1c990021a55c20", @ANYBLOB="4e762b36e9fefe97c256207b91bd1d4904f93eae0ca1cea71fe0d2dd213847cfb403e1330aa9490a07659422da34658b696ca95b6abedcac98a4836b59c25ed9d0cd1587cd45f44970d14916743ad2d03f4395c7bcb6147d65b23a225a1077beee78807ef7ca2d3a380e7ecc7d9a29755aba8bffa7ca8df492d5afe0e53abc2dfeadce2ebe52b22c12ab1040e04db81cb2768b032af228c060ce141d7c293102475724a12363ccf18d48e63d", @ANYRES16=r3, @ANYRES32=r2, @ANYRES32=r1], 0x108}, 0x1, 0x0, 0x0, 0x20004894}, 0x440d0) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r4, 0x0, 0x0) sendmsg$NL80211_CMD_GET_SURVEY(r4, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x28, r1, 0x200, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x4, 0x25}}}}, [""]}, 0x28}, 0x1, 0x0, 0x0, 0x4000014}, 0x805) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r6, 0x0, 0x0) setsockopt$RXRPC_UPGRADEABLE_SERVICE(r6, 0x110, 0x5, &(0x7f0000000280)=[0x1, 0x3], 0x2) write$vga_arbiter(r5, 0x0, 0x0) ioctl$EVIOCREVOKE(r5, 0x40044591, &(0x7f0000000040)=0x10000) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r7 = syz_open_dev$evdev(&(0x7f0000000080), 0x3, 0x400000) ioctl$EVIOCGLED(r7, 0x80404519, &(0x7f00000000c0)=""/242) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r0, 0x0, 0x0) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'wlan1\x00'}) (async) socket$inet6_sctp(0xa, 0x5, 0x84) (async) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) (async) sendmsg$NL80211_CMD_SET_COALESCE(r0, &(0x7f0000000400)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0xd2fc122717fd56e5}, 0xc, &(0x7f00000003c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="480001001851d3808f9a081d51fb515a1ee9e0bedfc1256136aa4a16ec407232b3e4dd1976e00b27308272ed4ef723cf21802b5e2e8632a7ae957d0afd8727b96b0c9905f30003159e763e1d0101e99a997fc24c3759cea7627ba42bb737fee72e0b00014043e62480c576651174a1b195c35acac142134fb636320e9268614305f0c1de71ff07000000000000828364cfa40a3a2d89580000000000005bfa2db037d10ad923cb1c990021a55c20", @ANYBLOB="4e762b36e9fefe97c256207b91bd1d4904f93eae0ca1cea71fe0d2dd213847cfb403e1330aa9490a07659422da34658b696ca95b6abedcac98a4836b59c25ed9d0cd1587cd45f44970d14916743ad2d03f4395c7bcb6147d65b23a225a1077beee78807ef7ca2d3a380e7ecc7d9a29755aba8bffa7ca8df492d5afe0e53abc2dfeadce2ebe52b22c12ab1040e04db81cb2768b032af228c060ce141d7c293102475724a12363ccf18d48e63d", @ANYRES16=r3, @ANYRES32=r2, @ANYRES32=r1], 0x108}, 0x1, 0x0, 0x0, 0x20004894}, 0x440d0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r4, 0x0, 0x0) (async) sendmsg$NL80211_CMD_GET_SURVEY(r4, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x28, r1, 0x200, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x4, 0x25}}}}, [""]}, 0x28}, 0x1, 0x0, 0x0, 0x4000014}, 0x805) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r6, 0x0, 0x0) (async) setsockopt$RXRPC_UPGRADEABLE_SERVICE(r6, 0x110, 0x5, &(0x7f0000000280)=[0x1, 0x3], 0x2) (async) write$vga_arbiter(r5, 0x0, 0x0) (async) ioctl$EVIOCREVOKE(r5, 0x40044591, &(0x7f0000000040)=0x10000) (async) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) syz_open_dev$evdev(&(0x7f0000000080), 0x3, 0x400000) (async) ioctl$EVIOCGLED(r7, 0x80404519, &(0x7f00000000c0)=""/242) (async) 20:27:19 executing program 0: r0 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000004c0)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) sendmsg$IEEE802154_LLSEC_GETPARAMS(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20c02}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x54, r0, 0x0, 0x70bd2a, 0x25dfdbfc, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000004}, 0x20000000) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'wpan0\x00'}) sendmsg$NL802154_CMD_DEL_SEC_DEV(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f0000000540)=ANY=[@ANYBLOB="600000002679656a3e81fcb2997e6cf2c04fc90d495fc628927a0b13d94014e12b144b7c", @ANYRES16=0x0, @ANYBLOB="00012bbd0000050000001b000000000023800c0004000201aaaaaaaaaaaa100023800c0004000201aaaaaaaaaaaa100023800c00040000000000000000f30f0023800c00040000000000000000000c0006000000000000000000"], 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000010) r5 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f0000000240)={'wpan0\x00'}) r7 = syz_open_dev$sg(&(0x7f0000000200), 0x5, 0x111000) ioctl$SCSI_IOCTL_SEND_COMMAND(r5, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000000000000004000000284e6fa64de45efb25d608471a2f5686da3325a2c0fcc13924d2ad49b315f4cd3e2ca25c0e608d3f51bf389c82ec0bf841190d6f6113cd5ca17523b7fa0162256cab6b98f3d1da382cd4c7766ea61b563f9576f577596e5793079fb7d4a935161fe8819e7c3d785da02a83936924b8dbc32ed98792be041e961d9168dc79b5"]) ioctl$SG_SET_RESERVED_SIZE(r7, 0x2275, &(0x7f0000000280)=0x4) syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r6) ioctl$SG_GET_COMMAND_Q(r5, 0x1267, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r5, 0x2287, &(0x7f0000000000)) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x1) 20:27:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000007fffffff01"], 0x1c}}, 0x0) 20:27:19 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000180)=0x10000) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100), 0x4000, 0x0) ioctl$SG_GET_SCSI_ID(r1, 0x2276, &(0x7f0000000140)) 20:27:19 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x40c5c2) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r0, 0x2) 20:27:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000009effffff01"], 0x1c}}, 0x0) 20:27:19 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) 20:27:19 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) 20:27:19 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x40c5c2) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r0, 0x2) 20:27:19 executing program 3: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) sendmsg$NL80211_CMD_SET_COALESCE(r0, &(0x7f0000000400)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0xd2fc122717fd56e5}, 0xc, &(0x7f00000003c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="480001001851d3808f9a081d51fb515a1ee9e0bedfc1256136aa4a16ec407232b3e4dd1976e00b27308272ed4ef723cf21802b5e2e8632a7ae957d0afd8727b96b0c9905f30003159e763e1d0101e99a997fc24c3759cea7627ba42bb737fee72e0b00014043e62480c576651174a1b195c35acac142134fb636320e9268614305f0c1de71ff07000000000000828364cfa40a3a2d89580000000000005bfa2db037d10ad923cb1c990021a55c20", @ANYBLOB="4e762b36e9fefe97c256207b91bd1d4904f93eae0ca1cea71fe0d2dd213847cfb403e1330aa9490a07659422da34658b696ca95b6abedcac98a4836b59c25ed9d0cd1587cd45f44970d14916743ad2d03f4395c7bcb6147d65b23a225a1077beee78807ef7ca2d3a380e7ecc7d9a29755aba8bffa7ca8df492d5afe0e53abc2dfeadce2ebe52b22c12ab1040e04db81cb2768b032af228c060ce141d7c293102475724a12363ccf18d48e63d", @ANYRES16=r3, @ANYRES32=r2, @ANYRES32=r1], 0x108}, 0x1, 0x0, 0x0, 0x20004894}, 0x440d0) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r4, 0x0, 0x0) sendmsg$NL80211_CMD_GET_SURVEY(r4, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x28, r1, 0x200, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x4, 0x25}}}}, [""]}, 0x28}, 0x1, 0x0, 0x0, 0x4000014}, 0x805) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r6, 0x0, 0x0) setsockopt$RXRPC_UPGRADEABLE_SERVICE(r6, 0x110, 0x5, &(0x7f0000000280)=[0x1, 0x3], 0x2) write$vga_arbiter(r5, 0x0, 0x0) ioctl$EVIOCREVOKE(r5, 0x40044591, &(0x7f0000000040)=0x10000) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r7 = syz_open_dev$evdev(&(0x7f0000000080), 0x3, 0x400000) ioctl$EVIOCGLED(r7, 0x80404519, &(0x7f00000000c0)=""/242) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r0, 0x0, 0x0) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'wlan1\x00'}) (async) socket$inet6_sctp(0xa, 0x5, 0x84) (async) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) (async) sendmsg$NL80211_CMD_SET_COALESCE(r0, &(0x7f0000000400)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0xd2fc122717fd56e5}, 0xc, &(0x7f00000003c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="480001001851d3808f9a081d51fb515a1ee9e0bedfc1256136aa4a16ec407232b3e4dd1976e00b27308272ed4ef723cf21802b5e2e8632a7ae957d0afd8727b96b0c9905f30003159e763e1d0101e99a997fc24c3759cea7627ba42bb737fee72e0b00014043e62480c576651174a1b195c35acac142134fb636320e9268614305f0c1de71ff07000000000000828364cfa40a3a2d89580000000000005bfa2db037d10ad923cb1c990021a55c20", @ANYBLOB="4e762b36e9fefe97c256207b91bd1d4904f93eae0ca1cea71fe0d2dd213847cfb403e1330aa9490a07659422da34658b696ca95b6abedcac98a4836b59c25ed9d0cd1587cd45f44970d14916743ad2d03f4395c7bcb6147d65b23a225a1077beee78807ef7ca2d3a380e7ecc7d9a29755aba8bffa7ca8df492d5afe0e53abc2dfeadce2ebe52b22c12ab1040e04db81cb2768b032af228c060ce141d7c293102475724a12363ccf18d48e63d", @ANYRES16=r3, @ANYRES32=r2, @ANYRES32=r1], 0x108}, 0x1, 0x0, 0x0, 0x20004894}, 0x440d0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r4, 0x0, 0x0) (async) sendmsg$NL80211_CMD_GET_SURVEY(r4, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x28, r1, 0x200, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x4, 0x25}}}}, [""]}, 0x28}, 0x1, 0x0, 0x0, 0x4000014}, 0x805) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r6, 0x0, 0x0) (async) setsockopt$RXRPC_UPGRADEABLE_SERVICE(r6, 0x110, 0x5, &(0x7f0000000280)=[0x1, 0x3], 0x2) (async) write$vga_arbiter(r5, 0x0, 0x0) (async) ioctl$EVIOCREVOKE(r5, 0x40044591, &(0x7f0000000040)=0x10000) (async) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) syz_open_dev$evdev(&(0x7f0000000080), 0x3, 0x400000) (async) ioctl$EVIOCGLED(r7, 0x80404519, &(0x7f00000000c0)=""/242) (async) 20:27:19 executing program 0: r0 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000004c0)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) sendmsg$IEEE802154_LLSEC_GETPARAMS(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20c02}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x54, r0, 0x0, 0x70bd2a, 0x25dfdbfc, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000004}, 0x20000000) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'wpan0\x00'}) sendmsg$NL802154_CMD_DEL_SEC_DEV(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f0000000540)=ANY=[@ANYBLOB="600000002679656a3e81fcb2997e6cf2c04fc90d495fc628927a0b13d94014e12b144b7c", @ANYRES16=0x0, @ANYBLOB="00012bbd0000050000001b000000000023800c0004000201aaaaaaaaaaaa100023800c0004000201aaaaaaaaaaaa100023800c00040000000000000000f30f0023800c00040000000000000000000c0006000000000000000000"], 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000010) r5 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f0000000240)={'wpan0\x00'}) r7 = syz_open_dev$sg(&(0x7f0000000200), 0x5, 0x111000) ioctl$SCSI_IOCTL_SEND_COMMAND(r5, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000000000000004000000284e6fa64de45efb25d608471a2f5686da3325a2c0fcc13924d2ad49b315f4cd3e2ca25c0e608d3f51bf389c82ec0bf841190d6f6113cd5ca17523b7fa0162256cab6b98f3d1da382cd4c7766ea61b563f9576f577596e5793079fb7d4a935161fe8819e7c3d785da02a83936924b8dbc32ed98792be041e961d9168dc79b5"]) ioctl$SG_SET_RESERVED_SIZE(r7, 0x2275, &(0x7f0000000280)=0x4) syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r6) ioctl$SG_GET_COMMAND_Q(r5, 0x1267, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r5, 0x2287, &(0x7f0000000000)) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x1) 20:27:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000efffffff01"], 0x1c}}, 0x0) 20:27:19 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000180)=0x10000) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100), 0x4000, 0x0) [ 2131.759304][ T797] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO 20:27:19 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) 20:27:19 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x2, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0), 0x24400, 0x0) ioctl$SG_SET_DEBUG(r2, 0x227e, &(0x7f0000000100)) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f0000000040)) ioctl$SCSI_IOCTL_GET_PCI(r0, 0x5387, &(0x7f0000000080)) 20:27:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000f0ffffff01"], 0x1c}}, 0x0) 20:27:19 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000180)=0x10000) 20:27:19 executing program 5: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) 20:27:19 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x2, 0x0) (async, rerun: 32) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (rerun: 32) write$vga_arbiter(r1, 0x0, 0x0) (async) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0), 0x24400, 0x0) ioctl$SG_SET_DEBUG(r2, 0x227e, &(0x7f0000000100)) (async, rerun: 32) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f0000000040)) (async, rerun: 32) ioctl$SCSI_IOCTL_GET_PCI(r0, 0x5387, &(0x7f0000000080)) 20:27:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000400"], 0x1c}}, 0x0) 20:27:19 executing program 5: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) [ 2131.848683][ T833] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO 20:27:19 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x2000) syz_open_dev$sg(&(0x7f0000000040), 0xcfef, 0x101002) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000280)={r0, r0, 0xf}, 0x10) bpf$ITER_CREATE(0x21, &(0x7f00000002c0)={r1}, 0x8) write$vga_arbiter(r0, 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200), 0x901000, 0x0) sendmsg$AUDIT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x10, 0x3e8, 0x200, 0x70bd27, 0x25dfdc02, "", ["", "", "", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x8000}, 0x20000894) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) ioctl$SG_NEXT_CMD_LEN(r3, 0x2283, &(0x7f0000000240)=0xc1) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) ioctl$PTP_PIN_SETFUNC2(0xffffffffffffffff, 0x40603d10, &(0x7f0000000080)={'\x00', 0x2, 0x1, 0x7f}) 20:27:19 executing program 0: r0 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000004c0)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) sendmsg$IEEE802154_LLSEC_GETPARAMS(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20c02}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x54, r0, 0x0, 0x70bd2a, 0x25dfdbfc, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000004}, 0x20000000) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'wpan0\x00'}) sendmsg$NL802154_CMD_DEL_SEC_DEV(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f0000000540)=ANY=[@ANYBLOB="600000002679656a3e81fcb2997e6cf2c04fc90d495fc628927a0b13d94014e12b144b7c", @ANYRES16=0x0, @ANYBLOB="00012bbd0000050000001b000000000023800c0004000201aaaaaaaaaaaa100023800c0004000201aaaaaaaaaaaa100023800c00040000000000000000f30f0023800c00040000000000000000000c0006000000000000000000"], 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000010) r5 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f0000000240)={'wpan0\x00'}) r7 = syz_open_dev$sg(&(0x7f0000000200), 0x5, 0x111000) ioctl$SCSI_IOCTL_SEND_COMMAND(r5, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000000000000004000000284e6fa64de45efb25d608471a2f5686da3325a2c0fcc13924d2ad49b315f4cd3e2ca25c0e608d3f51bf389c82ec0bf841190d6f6113cd5ca17523b7fa0162256cab6b98f3d1da382cd4c7766ea61b563f9576f577596e5793079fb7d4a935161fe8819e7c3d785da02a83936924b8dbc32ed98792be041e961d9168dc79b5"]) ioctl$SG_SET_RESERVED_SIZE(r7, 0x2275, &(0x7f0000000280)=0x4) syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r6) ioctl$SG_GET_COMMAND_Q(r5, 0x1267, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r5, 0x2287, &(0x7f0000000000)) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x1) 20:27:19 executing program 1: ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000180)=0x10000) 20:27:19 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x2, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0), 0x24400, 0x0) ioctl$SG_SET_DEBUG(r2, 0x227e, &(0x7f0000000100)) (async) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f0000000040)) ioctl$SCSI_IOCTL_GET_PCI(r0, 0x5387, &(0x7f0000000080)) 20:27:19 executing program 5: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) 20:27:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000002000001"], 0x1c}}, 0x0) 20:27:19 executing program 2: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x83a, 0x20000) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000080)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) ioctl$ifreq_SIOCGIFINDEX_wireguard(r2, 0x8933, &(0x7f0000000140)={'wg2\x00'}) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000100)) syz_open_dev$sg(&(0x7f0000000000), 0x80, 0x101080) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f00000000c0)) 20:27:19 executing program 1: ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000180)=0x10000) 20:27:19 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x2000) syz_open_dev$sg(&(0x7f0000000040), 0xcfef, 0x101002) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000280)={r0, r0, 0xf}, 0x10) bpf$ITER_CREATE(0x21, &(0x7f00000002c0)={r1}, 0x8) write$vga_arbiter(r0, 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200), 0x901000, 0x0) sendmsg$AUDIT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x10, 0x3e8, 0x200, 0x70bd27, 0x25dfdc02, "", ["", "", "", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x8000}, 0x20000894) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) ioctl$SG_NEXT_CMD_LEN(r3, 0x2283, &(0x7f0000000240)=0xc1) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) ioctl$PTP_PIN_SETFUNC2(0xffffffffffffffff, 0x40603d10, &(0x7f0000000080)={'\x00', 0x2, 0x1, 0x7f}) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x2000) (async) syz_open_dev$sg(&(0x7f0000000040), 0xcfef, 0x101002) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000280)={r0, r0, 0xf}, 0x10) (async) bpf$ITER_CREATE(0x21, &(0x7f00000002c0)={r1}, 0x8) (async) write$vga_arbiter(r0, 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200), 0x901000, 0x0) (async) sendmsg$AUDIT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x10, 0x3e8, 0x200, 0x70bd27, 0x25dfdc02, "", ["", "", "", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x8000}, 0x20000894) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r3, 0x0, 0x0) (async) ioctl$SG_NEXT_CMD_LEN(r3, 0x2283, &(0x7f0000000240)=0xc1) (async) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) (async) ioctl$PTP_PIN_SETFUNC2(0xffffffffffffffff, 0x40603d10, &(0x7f0000000080)={'\x00', 0x2, 0x1, 0x7f}) (async) 20:27:19 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) (fail_nth: 1) 20:27:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000003000001"], 0x1c}}, 0x0) 20:27:19 executing program 2: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) (async) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x83a, 0x20000) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000080)) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async, rerun: 32) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) (rerun: 32) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r2, 0x8933, &(0x7f0000000140)={'wg2\x00'}) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000100)) syz_open_dev$sg(&(0x7f0000000000), 0x80, 0x101080) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f00000000c0)) 20:27:19 executing program 1: ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000180)=0x10000) 20:27:19 executing program 0: r0 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000004c0)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) sendmsg$IEEE802154_LLSEC_GETPARAMS(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20c02}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x54, r0, 0x0, 0x70bd2a, 0x25dfdbfc, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000004}, 0x20000000) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'wpan0\x00'}) sendmsg$NL802154_CMD_DEL_SEC_DEV(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f0000000540)=ANY=[@ANYBLOB="600000002679656a3e81fcb2997e6cf2c04fc90d495fc628927a0b13d94014e12b144b7c", @ANYRES16=0x0, @ANYBLOB="00012bbd0000050000001b000000000023800c0004000201aaaaaaaaaaaa100023800c0004000201aaaaaaaaaaaa100023800c00040000000000000000f30f0023800c00040000000000000000000c0006000000000000000000"], 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000010) r5 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f0000000240)={'wpan0\x00'}) r7 = syz_open_dev$sg(&(0x7f0000000200), 0x5, 0x111000) ioctl$SCSI_IOCTL_SEND_COMMAND(r5, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000000000000004000000284e6fa64de45efb25d608471a2f5686da3325a2c0fcc13924d2ad49b315f4cd3e2ca25c0e608d3f51bf389c82ec0bf841190d6f6113cd5ca17523b7fa0162256cab6b98f3d1da382cd4c7766ea61b563f9576f577596e5793079fb7d4a935161fe8819e7c3d785da02a83936924b8dbc32ed98792be041e961d9168dc79b5"]) ioctl$SG_SET_RESERVED_SIZE(r7, 0x2275, &(0x7f0000000280)=0x4) syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r6) ioctl$SG_GET_COMMAND_Q(r5, 0x1267, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r5, 0x2287, &(0x7f0000000000)) 20:27:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000004000001"], 0x1c}}, 0x0) [ 2131.962401][ T882] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2132.012012][ T887] FAULT_INJECTION: forcing a failure. [ 2132.012012][ T887] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2132.025172][ T887] CPU: 0 PID: 887 Comm: syz-executor.5 Not tainted 5.17.0-rc1-syzkaller #0 [ 2132.033773][ T887] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2132.043844][ T887] Call Trace: [ 2132.047161][ T887] [ 2132.050097][ T887] dump_stack_lvl+0xd6/0x122 [ 2132.054740][ T887] dump_stack+0x11/0x1b [ 2132.059520][ T887] should_fail+0x23c/0x250 [ 2132.063973][ T887] should_fail_usercopy+0x16/0x20 [ 2132.069042][ T887] _copy_to_user+0x1c/0x90 [ 2132.073467][ T887] simple_read_from_buffer+0xab/0x120 [ 2132.078859][ T887] proc_fail_nth_read+0x10d/0x150 [ 2132.083936][ T887] ? proc_fault_inject_write+0x230/0x230 [ 2132.089659][ T887] vfs_read+0x1e6/0x750 [ 2132.093825][ T887] ? __fget_files+0x1d2/0x210 [ 2132.098516][ T887] ksys_read+0xd9/0x190 [ 2132.102764][ T887] __x64_sys_read+0x3e/0x50 [ 2132.107296][ T887] do_syscall_64+0x44/0xd0 20:27:19 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x2000) syz_open_dev$sg(&(0x7f0000000040), 0xcfef, 0x101002) (async) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000280)={r0, r0, 0xf}, 0x10) bpf$ITER_CREATE(0x21, &(0x7f00000002c0)={r1}, 0x8) write$vga_arbiter(r0, 0x0, 0x0) (async) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200), 0x901000, 0x0) sendmsg$AUDIT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x10, 0x3e8, 0x200, 0x70bd27, 0x25dfdc02, "", ["", "", "", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x8000}, 0x20000894) (async, rerun: 64) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (rerun: 64) write$vga_arbiter(r3, 0x0, 0x0) ioctl$SG_NEXT_CMD_LEN(r3, 0x2283, &(0x7f0000000240)=0xc1) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) (async) ioctl$PTP_PIN_SETFUNC2(0xffffffffffffffff, 0x40603d10, &(0x7f0000000080)={'\x00', 0x2, 0x1, 0x7f}) 20:27:19 executing program 1: r0 = syz_open_dev$sg(0x0, 0x0, 0x82) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000180)=0x10000) 20:27:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000005000001"], 0x1c}}, 0x0) 20:27:19 executing program 1: r0 = syz_open_dev$sg(0x0, 0x0, 0x82) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000180)=0x10000) 20:27:20 executing program 1: r0 = syz_open_dev$sg(0x0, 0x0, 0x82) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000180)=0x10000) 20:27:20 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000180)=0x10000) [ 2132.111723][ T887] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2132.117640][ T887] RIP: 0033:0x7f26599f1c0c [ 2132.122065][ T887] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 [ 2132.141723][ T887] RSP: 002b:00007f2658bb5160 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2132.150153][ T887] RAX: ffffffffffffffda RBX: 00007f2659b51f60 RCX: 00007f26599f1c0c 20:27:20 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) 20:27:20 executing program 2: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) (async) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x83a, 0x20000) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000080)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) (async, rerun: 64) ioctl$ifreq_SIOCGIFINDEX_wireguard(r2, 0x8933, &(0x7f0000000140)={'wg2\x00'}) (async, rerun: 64) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000100)) (async) syz_open_dev$sg(&(0x7f0000000000), 0x80, 0x101080) (async, rerun: 32) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f00000000c0)) (rerun: 32) 20:27:20 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000006000001"], 0x1c}}, 0x0) 20:27:20 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000180)=0x10000) 20:27:20 executing program 0: r0 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000004c0)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) sendmsg$IEEE802154_LLSEC_GETPARAMS(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20c02}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x54, r0, 0x0, 0x70bd2a, 0x25dfdbfc, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000004}, 0x20000000) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'wpan0\x00'}) sendmsg$NL802154_CMD_DEL_SEC_DEV(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f0000000540)=ANY=[@ANYBLOB="600000002679656a3e81fcb2997e6cf2c04fc90d495fc628927a0b13d94014e12b144b7c", @ANYRES16=0x0, @ANYBLOB="00012bbd0000050000001b000000000023800c0004000201aaaaaaaaaaaa100023800c0004000201aaaaaaaaaaaa100023800c00040000000000000000f30f0023800c00040000000000000000000c0006000000000000000000"], 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000010) r5 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f0000000240)={'wpan0\x00'}) r7 = syz_open_dev$sg(&(0x7f0000000200), 0x5, 0x111000) ioctl$SCSI_IOCTL_SEND_COMMAND(r5, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000000000000004000000284e6fa64de45efb25d608471a2f5686da3325a2c0fcc13924d2ad49b315f4cd3e2ca25c0e608d3f51bf389c82ec0bf841190d6f6113cd5ca17523b7fa0162256cab6b98f3d1da382cd4c7766ea61b563f9576f577596e5793079fb7d4a935161fe8819e7c3d785da02a83936924b8dbc32ed98792be041e961d9168dc79b5"]) ioctl$SG_SET_RESERVED_SIZE(r7, 0x2275, &(0x7f0000000280)=0x4) syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r6) ioctl$SG_GET_COMMAND_Q(r5, 0x1267, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r5, 0x2287, &(0x7f0000000000)) 20:27:20 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x2) [ 2132.158113][ T887] RDX: 000000000000000f RSI: 00007f2658bb51e0 RDI: 0000000000000004 [ 2132.166082][ T887] RBP: 00007f2658bb51d0 R08: 0000000000000000 R09: 0000000000000000 [ 2132.174057][ T887] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2132.182021][ T887] R13: 00007fff21e93d5f R14: 00007f2658bb5300 R15: 0000000000022000 [ 2132.190029][ T887] 20:27:20 executing program 1: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000180)=0x10000) 20:27:20 executing program 3: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) sendmsg$ETHTOOL_MSG_RINGS_SET(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x110b000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYRESHEX=r0], 0x3c}, 0x1, 0x0, 0x0, 0x21f9a2e6757cc001}, 0x8) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs2/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) 20:27:20 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5) 20:27:20 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000007000001"], 0x1c}}, 0x0) 20:27:20 executing program 1: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000180)=0x10000) 20:27:20 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000008000001"], 0x1c}}, 0x0) 20:27:20 executing program 3: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) sendmsg$ETHTOOL_MSG_RINGS_SET(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x110b000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYRESHEX=r0], 0x3c}, 0x1, 0x0, 0x0, 0x21f9a2e6757cc001}, 0x8) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs2/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) sendmsg$ETHTOOL_MSG_RINGS_SET(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x110b000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYRESHEX=r0], 0x3c}, 0x1, 0x0, 0x0, 0x21f9a2e6757cc001}, 0x8) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs2/binder1\x00', 0x0, 0x0) (async) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) (async) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) [ 2132.260028][ T945] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2132.286120][ T954] program syz-executor.5 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2132.317213][ T954] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 20:27:20 executing program 2: ioctl$IMGETDEVINFO(0xffffffffffffffff, 0x80044944, &(0x7f0000000000)={0x1}) syz_open_dev$sg(&(0x7f0000000040), 0x5b, 0x82) r0 = syz_open_dev$sg(&(0x7f0000000080), 0x81, 0x2) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) 20:27:20 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000009000001"], 0x1c}}, 0x0) 20:27:20 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x6) 20:27:20 executing program 0: r0 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000004c0)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) sendmsg$IEEE802154_LLSEC_GETPARAMS(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20c02}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x54, r0, 0x0, 0x70bd2a, 0x25dfdbfc, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000004}, 0x20000000) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'wpan0\x00'}) sendmsg$NL802154_CMD_DEL_SEC_DEV(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f0000000540)=ANY=[@ANYBLOB="600000002679656a3e81fcb2997e6cf2c04fc90d495fc628927a0b13d94014e12b144b7c", @ANYRES16=0x0, @ANYBLOB="00012bbd0000050000001b000000000023800c0004000201aaaaaaaaaaaa100023800c0004000201aaaaaaaaaaaa100023800c00040000000000000000f30f0023800c00040000000000000000000c0006000000000000000000"], 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000010) r5 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f0000000240)={'wpan0\x00'}) r7 = syz_open_dev$sg(&(0x7f0000000200), 0x5, 0x111000) ioctl$SCSI_IOCTL_SEND_COMMAND(r5, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000000000000004000000284e6fa64de45efb25d608471a2f5686da3325a2c0fcc13924d2ad49b315f4cd3e2ca25c0e608d3f51bf389c82ec0bf841190d6f6113cd5ca17523b7fa0162256cab6b98f3d1da382cd4c7766ea61b563f9576f577596e5793079fb7d4a935161fe8819e7c3d785da02a83936924b8dbc32ed98792be041e961d9168dc79b5"]) ioctl$SG_SET_RESERVED_SIZE(r7, 0x2275, &(0x7f0000000280)=0x4) syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r6) ioctl$SG_GET_COMMAND_Q(r5, 0x1267, 0x0) 20:27:20 executing program 2: ioctl$IMGETDEVINFO(0xffffffffffffffff, 0x80044944, &(0x7f0000000000)={0x1}) syz_open_dev$sg(&(0x7f0000000040), 0x5b, 0x82) (async, rerun: 32) r0 = syz_open_dev$sg(&(0x7f0000000080), 0x81, 0x2) (rerun: 32) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) 20:27:21 executing program 2: ioctl$IMGETDEVINFO(0xffffffffffffffff, 0x80044944, &(0x7f0000000000)={0x1}) (async) syz_open_dev$sg(&(0x7f0000000040), 0x5b, 0x82) (async) r0 = syz_open_dev$sg(&(0x7f0000000080), 0x81, 0x2) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) 20:27:21 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000000a000001"], 0x1c}}, 0x0) 20:27:21 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x4, 0x2) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000080)) 20:27:21 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000000b000001"], 0x1c}}, 0x0) [ 2133.059183][ T1104] __nla_validate_parse: 49 callbacks suppressed [ 2133.059194][ T1104] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2133.091737][ T1122] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:21 executing program 1: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000180)=0x10000) 20:27:21 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000000c000001"], 0x1c}}, 0x0) 20:27:21 executing program 3: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) sendmsg$ETHTOOL_MSG_RINGS_SET(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x110b000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYRESHEX=r0], 0x3c}, 0x1, 0x0, 0x0, 0x21f9a2e6757cc001}, 0x8) (async) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs2/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) (async) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) 20:27:21 executing program 0: r0 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000004c0)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) sendmsg$IEEE802154_LLSEC_GETPARAMS(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20c02}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x54, r0, 0x0, 0x70bd2a, 0x25dfdbfc, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000004}, 0x20000000) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'wpan0\x00'}) sendmsg$NL802154_CMD_DEL_SEC_DEV(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f0000000540)=ANY=[@ANYBLOB="600000002679656a3e81fcb2997e6cf2c04fc90d495fc628927a0b13d94014e12b144b7c", @ANYRES16=0x0, @ANYBLOB="00012bbd0000050000001b000000000023800c0004000201aaaaaaaaaaaa100023800c0004000201aaaaaaaaaaaa100023800c00040000000000000000f30f0023800c00040000000000000000000c0006000000000000000000"], 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000010) r5 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f0000000240)={'wpan0\x00'}) r7 = syz_open_dev$sg(&(0x7f0000000200), 0x5, 0x111000) ioctl$SCSI_IOCTL_SEND_COMMAND(r5, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000000000000004000000284e6fa64de45efb25d608471a2f5686da3325a2c0fcc13924d2ad49b315f4cd3e2ca25c0e608d3f51bf389c82ec0bf841190d6f6113cd5ca17523b7fa0162256cab6b98f3d1da382cd4c7766ea61b563f9576f577596e5793079fb7d4a935161fe8819e7c3d785da02a83936924b8dbc32ed98792be041e961d9168dc79b5"]) ioctl$SG_SET_RESERVED_SIZE(r7, 0x2275, &(0x7f0000000280)=0x4) syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r6) ioctl$SG_GET_COMMAND_Q(r5, 0x1267, 0x0) 20:27:21 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x1267) 20:27:21 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, 0x0) 20:27:21 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x4, 0x2) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000080)) 20:27:21 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x1274) [ 2133.112528][ T1128] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2133.145641][ T1130] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:21 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000000d000001"], 0x1c}}, 0x0) 20:27:21 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, 0x0) 20:27:21 executing program 3: r0 = socket(0xa, 0x6, 0x0) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x29, 0x21, 0x0, 0x4) r1 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_TTY(r1, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="2e00001ec25a8930b0061159cbf5f0fa2b3613045443bc2a00000000"], 0x10}}, 0x0) sendmsg$AUDIT_TRIM(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40081c0}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x10, 0x3f6, 0x800, 0x70bd2b, 0x24dedbfd, "", ["", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x44000}, 0x24000884) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) ioctl$ifreq_SIOCGIFINDEX_wireguard(r2, 0x8933, &(0x7f0000000180)={'wg1\x00'}) 20:27:21 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, 0x0) 20:27:21 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000000e000001"], 0x1c}}, 0x0) 20:27:21 executing program 0: r0 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000004c0)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) sendmsg$IEEE802154_LLSEC_GETPARAMS(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20c02}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x54, r0, 0x0, 0x70bd2a, 0x25dfdbfc, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000004}, 0x20000000) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'wpan0\x00'}) sendmsg$NL802154_CMD_DEL_SEC_DEV(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f0000000540)=ANY=[@ANYBLOB="600000002679656a3e81fcb2997e6cf2c04fc90d495fc628927a0b13d94014e12b144b7c", @ANYRES16=0x0, @ANYBLOB="00012bbd0000050000001b000000000023800c0004000201aaaaaaaaaaaa100023800c0004000201aaaaaaaaaaaa100023800c00040000000000000000f30f0023800c00040000000000000000000c0006000000000000000000"], 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000010) r5 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f0000000240)={'wpan0\x00'}) r7 = syz_open_dev$sg(&(0x7f0000000200), 0x5, 0x111000) ioctl$SCSI_IOCTL_SEND_COMMAND(r5, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000000000000004000000284e6fa64de45efb25d608471a2f5686da3325a2c0fcc13924d2ad49b315f4cd3e2ca25c0e608d3f51bf389c82ec0bf841190d6f6113cd5ca17523b7fa0162256cab6b98f3d1da382cd4c7766ea61b563f9576f577596e5793079fb7d4a935161fe8819e7c3d785da02a83936924b8dbc32ed98792be041e961d9168dc79b5"]) ioctl$SG_SET_RESERVED_SIZE(r7, 0x2275, &(0x7f0000000280)=0x4) syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r6) 20:27:21 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x4, 0x2) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000080)) [ 2133.201400][ T1138] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2133.219116][ T1149] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:21 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x1275) 20:27:21 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000000f000001"], 0x1c}}, 0x0) 20:27:21 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x1276) 20:27:21 executing program 3: r0 = socket(0xa, 0x6, 0x0) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x29, 0x21, 0x0, 0x4) r1 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_TTY(r1, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="2e00001ec25a8930b0061159cbf5f0fa2b3613045443bc2a00000000"], 0x10}}, 0x0) sendmsg$AUDIT_TRIM(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40081c0}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x10, 0x3f6, 0x800, 0x70bd2b, 0x24dedbfd, "", ["", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x44000}, 0x24000884) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) ioctl$ifreq_SIOCGIFINDEX_wireguard(r2, 0x8933, &(0x7f0000000180)={'wg1\x00'}) socket(0xa, 0x6, 0x0) (async) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x29, 0x21, 0x0, 0x4) (async) socket$nl_audit(0x10, 0x3, 0x9) (async) sendmsg$AUDIT_USER_TTY(r1, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="2e00001ec25a8930b0061159cbf5f0fa2b3613045443bc2a00000000"], 0x10}}, 0x0) (async) sendmsg$AUDIT_TRIM(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40081c0}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x10, 0x3f6, 0x800, 0x70bd2b, 0x24dedbfd, "", ["", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x44000}, 0x24000884) (async) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) socket$inet6_sctp(0xa, 0x5, 0x84) (async) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r2, 0x8933, &(0x7f0000000180)={'wg1\x00'}) (async) [ 2133.256941][ T1163] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2133.282292][ T1156] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO 20:27:21 executing program 0: r0 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000004c0)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) sendmsg$IEEE802154_LLSEC_GETPARAMS(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20c02}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x54, r0, 0x0, 0x70bd2a, 0x25dfdbfc, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000004}, 0x20000000) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'wpan0\x00'}) sendmsg$NL802154_CMD_DEL_SEC_DEV(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f0000000540)=ANY=[@ANYBLOB="600000002679656a3e81fcb2997e6cf2c04fc90d495fc628927a0b13d94014e12b144b7c", @ANYRES16=0x0, @ANYBLOB="00012bbd0000050000001b000000000023800c0004000201aaaaaaaaaaaa100023800c0004000201aaaaaaaaaaaa100023800c00040000000000000000f30f0023800c00040000000000000000000c0006000000000000000000"], 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000010) r5 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f0000000240)={'wpan0\x00'}) r7 = syz_open_dev$sg(&(0x7f0000000200), 0x5, 0x111000) ioctl$SCSI_IOCTL_SEND_COMMAND(r5, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000000000000004000000284e6fa64de45efb25d608471a2f5686da3325a2c0fcc13924d2ad49b315f4cd3e2ca25c0e608d3f51bf389c82ec0bf841190d6f6113cd5ca17523b7fa0162256cab6b98f3d1da382cd4c7766ea61b563f9576f577596e5793079fb7d4a935161fe8819e7c3d785da02a83936924b8dbc32ed98792be041e961d9168dc79b5"]) ioctl$SG_SET_RESERVED_SIZE(r7, 0x2275, &(0x7f0000000280)=0x4) 20:27:21 executing program 2: r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f0000000080)) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f00000000c0)=0x81) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f0000000140)) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000100)=0x8) 20:27:21 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000180)) 20:27:21 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000010000001"], 0x1c}}, 0x0) [ 2133.300153][ T1168] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:21 executing program 2: r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f0000000080)) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f00000000c0)=0x81) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f0000000140)) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000100)=0x8) bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) (async) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f0000000080)) (async) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f00000000c0)=0x81) (async) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f0000000140)) (async) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000100)=0x8) (async) 20:27:21 executing program 3: r0 = socket(0xa, 0x6, 0x0) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x29, 0x21, 0x0, 0x4) (async) r1 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_TTY(r1, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="2e00001ec25a8930b0061159cbf5f0fa2b3613045443bc2a00000000"], 0x10}}, 0x0) sendmsg$AUDIT_TRIM(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40081c0}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x10, 0x3f6, 0x800, 0x70bd2b, 0x24dedbfd, "", ["", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x44000}, 0x24000884) (async) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r2, 0x8933, &(0x7f0000000180)={'wg1\x00'}) 20:27:21 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000011000001"], 0x1c}}, 0x0) 20:27:21 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000180)) 20:27:21 executing program 0: r0 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000004c0)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) sendmsg$IEEE802154_LLSEC_GETPARAMS(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20c02}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x54, r0, 0x0, 0x70bd2a, 0x25dfdbfc, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000004}, 0x20000000) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'wpan0\x00'}) sendmsg$NL802154_CMD_DEL_SEC_DEV(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f0000000540)=ANY=[@ANYBLOB="600000002679656a3e81fcb2997e6cf2c04fc90d495fc628927a0b13d94014e12b144b7c", @ANYRES16=0x0, @ANYBLOB="00012bbd0000050000001b000000000023800c0004000201aaaaaaaaaaaa100023800c0004000201aaaaaaaaaaaa100023800c00040000000000000000f30f0023800c00040000000000000000000c0006000000000000000000"], 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000010) r5 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f0000000240)={'wpan0\x00'}) syz_open_dev$sg(&(0x7f0000000200), 0x5, 0x111000) ioctl$SCSI_IOCTL_SEND_COMMAND(r5, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000000000000004000000284e6fa64de45efb25d608471a2f5686da3325a2c0fcc13924d2ad49b315f4cd3e2ca25c0e608d3f51bf389c82ec0bf841190d6f6113cd5ca17523b7fa0162256cab6b98f3d1da382cd4c7766ea61b563f9576f577596e5793079fb7d4a935161fe8819e7c3d785da02a83936924b8dbc32ed98792be041e961d9168dc79b5"]) 20:27:21 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000012000001"], 0x1c}}, 0x0) [ 2133.339603][ T1182] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2133.349567][ T1177] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2133.378906][ T1202] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2133.397818][ T1208] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:22 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x2201) 20:27:22 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000025000001"], 0x1c}}, 0x0) 20:27:22 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000048000001"], 0x1c}}, 0x0) 20:27:22 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000004c000001"], 0x1c}}, 0x0) 20:27:22 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000060000001"], 0x1c}}, 0x0) 20:27:22 executing program 2: r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f0000000080)) (async) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f00000000c0)=0x81) (async) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f0000000140)) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000100)=0x8) 20:27:22 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000180)) 20:27:22 executing program 3: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000040)=0x6) syz_open_dev$sg(&(0x7f00000000c0), 0x0, 0x60082) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x20000) ioctl$SG_GET_RESERVED_SIZE(r1, 0x2272, &(0x7f0000000080)) 20:27:22 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x2202) 20:27:22 executing program 0: r0 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000004c0)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) sendmsg$IEEE802154_LLSEC_GETPARAMS(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20c02}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x54, r0, 0x0, 0x70bd2a, 0x25dfdbfc, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000004}, 0x20000000) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'wpan0\x00'}) sendmsg$NL802154_CMD_DEL_SEC_DEV(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f0000000540)=ANY=[@ANYBLOB="600000002679656a3e81fcb2997e6cf2c04fc90d495fc628927a0b13d94014e12b144b7c", @ANYRES16=0x0, @ANYBLOB="00012bbd0000050000001b000000000023800c0004000201aaaaaaaaaaaa100023800c0004000201aaaaaaaaaaaa100023800c00040000000000000000f30f0023800c00040000000000000000000c0006000000000000000000"], 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000010) r5 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f0000000240)={'wpan0\x00'}) syz_open_dev$sg(&(0x7f0000000200), 0x5, 0x111000) ioctl$SCSI_IOCTL_SEND_COMMAND(r5, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000000000000004000000284e6fa64de45efb25d608471a2f5686da3325a2c0fcc13924d2ad49b315f4cd3e2ca25c0e608d3f51bf389c82ec0bf841190d6f6113cd5ca17523b7fa0162256cab6b98f3d1da382cd4c7766ea61b563f9576f577596e5793079fb7d4a935161fe8819e7c3d785da02a83936924b8dbc32ed98792be041e961d9168dc79b5"]) 20:27:22 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000068000001"], 0x1c}}, 0x0) 20:27:22 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x18082) 20:27:22 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000006c000001"], 0x1c}}, 0x0) 20:27:22 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x2201) 20:27:22 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x18082) 20:27:22 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000074000001"], 0x1c}}, 0x0) 20:27:22 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x18082) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x18082) (async) 20:27:22 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000007a000001"], 0x1c}}, 0x0) 20:27:22 executing program 2: modify_ldt$write2(0x11, &(0x7f0000000040)={0x8, 0x20000000, 0x4000, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}, 0x10) syz_open_dev$sg(&(0x7f0000000080), 0x10001, 0x2) 20:27:23 executing program 3: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) (async) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000040)=0x6) (async) syz_open_dev$sg(&(0x7f00000000c0), 0x0, 0x60082) (async) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x20000) ioctl$SG_GET_RESERVED_SIZE(r1, 0x2272, &(0x7f0000000080)) 20:27:23 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x2203) 20:27:23 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000030001"], 0x1c}}, 0x0) 20:27:23 executing program 2: modify_ldt$write2(0x11, &(0x7f0000000040)={0x8, 0x20000000, 0x4000, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}, 0x10) syz_open_dev$sg(&(0x7f0000000080), 0x10001, 0x2) 20:27:23 executing program 0: r0 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000004c0)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) sendmsg$IEEE802154_LLSEC_GETPARAMS(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20c02}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x54, r0, 0x0, 0x70bd2a, 0x25dfdbfc, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000004}, 0x20000000) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'wpan0\x00'}) sendmsg$NL802154_CMD_DEL_SEC_DEV(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f0000000540)=ANY=[@ANYBLOB="600000002679656a3e81fcb2997e6cf2c04fc90d495fc628927a0b13d94014e12b144b7c", @ANYRES16=0x0, @ANYBLOB="00012bbd0000050000001b000000000023800c0004000201aaaaaaaaaaaa100023800c0004000201aaaaaaaaaaaa100023800c00040000000000000000f30f0023800c00040000000000000000000c0006000000000000000000"], 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000010) r5 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f0000000240)={'wpan0\x00'}) syz_open_dev$sg(&(0x7f0000000200), 0x5, 0x111000) ioctl$SCSI_IOCTL_SEND_COMMAND(r5, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000000000000004000000284e6fa64de45efb25d608471a2f5686da3325a2c0fcc13924d2ad49b315f4cd3e2ca25c0e608d3f51bf389c82ec0bf841190d6f6113cd5ca17523b7fa0162256cab6b98f3d1da382cd4c7766ea61b563f9576f577596e5793079fb7d4a935161fe8819e7c3d785da02a83936924b8dbc32ed98792be041e961d9168dc79b5"]) 20:27:23 executing program 1: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000180)=0x10000) 20:27:23 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5) 20:27:23 executing program 2: modify_ldt$write2(0x11, &(0x7f0000000040)={0x8, 0x20000000, 0x4000, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}, 0x10) (async, rerun: 32) syz_open_dev$sg(&(0x7f0000000080), 0x10001, 0x2) (rerun: 32) 20:27:23 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000050001"], 0x1c}}, 0x0) 20:27:23 executing program 2: syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) syz_open_dev$sg(&(0x7f0000000000), 0x10002, 0x4b2400) 20:27:23 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000060001"], 0x1c}}, 0x0) 20:27:23 executing program 0: r0 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000004c0)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) sendmsg$IEEE802154_LLSEC_GETPARAMS(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20c02}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x54, r0, 0x0, 0x70bd2a, 0x25dfdbfc, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000004}, 0x20000000) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'wpan0\x00'}) sendmsg$NL802154_CMD_DEL_SEC_DEV(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f0000000540)=ANY=[@ANYBLOB="600000002679656a3e81fcb2997e6cf2c04fc90d495fc628927a0b13d94014e12b144b7c", @ANYRES16=0x0, @ANYBLOB="00012bbd0000050000001b000000000023800c0004000201aaaaaaaaaaaa100023800c0004000201aaaaaaaaaaaa100023800c00040000000000000000f30f0023800c00040000000000000000000c0006000000000000000000"], 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000010) r5 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f0000000240)={'wpan0\x00'}) ioctl$SCSI_IOCTL_SEND_COMMAND(r5, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000000000000004000000284e6fa64de45efb25d608471a2f5686da3325a2c0fcc13924d2ad49b315f4cd3e2ca25c0e608d3f51bf389c82ec0bf841190d6f6113cd5ca17523b7fa0162256cab6b98f3d1da382cd4c7766ea61b563f9576f577596e5793079fb7d4a935161fe8819e7c3d785da02a83936924b8dbc32ed98792be041e961d9168dc79b5"]) [ 2135.111919][ T1271] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2135.149630][ T1284] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO 20:27:23 executing program 3: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000040)=0x6) (async) syz_open_dev$sg(&(0x7f00000000c0), 0x0, 0x60082) (async) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x20000) ioctl$SG_GET_RESERVED_SIZE(r1, 0x2272, &(0x7f0000000080)) 20:27:23 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x2205) 20:27:23 executing program 2: syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) syz_open_dev$sg(&(0x7f0000000000), 0x10002, 0x4b2400) 20:27:23 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000070001"], 0x1c}}, 0x0) 20:27:23 executing program 0: r0 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000004c0)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) sendmsg$IEEE802154_LLSEC_GETPARAMS(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20c02}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x54, r0, 0x0, 0x70bd2a, 0x25dfdbfc, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000004}, 0x20000000) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'wpan0\x00'}) sendmsg$NL802154_CMD_DEL_SEC_DEV(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f0000000540)=ANY=[@ANYBLOB="600000002679656a3e81fcb2997e6cf2c04fc90d495fc628927a0b13d94014e12b144b7c", @ANYRES16=0x0, @ANYBLOB="00012bbd0000050000001b000000000023800c0004000201aaaaaaaaaaaa100023800c0004000201aaaaaaaaaaaa100023800c00040000000000000000f30f0023800c00040000000000000000000c0006000000000000000000"], 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000010) r5 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$SCSI_IOCTL_SEND_COMMAND(r5, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000000000000004000000284e6fa64de45efb25d608471a2f5686da3325a2c0fcc13924d2ad49b315f4cd3e2ca25c0e608d3f51bf389c82ec0bf841190d6f6113cd5ca17523b7fa0162256cab6b98f3d1da382cd4c7766ea61b563f9576f577596e5793079fb7d4a935161fe8819e7c3d785da02a83936924b8dbc32ed98792be041e961d9168dc79b5"]) 20:27:23 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5) 20:27:23 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000090001"], 0x1c}}, 0x0) 20:27:23 executing program 2: syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) (async, rerun: 64) syz_open_dev$sg(&(0x7f0000000000), 0x10002, 0x4b2400) (rerun: 64) 20:27:23 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000000000a0001"], 0x1c}}, 0x0) 20:27:23 executing program 0: r0 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000004c0)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) sendmsg$IEEE802154_LLSEC_GETPARAMS(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20c02}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x54, r0, 0x0, 0x70bd2a, 0x25dfdbfc, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000004}, 0x20000000) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'wpan0\x00'}) sendmsg$NL802154_CMD_DEL_SEC_DEV(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f0000000540)=ANY=[@ANYBLOB="600000002679656a3e81fcb2997e6cf2c04fc90d495fc628927a0b13d94014e12b144b7c", @ANYRES16=0x0, @ANYBLOB="00012bbd0000050000001b000000000023800c0004000201aaaaaaaaaaaa100023800c0004000201aaaaaaaaaaaa100023800c00040000000000000000f30f0023800c00040000000000000000000c0006000000000000000000"], 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000010) r5 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r5, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000000000000004000000284e6fa64de45efb25d608471a2f5686da3325a2c0fcc13924d2ad49b315f4cd3e2ca25c0e608d3f51bf389c82ec0bf841190d6f6113cd5ca17523b7fa0162256cab6b98f3d1da382cd4c7766ea61b563f9576f577596e5793079fb7d4a935161fe8819e7c3d785da02a83936924b8dbc32ed98792be041e961d9168dc79b5"]) [ 2135.950250][ T1294] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO 20:27:23 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000000000b0001"], 0x1c}}, 0x0) 20:27:23 executing program 2: r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f00000000c0)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000100)) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SG_SET_DEBUG(r2, 0x227e, &(0x7f0000000040)=0x1) [ 2135.995795][ T1312] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO 20:27:24 executing program 3: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), r0) sendmsg$AUDIT_SIGNAL_INFO(r0, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x10, 0x3f2, 0x42bc8da760857066, 0x70bd2c, 0x25dfdbfc, "", ["", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x24000005}, 0x80) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(0xffffffffffffffff, 0x0, 0x0) ioctl$SG_NEXT_CMD_LEN(0xffffffffffffffff, 0x2283, &(0x7f0000000400)=0xdc) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r2, 0x227d, &(0x7f0000000180)) syz_open_dev$sg(&(0x7f00000002c0), 0x8, 0x4200) write$vga_arbiter(r1, 0x0, 0x59) bpf$ITER_CREATE(0x21, &(0x7f0000000100)={r1}, 0x8) r3 = syz_open_dev$sg(&(0x7f00000001c0), 0x0, 0x88000) r4 = syz_open_dev$sg(&(0x7f0000000200), 0x1, 0x42000) ioctl$SG_GET_KEEP_ORPHAN(r4, 0x2288, &(0x7f0000000240)) ioctl$SG_SET_KEEP_ORPHAN(r3, 0x2287, &(0x7f0000000140)=0x80) r5 = bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) ioctl$SCSI_IOCTL_GET_PCI(r5, 0x5387, &(0x7f00000000c0)) 20:27:24 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x2270) 20:27:24 executing program 0: r0 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000004c0)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) sendmsg$IEEE802154_LLSEC_GETPARAMS(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20c02}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x54, r0, 0x0, 0x70bd2a, 0x25dfdbfc, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000004}, 0x20000000) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'wpan0\x00'}) sendmsg$NL802154_CMD_DEL_SEC_DEV(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f0000000540)=ANY=[@ANYBLOB="600000002679656a3e81fcb2997e6cf2c04fc90d495fc628927a0b13d94014e12b144b7c", @ANYRES16=0x0, @ANYBLOB="00012bbd0000050000001b000000000023800c0004000201aaaaaaaaaaaa100023800c0004000201aaaaaaaaaaaa100023800c00040000000000000000f30f0023800c00040000000000000000000c0006000000000000000000"], 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000010) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000000000000004000000284e6fa64de45efb25d608471a2f5686da3325a2c0fcc13924d2ad49b315f4cd3e2ca25c0e608d3f51bf389c82ec0bf841190d6f6113cd5ca17523b7fa0162256cab6b98f3d1da382cd4c7766ea61b563f9576f577596e5793079fb7d4a935161fe8819e7c3d785da02a83936924b8dbc32ed98792be041e961d9168dc79b5"]) 20:27:24 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000000000c0001"], 0x1c}}, 0x0) 20:27:24 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5) 20:27:24 executing program 2: r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f00000000c0)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000100)) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SG_SET_DEBUG(r2, 0x227e, &(0x7f0000000040)=0x1) bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f00000000c0)) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000100)) (async) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) ioctl$SG_SET_DEBUG(r2, 0x227e, &(0x7f0000000040)=0x1) (async) 20:27:24 executing program 3: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), r0) sendmsg$AUDIT_SIGNAL_INFO(r0, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x10, 0x3f2, 0x42bc8da760857066, 0x70bd2c, 0x25dfdbfc, "", ["", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x24000005}, 0x80) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(0xffffffffffffffff, 0x0, 0x0) ioctl$SG_NEXT_CMD_LEN(0xffffffffffffffff, 0x2283, &(0x7f0000000400)=0xdc) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r2, 0x227d, &(0x7f0000000180)) syz_open_dev$sg(&(0x7f00000002c0), 0x8, 0x4200) write$vga_arbiter(r1, 0x0, 0x59) bpf$ITER_CREATE(0x21, &(0x7f0000000100)={r1}, 0x8) r3 = syz_open_dev$sg(&(0x7f00000001c0), 0x0, 0x88000) r4 = syz_open_dev$sg(&(0x7f0000000200), 0x1, 0x42000) ioctl$SG_GET_KEEP_ORPHAN(r4, 0x2288, &(0x7f0000000240)) ioctl$SG_SET_KEEP_ORPHAN(r3, 0x2287, &(0x7f0000000140)=0x80) r5 = bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) ioctl$SCSI_IOCTL_GET_PCI(r5, 0x5387, &(0x7f00000000c0)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r0, 0x0, 0x0) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), r0) (async) sendmsg$AUDIT_SIGNAL_INFO(r0, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x10, 0x3f2, 0x42bc8da760857066, 0x70bd2c, 0x25dfdbfc, "", ["", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x24000005}, 0x80) (async) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(0xffffffffffffffff, 0x0, 0x0) (async) ioctl$SG_NEXT_CMD_LEN(0xffffffffffffffff, 0x2283, &(0x7f0000000400)=0xdc) (async) write$vga_arbiter(r2, 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r2, 0x227d, &(0x7f0000000180)) (async) syz_open_dev$sg(&(0x7f00000002c0), 0x8, 0x4200) (async) write$vga_arbiter(r1, 0x0, 0x59) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000100)={r1}, 0x8) (async) syz_open_dev$sg(&(0x7f00000001c0), 0x0, 0x88000) (async) syz_open_dev$sg(&(0x7f0000000200), 0x1, 0x42000) (async) ioctl$SG_GET_KEEP_ORPHAN(r4, 0x2288, &(0x7f0000000240)) (async) ioctl$SG_SET_KEEP_ORPHAN(r3, 0x2287, &(0x7f0000000140)=0x80) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) (async) ioctl$SCSI_IOCTL_GET_PCI(r5, 0x5387, &(0x7f00000000c0)) (async) 20:27:24 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000000000d0001"], 0x1c}}, 0x0) 20:27:24 executing program 0: r0 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000004c0)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) sendmsg$IEEE802154_LLSEC_GETPARAMS(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20c02}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x54, r0, 0x0, 0x70bd2a, 0x25dfdbfc, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000004}, 0x20000000) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'wpan0\x00'}) sendmsg$NL802154_CMD_DEL_SEC_DEV(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f0000000540)=ANY=[@ANYBLOB="600000002679656a3e81fcb2997e6cf2c04fc90d495fc628927a0b13d94014e12b144b7c", @ANYRES16=0x0, @ANYBLOB="00012bbd0000050000001b000000000023800c0004000201aaaaaaaaaaaa100023800c0004000201aaaaaaaaaaaa100023800c00040000000000000000f30f0023800c00040000000000000000000c0006000000000000000000"], 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000010) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000000000000004000000284e6fa64de45efb25d608471a2f5686da3325a2c0fcc13924d2ad49b315f4cd3e2ca25c0e608d3f51bf389c82ec0bf841190d6f6113cd5ca17523b7fa0162256cab6b98f3d1da382cd4c7766ea61b563f9576f577596e5793079fb7d4a935161fe8819e7c3d785da02a83936924b8dbc32ed98792be041e961d9168dc79b5"]) 20:27:24 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x2271) 20:27:24 executing program 3: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), r0) sendmsg$AUDIT_SIGNAL_INFO(r0, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x10, 0x3f2, 0x42bc8da760857066, 0x70bd2c, 0x25dfdbfc, "", ["", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x24000005}, 0x80) (async) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(0xffffffffffffffff, 0x0, 0x0) (async) ioctl$SG_NEXT_CMD_LEN(0xffffffffffffffff, 0x2283, &(0x7f0000000400)=0xdc) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r2, 0x227d, &(0x7f0000000180)) (async, rerun: 64) syz_open_dev$sg(&(0x7f00000002c0), 0x8, 0x4200) (async, rerun: 64) write$vga_arbiter(r1, 0x0, 0x59) bpf$ITER_CREATE(0x21, &(0x7f0000000100)={r1}, 0x8) (async) r3 = syz_open_dev$sg(&(0x7f00000001c0), 0x0, 0x88000) r4 = syz_open_dev$sg(&(0x7f0000000200), 0x1, 0x42000) ioctl$SG_GET_KEEP_ORPHAN(r4, 0x2288, &(0x7f0000000240)) ioctl$SG_SET_KEEP_ORPHAN(r3, 0x2287, &(0x7f0000000140)=0x80) (async, rerun: 64) r5 = bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) (rerun: 64) ioctl$SCSI_IOCTL_GET_PCI(r5, 0x5387, &(0x7f00000000c0)) 20:27:24 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000000260d0001"], 0x1c}}, 0x0) 20:27:24 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000000000e0001"], 0x1c}}, 0x0) 20:27:24 executing program 0: r0 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000004c0)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) sendmsg$IEEE802154_LLSEC_GETPARAMS(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20c02}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x54, r0, 0x0, 0x70bd2a, 0x25dfdbfc, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000004}, 0x20000000) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'wpan0\x00'}) sendmsg$NL802154_CMD_DEL_SEC_DEV(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f0000000540)=ANY=[@ANYBLOB="600000002679656a3e81fcb2997e6cf2c04fc90d495fc628927a0b13d94014e12b144b7c", @ANYRES16=0x0, @ANYBLOB="00012bbd0000050000001b000000000023800c0004000201aaaaaaaaaaaa100023800c0004000201aaaaaaaaaaaa100023800c00040000000000000000f30f0023800c00040000000000000000000c0006000000000000000000"], 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000010) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000000000000004000000284e6fa64de45efb25d608471a2f5686da3325a2c0fcc13924d2ad49b315f4cd3e2ca25c0e608d3f51bf389c82ec0bf841190d6f6113cd5ca17523b7fa0162256cab6b98f3d1da382cd4c7766ea61b563f9576f577596e5793079fb7d4a935161fe8819e7c3d785da02a83936924b8dbc32ed98792be041e961d9168dc79b5"]) 20:27:24 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x2, 0xa54d3d8a030f6bb0) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) 20:27:24 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x2272) 20:27:24 executing program 1: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5) 20:27:24 executing program 2: r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f00000000c0)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000100)) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SG_SET_DEBUG(r2, 0x227e, &(0x7f0000000040)=0x1) bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f00000000c0)) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000100)) (async) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) ioctl$SG_SET_DEBUG(r2, 0x227e, &(0x7f0000000040)=0x1) (async) 20:27:24 executing program 0: r0 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000004c0)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) sendmsg$IEEE802154_LLSEC_GETPARAMS(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20c02}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x54, r0, 0x0, 0x70bd2a, 0x25dfdbfc, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000004}, 0x20000000) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'wpan0\x00'}) r5 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r5, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000000000000004000000284e6fa64de45efb25d608471a2f5686da3325a2c0fcc13924d2ad49b315f4cd3e2ca25c0e608d3f51bf389c82ec0bf841190d6f6113cd5ca17523b7fa0162256cab6b98f3d1da382cd4c7766ea61b563f9576f577596e5793079fb7d4a935161fe8819e7c3d785da02a83936924b8dbc32ed98792be041e961d9168dc79b5"]) 20:27:24 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000000000f0001"], 0x1c}}, 0x0) [ 2136.843465][ T1334] program syz-executor.1 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2136.871789][ T1334] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 20:27:24 executing program 1: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5) 20:27:24 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x2275) 20:27:24 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x2, 0xa54d3d8a030f6bb0) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) syz_open_dev$sg(&(0x7f0000000040), 0x2, 0xa54d3d8a030f6bb0) (async) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) (async) 20:27:24 executing program 1: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5) 20:27:24 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000110001"], 0x1c}}, 0x0) 20:27:24 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x2, 0xa54d3d8a030f6bb0) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) syz_open_dev$sg(&(0x7f0000000040), 0x2, 0xa54d3d8a030f6bb0) (async) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) (async) 20:27:24 executing program 1: r0 = syz_open_dev$sg(0x0, 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5) 20:27:24 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000120001"], 0x1c}}, 0x0) 20:27:24 executing program 1: r0 = syz_open_dev$sg(0x0, 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5) 20:27:25 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000250001"], 0x1c}}, 0x0) 20:27:25 executing program 0: r0 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000004c0)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) sendmsg$IEEE802154_LLSEC_GETPARAMS(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20c02}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x54, r0, 0x0, 0x70bd2a, 0x25dfdbfc, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000004}, 0x20000000) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'wpan0\x00'}) r5 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r5, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000000000000004000000284e6fa64de45efb25d608471a2f5686da3325a2c0fcc13924d2ad49b315f4cd3e2ca25c0e608d3f51bf389c82ec0bf841190d6f6113cd5ca17523b7fa0162256cab6b98f3d1da382cd4c7766ea61b563f9576f577596e5793079fb7d4a935161fe8819e7c3d785da02a83936924b8dbc32ed98792be041e961d9168dc79b5"]) 20:27:25 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x127482) 20:27:25 executing program 1: r0 = syz_open_dev$sg(0x0, 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5) 20:27:25 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x2276) 20:27:25 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan0\x00'}) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000004c0)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x38, 0x0, 0x800, 0x70bd27, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0xe9}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040800}, 0x4040080) syz_open_dev$sg(&(0x7f0000000000), 0xffffffffe824e145, 0x82) 20:27:25 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000000d260001"], 0x1c}}, 0x0) 20:27:25 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan0\x00'}) (async, rerun: 64) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000004c0)={'wpan1\x00', 0x0}) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) (async) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x38, 0x0, 0x800, 0x70bd27, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0xe9}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040800}, 0x4040080) (async) syz_open_dev$sg(&(0x7f0000000000), 0xffffffffe824e145, 0x82) 20:27:25 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x127482) 20:27:25 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5) 20:27:25 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x2279) 20:27:25 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000480001"], 0x1c}}, 0x0) 20:27:25 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5) [ 2137.793191][ T1432] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO 20:27:25 executing program 0: r0 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000004c0)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) sendmsg$IEEE802154_LLSEC_GETPARAMS(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20c02}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x54, r0, 0x0, 0x70bd2a, 0x25dfdbfc, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000004}, 0x20000000) r5 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r5, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000000000000004000000284e6fa64de45efb25d608471a2f5686da3325a2c0fcc13924d2ad49b315f4cd3e2ca25c0e608d3f51bf389c82ec0bf841190d6f6113cd5ca17523b7fa0162256cab6b98f3d1da382cd4c7766ea61b563f9576f577596e5793079fb7d4a935161fe8819e7c3d785da02a83936924b8dbc32ed98792be041e961d9168dc79b5"]) 20:27:25 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x127482) 20:27:25 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x227a) 20:27:25 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000000004c0001"], 0x1c}}, 0x0) 20:27:25 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x4, 0x2) 20:27:25 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5) 20:27:25 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan0\x00'}) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000004c0)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x38, 0x0, 0x800, 0x70bd27, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0xe9}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040800}, 0x4040080) syz_open_dev$sg(&(0x7f0000000000), 0xffffffffe824e145, 0x82) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan0\x00'}) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000004c0)={'wpan1\x00'}) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) (async) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) (async) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x38, 0x0, 0x800, 0x70bd27, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0xe9}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040800}, 0x4040080) (async) syz_open_dev$sg(&(0x7f0000000000), 0xffffffffe824e145, 0x82) (async) 20:27:25 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000600001"], 0x1c}}, 0x0) 20:27:25 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x4, 0x2) 20:27:25 executing program 1: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5) 20:27:25 executing program 0: syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000004c0)={'wpan1\x00', 0x0}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r3, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x1c}}, 0x0) r4 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r4, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000000000000004000000284e6fa64de45efb25d608471a2f5686da3325a2c0fcc13924d2ad49b315f4cd3e2ca25c0e608d3f51bf389c82ec0bf841190d6f6113cd5ca17523b7fa0162256cab6b98f3d1da382cd4c7766ea61b563f9576f577596e5793079fb7d4a935161fe8819e7c3d785da02a83936924b8dbc32ed98792be041e961d9168dc79b5"]) [ 2137.871403][ T1456] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO 20:27:25 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000680001"], 0x1c}}, 0x0) 20:27:25 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x227b) 20:27:25 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x227c) 20:27:25 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x80c82) ioctl$SCSI_IOCTL_GET_PCI(r0, 0x5387, &(0x7f0000000040)) 20:27:25 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x4, 0x2) 20:27:25 executing program 1: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5) 20:27:25 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x80c82) ioctl$SCSI_IOCTL_GET_PCI(r0, 0x5387, &(0x7f0000000040)) 20:27:25 executing program 3: modify_ldt$write(0x1, &(0x7f0000000000)={0x3, 0x1000, 0xffffffffffffffff, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1}, 0x10) syz_open_dev$sg(&(0x7f0000000040), 0xfc70, 0x82) 20:27:25 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000000006c0001"], 0x1c}}, 0x0) 20:27:25 executing program 1: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5) 20:27:25 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x80c82) ioctl$SCSI_IOCTL_GET_PCI(r0, 0x5387, &(0x7f0000000040)) 20:27:25 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x227d) [ 2137.950360][ T1490] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO 20:27:25 executing program 0: syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000004c0)={'wpan1\x00'}) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000000000000004000000284e6fa64de45efb25d608471a2f5686da3325a2c0fcc13924d2ad49b315f4cd3e2ca25c0e608d3f51bf389c82ec0bf841190d6f6113cd5ca17523b7fa0162256cab6b98f3d1da382cd4c7766ea61b563f9576f577596e5793079fb7d4a935161fe8819e7c3d785da02a83936924b8dbc32ed98792be041e961d9168dc79b5"]) 20:27:25 executing program 3: modify_ldt$write(0x1, &(0x7f0000000000)={0x3, 0x1000, 0xffffffffffffffff, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1}, 0x10) syz_open_dev$sg(&(0x7f0000000040), 0xfc70, 0x82) modify_ldt$write(0x1, &(0x7f0000000000)={0x3, 0x1000, 0xffffffffffffffff, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1}, 0x10) (async) syz_open_dev$sg(&(0x7f0000000040), 0xfc70, 0x82) (async) 20:27:25 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000740001"], 0x1c}}, 0x0) 20:27:25 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x227e) 20:27:25 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x2205) 20:27:25 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) bpf$ITER_CREATE(0x21, &(0x7f0000000040)={r0}, 0x8) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) 20:27:25 executing program 3: modify_ldt$write(0x1, &(0x7f0000000000)={0x3, 0x1000, 0xffffffffffffffff, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1}, 0x10) syz_open_dev$sg(&(0x7f0000000040), 0xfc70, 0x82) modify_ldt$write(0x1, &(0x7f0000000000)={0x3, 0x1000, 0xffffffffffffffff, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1}, 0x10) (async) syz_open_dev$sg(&(0x7f0000000040), 0xfc70, 0x82) (async) 20:27:25 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000000007a0001"], 0x1c}}, 0x0) 20:27:26 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x227f) [ 2138.027674][ T1512] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO 20:27:26 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000180)=0x10000) 20:27:26 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000040)={r0}, 0x8) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) 20:27:26 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5) (fail_nth: 1) 20:27:26 executing program 0: syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000004c0)={'wpan1\x00'}) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000000000000004000000284e6fa64de45efb25d608471a2f5686da3325a2c0fcc13924d2ad49b315f4cd3e2ca25c0e608d3f51bf389c82ec0bf841190d6f6113cd5ca17523b7fa0162256cab6b98f3d1da382cd4c7766ea61b563f9576f577596e5793079fb7d4a935161fe8819e7c3d785da02a83936924b8dbc32ed98792be041e961d9168dc79b5"]) 20:27:26 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x2282) 20:27:26 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000002"], 0x1c}}, 0x0) [ 2138.079204][ T1528] __nla_validate_parse: 30 callbacks suppressed [ 2138.079222][ T1528] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2138.108693][ T1537] program syz-executor.1 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2138.122138][ T1537] FAULT_INJECTION: forcing a failure. 20:27:26 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000008"], 0x1c}}, 0x0) 20:27:26 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x103082) 20:27:26 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000000000000a"], 0x1c}}, 0x0) [ 2138.122138][ T1537] name failslab, interval 1, probability 0, space 0, times 0 [ 2138.133498][ T1544] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2138.134915][ T1537] CPU: 1 PID: 1537 Comm: syz-executor.1 Not tainted 5.17.0-rc1-syzkaller #0 [ 2138.152924][ T1537] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2138.162997][ T1537] Call Trace: [ 2138.162994][ T1546] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2138.176293][ T1537] 20:27:26 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000010"], 0x1c}}, 0x0) [ 2138.179280][ T1537] dump_stack_lvl+0xd6/0x122 [ 2138.182721][ T1551] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2138.184000][ T1537] dump_stack+0x11/0x1b [ 2138.184029][ T1537] should_fail+0x23c/0x250 [ 2138.201756][ T1537] ? sdev_prefix_printk+0x76/0x170 [ 2138.206879][ T1537] __should_failslab+0x81/0x90 [ 2138.211736][ T1537] should_failslab+0x5/0x20 [ 2138.212652][ T1553] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:26 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000025"], 0x1c}}, 0x0) 20:27:26 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000064"], 0x1c}}, 0x0) [ 2138.216261][ T1537] kmem_cache_alloc_trace+0x52/0x350 [ 2138.230820][ T1537] sdev_prefix_printk+0x76/0x170 [ 2138.235779][ T1537] ? __scsi_execute+0x36a/0x3a0 [ 2138.240727][ T1537] ioctl_internal_command+0x214/0x240 [ 2138.246122][ T1556] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2138.246131][ T1537] scsi_ioctl+0x883/0x14e0 [ 2138.246158][ T1537] ? scsi_block_when_processing_errors+0x194/0x1d0 [ 2138.266283][ T1537] sg_ioctl+0xaf3/0x18e0 [ 2138.270643][ T1537] ? sg_poll+0x240/0x240 20:27:26 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000007ffffff2"], 0x1c}}, 0x0) [ 2138.273201][ T1558] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2138.274906][ T1537] __se_sys_ioctl+0xcb/0x140 [ 2138.274931][ T1537] __x64_sys_ioctl+0x3f/0x50 [ 2138.274948][ T1537] do_syscall_64+0x44/0xd0 [ 2138.274974][ T1537] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2138.303645][ T1537] RIP: 0033:0x7fdc371ac059 [ 2138.308104][ T1537] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 20:27:26 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) bpf$ITER_CREATE(0x21, &(0x7f0000000040)={r0}, 0x8) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r0, 0x0, 0x0) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000040)={r0}, 0x8) (async) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) 20:27:26 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5) (fail_nth: 2) 20:27:26 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000007ffffff8"], 0x1c}}, 0x0) 20:27:26 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x2283) 20:27:26 executing program 0: syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000004c0)={'wpan1\x00'}) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000000000000004000000284e6fa64de45efb25d608471a2f5686da3325a2c0fcc13924d2ad49b315f4cd3e2ca25c0e608d3f51bf389c82ec0bf841190d6f6113cd5ca17523b7fa0162256cab6b98f3d1da382cd4c7766ea61b563f9576f577596e5793079fb7d4a935161fe8819e7c3d785da02a83936924b8dbc32ed98792be041e961d9168dc79b5"]) 20:27:26 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x103082) [ 2138.327769][ T1537] RSP: 002b:00007fdc36322168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2138.336171][ T1537] RAX: ffffffffffffffda RBX: 00007fdc372bef60 RCX: 00007fdc371ac059 [ 2138.344129][ T1537] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000003 [ 2138.352131][ T1537] RBP: 00007fdc363221d0 R08: 0000000000000000 R09: 0000000000000000 [ 2138.360215][ T1537] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2138.368704][ T1537] R13: 00007ffd7a09847f R14: 00007fdc36322300 R15: 0000000000022000 [ 2138.376696][ T1537] 20:27:26 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000007ffffff9"], 0x1c}}, 0x0) 20:27:26 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000007fffffff"], 0x1c}}, 0x0) 20:27:26 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000020001"], 0x1c}}, 0x0) 20:27:26 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000030001"], 0x1c}}, 0x0) [ 2138.449888][ T1581] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2138.469717][ T1585] FAULT_INJECTION: forcing a failure. [ 2138.469717][ T1585] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2138.470874][ T1586] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:26 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000040001"], 0x1c}}, 0x0) 20:27:26 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000050001"], 0x1c}}, 0x0) [ 2138.482832][ T1585] CPU: 1 PID: 1585 Comm: syz-executor.1 Not tainted 5.17.0-rc1-syzkaller #0 [ 2138.500697][ T1585] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2138.510837][ T1585] Call Trace: [ 2138.510976][ T1588] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2138.514117][ T1585] [ 2138.526297][ T1585] dump_stack_lvl+0xd6/0x122 [ 2138.530982][ T1585] dump_stack+0x11/0x1b [ 2138.535228][ T1585] should_fail+0x23c/0x250 [ 2138.539660][ T1585] should_fail_usercopy+0x16/0x20 [ 2138.544716][ T1585] _copy_from_user+0x1c/0xd0 [ 2138.549322][ T1585] kstrtouint_from_user+0x81/0xf0 [ 2138.554394][ T1585] proc_fail_nth_write+0x4b/0x150 [ 2138.559430][ T1585] ? proc_fail_nth_read+0x150/0x150 [ 2138.564622][ T1585] vfs_write+0x2af/0x950 [ 2138.568890][ T1585] ? __fget_files+0x1d2/0x210 [ 2138.573572][ T1585] ksys_write+0xd9/0x190 [ 2138.577803][ T1585] __x64_sys_write+0x3e/0x50 [ 2138.582379][ T1585] do_syscall_64+0x44/0xd0 [ 2138.586794][ T1585] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2138.592768][ T1585] RIP: 0033:0x7fdc3715eb6f [ 2138.597186][ T1585] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 fd ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 cc fd ff ff 48 [ 2138.616780][ T1585] RSP: 002b:00007fdc36301160 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 2138.625187][ T1585] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fdc3715eb6f [ 2138.633167][ T1585] RDX: 0000000000000001 RSI: 00007fdc363011e0 RDI: 0000000000000004 [ 2138.641144][ T1585] RBP: 00007fdc363011d0 R08: 0000000000000000 R09: 0000000000000000 [ 2138.649186][ T1585] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 2138.657156][ T1585] R13: 00007ffd7a09847f R14: 00007fdc36301300 R15: 0000000000022000 [ 2138.665129][ T1585] 20:27:27 executing program 2: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x260003) 20:27:27 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000060001"], 0x1c}}, 0x0) 20:27:27 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5) 20:27:27 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x2284) 20:27:27 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x103082) 20:27:27 executing program 0: syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000004c0)={'wpan1\x00'}) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000000000000004000000284e6fa64de45efb25d608471a2f5686da3325a2c0fcc13924d2ad49b315f4cd3e2ca25c0e608d3f51bf389c82ec0bf841190d6f6113cd5ca17523b7fa0162256cab6b98f3d1da382cd4c7766ea61b563f9576f577596e5793079fb7d4a935161fe8819e7c3d785da02a83936924b8dbc32ed98792be041e961d9168dc79b5"]) 20:27:27 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000070001"], 0x1c}}, 0x0) 20:27:27 executing program 2: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x260003) 20:27:27 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000080001"], 0x1c}}, 0x0) [ 2139.258146][ T1597] program syz-executor.1 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2139.280616][ T1597] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 20:27:27 executing program 3: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x3c7083) 20:27:27 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x2285) 20:27:27 executing program 3: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async, rerun: 64) syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x3c7083) (rerun: 64) 20:27:27 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x2) 20:27:27 executing program 0: syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000004c0)={'wpan1\x00'}) r1 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000000000000004000000284e6fa64de45efb25d608471a2f5686da3325a2c0fcc13924d2ad49b315f4cd3e2ca25c0e608d3f51bf389c82ec0bf841190d6f6113cd5ca17523b7fa0162256cab6b98f3d1da382cd4c7766ea61b563f9576f577596e5793079fb7d4a935161fe8819e7c3d785da02a83936924b8dbc32ed98792be041e961d9168dc79b5"]) 20:27:27 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000090001"], 0x1c}}, 0x0) 20:27:27 executing program 2: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x260003) [ 2139.300005][ T1608] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO 20:27:27 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x3) 20:27:27 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x2286) 20:27:27 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x1000006, 0x0) 20:27:27 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000000000a0001"], 0x1c}}, 0x0) 20:27:27 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x2287) 20:27:27 executing program 3: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x3c7083) 20:27:27 executing program 0: syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000000000000004000000284e6fa64de45efb25d608471a2f5686da3325a2c0fcc13924d2ad49b315f4cd3e2ca25c0e608d3f51bf389c82ec0bf841190d6f6113cd5ca17523b7fa0162256cab6b98f3d1da382cd4c7766ea61b563f9576f577596e5793079fb7d4a935161fe8819e7c3d785da02a83936924b8dbc32ed98792be041e961d9168dc79b5"]) 20:27:27 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x1000006, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x1000006, 0x0) (async) [ 2139.351227][ T1628] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2139.381765][ T1638] program syz-executor.1 is using a deprecated SCSI ioctl, please convert it to SG_IO 20:27:27 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r0 = syz_open_dev$sg(&(0x7f0000000040), 0xea1dd87, 0x8000) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000080)=0x3) 20:27:27 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000000000b0001"], 0x1c}}, 0x0) 20:27:27 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x1000006, 0x0) 20:27:27 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x4) 20:27:27 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) ioctl$BINDER_CTL_ADD(r0, 0xc1086201, &(0x7f0000000000)={'custom0\x00'}) 20:27:27 executing program 0: syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000000000000004000000284e6fa64de45efb25d608471a2f5686da3325a2c0fcc13924d2ad49b315f4cd3e2ca25c0e608d3f51bf389c82ec0bf841190d6f6113cd5ca17523b7fa0162256cab6b98f3d1da382cd4c7766ea61b563f9576f577596e5793079fb7d4a935161fe8819e7c3d785da02a83936924b8dbc32ed98792be041e961d9168dc79b5"]) 20:27:27 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000000000c0001"], 0x1c}}, 0x0) 20:27:27 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x6) [ 2139.415014][ T1646] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2139.449486][ T1656] program syz-executor.1 is using a deprecated SCSI ioctl, please convert it to SG_IO 20:27:27 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x2288) 20:27:27 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) r0 = syz_open_dev$sg(&(0x7f0000000040), 0xea1dd87, 0x8000) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000080)=0x3) 20:27:27 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000000000d0001"], 0x1c}}, 0x0) 20:27:27 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000000000000004000000284e6fa64de45efb25d608471a2f5686da3325a2c0fcc13924d2ad49b315f4cd3e2ca25c0e608d3f51bf389c82ec0bf841190d6f6113cd5ca17523b7fa0162256cab6b98f3d1da382cd4c7766ea61b563f9576f577596e5793079fb7d4a935161fe8819e7c3d785da02a83936924b8dbc32ed98792be041e961d9168dc79b5"]) 20:27:27 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000000000e0001"], 0x1c}}, 0x0) 20:27:27 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) ioctl$BINDER_CTL_ADD(r0, 0xc1086201, &(0x7f0000000000)={'custom0\x00'}) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r0, 0x0, 0x0) (async) ioctl$BINDER_CTL_ADD(r0, 0xc1086201, &(0x7f0000000000)={'custom0\x00'}) (async) [ 2139.479538][ T1661] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2139.505766][ T1666] program syz-executor.1 is using a deprecated SCSI ioctl, please convert it to SG_IO 20:27:27 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000000000f0001"], 0x1c}}, 0x0) 20:27:27 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x7) 20:27:27 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) (async) ioctl$BINDER_CTL_ADD(r0, 0xc1086201, &(0x7f0000000000)={'custom0\x00'}) 20:27:27 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r0 = syz_open_dev$sg(&(0x7f0000000040), 0xea1dd87, 0x8000) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000080)=0x3) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) syz_open_dev$sg(&(0x7f0000000040), 0xea1dd87, 0x8000) (async) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000080)=0x3) (async) 20:27:27 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x40040, 0x0) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f0000000080)) 20:27:27 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000100001"], 0x1c}}, 0x0) 20:27:27 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x2289) 20:27:27 executing program 0: r0 = syz_open_dev$sg(0x0, 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000000000000004000000284e6fa64de45efb25d608471a2f5686da3325a2c0fcc13924d2ad49b315f4cd3e2ca25c0e608d3f51bf389c82ec0bf841190d6f6113cd5ca17523b7fa0162256cab6b98f3d1da382cd4c7766ea61b563f9576f577596e5793079fb7d4a935161fe8819e7c3d785da02a83936924b8dbc32ed98792be041e961d9168dc79b5"]) 20:27:27 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x8) [ 2139.524390][ T1666] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 2139.533739][ T1674] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO 20:27:27 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000110001"], 0x1c}}, 0x0) 20:27:27 executing program 0: r0 = syz_open_dev$sg(0x0, 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000000000000004000000284e6fa64de45efb25d608471a2f5686da3325a2c0fcc13924d2ad49b315f4cd3e2ca25c0e608d3f51bf389c82ec0bf841190d6f6113cd5ca17523b7fa0162256cab6b98f3d1da382cd4c7766ea61b563f9576f577596e5793079fb7d4a935161fe8819e7c3d785da02a83936924b8dbc32ed98792be041e961d9168dc79b5"]) 20:27:27 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000120001"], 0x1c}}, 0x0) 20:27:27 executing program 0: r0 = syz_open_dev$sg(0x0, 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000000000000004000000284e6fa64de45efb25d608471a2f5686da3325a2c0fcc13924d2ad49b315f4cd3e2ca25c0e608d3f51bf389c82ec0bf841190d6f6113cd5ca17523b7fa0162256cab6b98f3d1da382cd4c7766ea61b563f9576f577596e5793079fb7d4a935161fe8819e7c3d785da02a83936924b8dbc32ed98792be041e961d9168dc79b5"]) 20:27:27 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000250001"], 0x1c}}, 0x0) 20:27:27 executing program 0: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000000000000004000000284e6fa64de45efb25d608471a2f5686da3325a2c0fcc13924d2ad49b315f4cd3e2ca25c0e608d3f51bf389c82ec0bf841190d6f6113cd5ca17523b7fa0162256cab6b98f3d1da382cd4c7766ea61b563f9576f577596e5793079fb7d4a935161fe8819e7c3d785da02a83936924b8dbc32ed98792be041e961d9168dc79b5"]) 20:27:28 executing program 3: syz_open_dev$sg(&(0x7f0000000040), 0x800000000000, 0x200) 20:27:28 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000480001"], 0x1c}}, 0x0) 20:27:28 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x9) 20:27:28 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x40040, 0x0) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f0000000080)) 20:27:28 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x4b47) 20:27:28 executing program 0: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000000000000004000000284e6fa64de45efb25d608471a2f5686da3325a2c0fcc13924d2ad49b315f4cd3e2ca25c0e608d3f51bf389c82ec0bf841190d6f6113cd5ca17523b7fa0162256cab6b98f3d1da382cd4c7766ea61b563f9576f577596e5793079fb7d4a935161fe8819e7c3d785da02a83936924b8dbc32ed98792be041e961d9168dc79b5"]) 20:27:28 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000000004c0001"], 0x1c}}, 0x0) 20:27:28 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x40040, 0x0) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f0000000080)) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x40040, 0x0) (async) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f0000000080)) (async) 20:27:28 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0xa) 20:27:28 executing program 0: syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000000000000004000000284e6fa64de45efb25d608471a2f5686da3325a2c0fcc13924d2ad49b315f4cd3e2ca25c0e608d3f51bf389c82ec0bf841190d6f6113cd5ca17523b7fa0162256cab6b98f3d1da382cd4c7766ea61b563f9576f577596e5793079fb7d4a935161fe8819e7c3d785da02a83936924b8dbc32ed98792be041e961d9168dc79b5"]) 20:27:28 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x4b49) 20:27:28 executing program 3: syz_open_dev$sg(&(0x7f0000000040), 0x800000000000, 0x200) syz_open_dev$sg(&(0x7f0000000040), 0x800000000000, 0x200) (async) 20:27:28 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000600001"], 0x1c}}, 0x0) 20:27:28 executing program 3: syz_open_dev$sg(&(0x7f0000000040), 0x800000000000, 0x200) 20:27:28 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0xb) 20:27:28 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000680001"], 0x1c}}, 0x0) 20:27:28 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x14000, 0x0) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f0000000080)) 20:27:28 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000000006c0001"], 0x1c}}, 0x0) 20:27:28 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000740001"], 0x1c}}, 0x0) 20:27:29 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) socket$isdn_base(0x22, 0x3, 0x0) 20:27:29 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000000007a0001"], 0x1c}}, 0x0) 20:27:29 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, 0x0) 20:27:29 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x14000, 0x0) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f0000000080)) 20:27:29 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0xc) 20:27:29 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5309) 20:27:29 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000301"], 0x1c}}, 0x0) 20:27:29 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) socket$isdn_base(0x22, 0x3, 0x0) 20:27:29 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x14000, 0x0) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f0000000080)) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x14000, 0x0) (async) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f0000000080)) (async) 20:27:29 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0xd) 20:27:29 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000501"], 0x1c}}, 0x0) 20:27:29 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5319) 20:27:29 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) socket$isdn_base(0x22, 0x3, 0x0) 20:27:29 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, 0x0) 20:27:29 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000601"], 0x1c}}, 0x0) 20:27:29 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000701"], 0x1c}}, 0x0) [ 2141.355262][ T1772] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 2141.369020][ T1775] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO 20:27:29 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000901"], 0x1c}}, 0x0) 20:27:29 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000a01"], 0x1c}}, 0x0) 20:27:29 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000b01"], 0x1c}}, 0x0) 20:27:29 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000c01"], 0x1c}}, 0x0) 20:27:30 executing program 3: r0 = openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$wireguard(&(0x7f0000000440), 0xffffffffffffffff) ioctl$PTP_PIN_GETFUNC2(r0, 0xc0603d0f, &(0x7f0000000140)={'\x00', 0x6, 0x3}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) sendmsg$AUDIT_GET_FEATURE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x10, 0x3fb, 0x8, 0x70bd28, 0x25dfdbfd, "", ["", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x4040}, 0x90) ioctl$EVIOCGREP(r0, 0x80084503, &(0x7f0000000380)=""/159) r3 = bpf$ITER_CREATE(0x21, &(0x7f00000001c0)={r2}, 0x8) sendmsg$AUDIT_USER_AVC(r3, &(0x7f0000000340)={&(0x7f0000000200), 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0x84, 0x453, 0x800, 0x70bd2b, 0x25dfdbfb, "481880a58d6df207701a89ec3afc654de6345ab8b0f68806908b325221f09c071e70c638581ddb192a75d335a49b240271e8e367411486c00e522c6c7e75bfc7b82339a94dd05644f28428becfcd48ebc35d26d90722a9a2082cead7df7f32eb28ba9fa5d8a7fd9a86bac5090b31e54e337786", ["", "", "", ""]}, 0x84}, 0x1, 0x0, 0x0, 0x4}, 0x4041) 20:27:30 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0xe) 20:27:30 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, 0x0) 20:27:30 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5381) 20:27:30 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000d01"], 0x1c}}, 0x0) 20:27:30 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000260d01"], 0x1c}}, 0x0) 20:27:30 executing program 3: r0 = openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$wireguard(&(0x7f0000000440), 0xffffffffffffffff) (async) ioctl$PTP_PIN_GETFUNC2(r0, 0xc0603d0f, &(0x7f0000000140)={'\x00', 0x6, 0x3}) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x0) (async) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) sendmsg$AUDIT_GET_FEATURE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x10, 0x3fb, 0x8, 0x70bd28, 0x25dfdbfd, "", ["", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x4040}, 0x90) (async, rerun: 64) ioctl$EVIOCGREP(r0, 0x80084503, &(0x7f0000000380)=""/159) (async, rerun: 64) r3 = bpf$ITER_CREATE(0x21, &(0x7f00000001c0)={r2}, 0x8) sendmsg$AUDIT_USER_AVC(r3, &(0x7f0000000340)={&(0x7f0000000200), 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0x84, 0x453, 0x800, 0x70bd2b, 0x25dfdbfb, "481880a58d6df207701a89ec3afc654de6345ab8b0f68806908b325221f09c071e70c638581ddb192a75d335a49b240271e8e367411486c00e522c6c7e75bfc7b82339a94dd05644f28428becfcd48ebc35d26d90722a9a2082cead7df7f32eb28ba9fa5d8a7fd9a86bac5090b31e54e337786", ["", "", "", ""]}, 0x84}, 0x1, 0x0, 0x0, 0x4}, 0x4041) 20:27:30 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x10) 20:27:30 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5382) 20:27:30 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000002c0)=ANY=[]) 20:27:30 executing program 2: r0 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$WG_CMD_GET_DEVICE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x60, r0, 0x100, 0x70bd26, 0x25dfdbfe, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg2\x00'}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}, @WGDEVICE_A_FLAGS={0x8, 0x5, 0x1}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg2\x00'}, @WGDEVICE_A_LISTEN_PORT={0x6, 0x6, 0x4e20}]}, 0x60}}, 0x4000) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000240), 0x20482, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r2, 0x1, &(0x7f00000002c0)={0xb1, 0x2fc, 0x0, "0e34c0e0337324a99ce1006c345821c249c3eff810b40dd767f196dea244b80cea1385dfba5db17551078fbcdd2efbfd8af1a8f6a3e21a3040bbbdaad367a6b5ca532cac9f74b9a82a18b0fc521837baf2e211fc06fa2c0166483302c84dcaa82dd8e2b067dfd176eb53bb2bb8f19ebefaf2566f683d6645ffa448589c49196859fa29624fdfe103a97e51bb702f1323e6a4518dca99e56e5b2152aeefcfce11667633a0f4c5292c4f5f27cb2fd2abddd1"}) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f0000000280)) r3 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x200000) ioctl$SCSI_IOCTL_SEND_COMMAND(r3, 0x1, &(0x7f0000000080)={0x28, 0x200, 0x5, "4bef1a69c138f2141ccd68f3fe0cbab066caa527063531d16ef0aa61eebcef955b7e6bd3f6df40ca"}) 20:27:30 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000e01"], 0x1c}}, 0x0) 20:27:30 executing program 3: r0 = openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$wireguard(&(0x7f0000000440), 0xffffffffffffffff) (async) ioctl$PTP_PIN_GETFUNC2(r0, 0xc0603d0f, &(0x7f0000000140)={'\x00', 0x6, 0x3}) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x0) (async) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) sendmsg$AUDIT_GET_FEATURE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x10, 0x3fb, 0x8, 0x70bd28, 0x25dfdbfd, "", ["", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x4040}, 0x90) ioctl$EVIOCGREP(r0, 0x80084503, &(0x7f0000000380)=""/159) (async) r3 = bpf$ITER_CREATE(0x21, &(0x7f00000001c0)={r2}, 0x8) sendmsg$AUDIT_USER_AVC(r3, &(0x7f0000000340)={&(0x7f0000000200), 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0x84, 0x453, 0x800, 0x70bd2b, 0x25dfdbfb, "481880a58d6df207701a89ec3afc654de6345ab8b0f68806908b325221f09c071e70c638581ddb192a75d335a49b240271e8e367411486c00e522c6c7e75bfc7b82339a94dd05644f28428becfcd48ebc35d26d90722a9a2082cead7df7f32eb28ba9fa5d8a7fd9a86bac5090b31e54e337786", ["", "", "", ""]}, 0x84}, 0x1, 0x0, 0x0, 0x4}, 0x4041) 20:27:30 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x11) [ 2142.272244][ T1837] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO 20:27:30 executing program 2: r0 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$WG_CMD_GET_DEVICE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x60, r0, 0x100, 0x70bd26, 0x25dfdbfe, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg2\x00'}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}, @WGDEVICE_A_FLAGS={0x8, 0x5, 0x1}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg2\x00'}, @WGDEVICE_A_LISTEN_PORT={0x6, 0x6, 0x4e20}]}, 0x60}}, 0x4000) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000240), 0x20482, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r2, 0x1, &(0x7f00000002c0)={0xb1, 0x2fc, 0x0, "0e34c0e0337324a99ce1006c345821c249c3eff810b40dd767f196dea244b80cea1385dfba5db17551078fbcdd2efbfd8af1a8f6a3e21a3040bbbdaad367a6b5ca532cac9f74b9a82a18b0fc521837baf2e211fc06fa2c0166483302c84dcaa82dd8e2b067dfd176eb53bb2bb8f19ebefaf2566f683d6645ffa448589c49196859fa29624fdfe103a97e51bb702f1323e6a4518dca99e56e5b2152aeefcfce11667633a0f4c5292c4f5f27cb2fd2abddd1"}) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f0000000280)) r3 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x200000) ioctl$SCSI_IOCTL_SEND_COMMAND(r3, 0x1, &(0x7f0000000080)={0x28, 0x200, 0x5, "4bef1a69c138f2141ccd68f3fe0cbab066caa527063531d16ef0aa61eebcef955b7e6bd3f6df40ca"}) syz_genetlink_get_family_id$wireguard(&(0x7f0000000100), 0xffffffffffffffff) (async) sendmsg$WG_CMD_GET_DEVICE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x60, r0, 0x100, 0x70bd26, 0x25dfdbfe, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg2\x00'}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}, @WGDEVICE_A_FLAGS={0x8, 0x5, 0x1}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg2\x00'}, @WGDEVICE_A_LISTEN_PORT={0x6, 0x6, 0x4e20}]}, 0x60}}, 0x4000) (async) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000240), 0x20482, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r2, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_SEND_COMMAND(r2, 0x1, &(0x7f00000002c0)={0xb1, 0x2fc, 0x0, "0e34c0e0337324a99ce1006c345821c249c3eff810b40dd767f196dea244b80cea1385dfba5db17551078fbcdd2efbfd8af1a8f6a3e21a3040bbbdaad367a6b5ca532cac9f74b9a82a18b0fc521837baf2e211fc06fa2c0166483302c84dcaa82dd8e2b067dfd176eb53bb2bb8f19ebefaf2566f683d6645ffa448589c49196859fa29624fdfe103a97e51bb702f1323e6a4518dca99e56e5b2152aeefcfce11667633a0f4c5292c4f5f27cb2fd2abddd1"}) (async) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f0000000280)) (async) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x200000) (async) ioctl$SCSI_IOCTL_SEND_COMMAND(r3, 0x1, &(0x7f0000000080)={0x28, 0x200, 0x5, "4bef1a69c138f2141ccd68f3fe0cbab066caa527063531d16ef0aa61eebcef955b7e6bd3f6df40ca"}) (async) 20:27:30 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x12) 20:27:30 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000040)={0xe, 0xff, 0x7fffffff, "67bf8bd4c46efc52bee6dbfe941a"}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), r2) ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f0000000080)=0x1) 20:27:30 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5385) 20:27:30 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000f01"], 0x1c}}, 0x0) 20:27:30 executing program 2: r0 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$WG_CMD_GET_DEVICE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x60, r0, 0x100, 0x70bd26, 0x25dfdbfe, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg2\x00'}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}, @WGDEVICE_A_FLAGS={0x8, 0x5, 0x1}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg2\x00'}, @WGDEVICE_A_LISTEN_PORT={0x6, 0x6, 0x4e20}]}, 0x60}}, 0x4000) (async) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async, rerun: 64) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000240), 0x20482, 0x0) (rerun: 64) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) (async, rerun: 64) ioctl$SCSI_IOCTL_SEND_COMMAND(r2, 0x1, &(0x7f00000002c0)={0xb1, 0x2fc, 0x0, "0e34c0e0337324a99ce1006c345821c249c3eff810b40dd767f196dea244b80cea1385dfba5db17551078fbcdd2efbfd8af1a8f6a3e21a3040bbbdaad367a6b5ca532cac9f74b9a82a18b0fc521837baf2e211fc06fa2c0166483302c84dcaa82dd8e2b067dfd176eb53bb2bb8f19ebefaf2566f683d6645ffa448589c49196859fa29624fdfe103a97e51bb702f1323e6a4518dca99e56e5b2152aeefcfce11667633a0f4c5292c4f5f27cb2fd2abddd1"}) (async, rerun: 64) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f0000000280)) r3 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x200000) ioctl$SCSI_IOCTL_SEND_COMMAND(r3, 0x1, &(0x7f0000000080)={0x28, 0x200, 0x5, "4bef1a69c138f2141ccd68f3fe0cbab066caa527063531d16ef0aa61eebcef955b7e6bd3f6df40ca"}) 20:27:30 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000002c0)=ANY=[]) 20:27:30 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x1267) 20:27:30 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5386) 20:27:30 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000001101"], 0x1c}}, 0x0) 20:27:30 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000040)={0xe, 0xff, 0x7fffffff, "67bf8bd4c46efc52bee6dbfe941a"}) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), r2) (async) ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f0000000080)=0x1) 20:27:30 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x1274) [ 2142.339379][ T1863] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2142.370143][ T1902] program syz-executor.3 is using a deprecated SCSI ioctl, please convert it to SG_IO 20:27:30 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000001201"], 0x1c}}, 0x0) 20:27:30 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000002501"], 0x1c}}, 0x0) 20:27:30 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000000000d2601"], 0x1c}}, 0x0) 20:27:30 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000004801"], 0x1c}}, 0x0) 20:27:30 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000004c01"], 0x1c}}, 0x0) 20:27:31 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000006001"], 0x1c}}, 0x0) 20:27:31 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000002c0)=ANY=[]) 20:27:31 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x800003, 0x44000) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) io_uring_register$IORING_UNREGISTER_BUFFERS(r0, 0x1, 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r0, 0x2) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/custom1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) 20:27:31 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5387) 20:27:31 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x1275) 20:27:31 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000040)={0xe, 0xff, 0x7fffffff, "67bf8bd4c46efc52bee6dbfe941a"}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), r2) (async) ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f0000000080)=0x1) 20:27:31 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000006801"], 0x1c}}, 0x0) 20:27:31 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB]) 20:27:31 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x800003, 0x44000) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) io_uring_register$IORING_UNREGISTER_BUFFERS(r0, 0x1, 0x0, 0x0) (async) write$vga_arbiter(r0, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r0, 0x2) (async) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/custom1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) [ 2143.262169][ T1943] __nla_validate_parse: 40 callbacks suppressed [ 2143.262183][ T1943] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2143.270224][ T1948] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2143.299775][ T1953] program syz-executor.3 is using a deprecated SCSI ioctl, please convert it to SG_IO 20:27:31 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x800003, 0x44000) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) io_uring_register$IORING_UNREGISTER_BUFFERS(r0, 0x1, 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r0, 0x2) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/custom1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x800003, 0x44000) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) io_uring_register$IORING_UNREGISTER_BUFFERS(r0, 0x1, 0x0, 0x0) (async) write$vga_arbiter(r0, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r0, 0x2) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/custom1\x00', 0x0, 0x0) (async) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) (async) 20:27:31 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x101400, 0x0) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000080)=0x5) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, &(0x7f00000000c0)=0x5, 0x4) 20:27:31 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000006c01"], 0x1c}}, 0x0) 20:27:31 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x1276) 20:27:31 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB]) 20:27:31 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5393) 20:27:31 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000040)) [ 2143.317462][ T1961] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2143.341069][ T1962] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO 20:27:31 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x101400, 0x0) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000080)=0x5) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, &(0x7f00000000c0)=0x5, 0x4) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x101400, 0x0) (async) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000080)=0x5) (async) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, &(0x7f00000000c0)=0x5, 0x4) (async) 20:27:31 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000040)) 20:27:31 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x2201) 20:27:31 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000007401"], 0x1c}}, 0x0) 20:27:31 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x541b) 20:27:31 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000007a01"], 0x1c}}, 0x0) [ 2143.374639][ T1976] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2143.408324][ T1993] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:31 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100"/11], 0x1c}}, 0x0) 20:27:31 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000300"], 0x1c}}, 0x0) 20:27:31 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000400"], 0x1c}}, 0x0) [ 2143.428628][ T2000] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:32 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB]) 20:27:32 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000201"], 0x1c}}, 0x0) 20:27:32 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000301"], 0x1c}}, 0x0) 20:27:32 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x101400, 0x0) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000080)=0x5) (async, rerun: 64) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, &(0x7f00000000c0)=0x5, 0x4) (rerun: 64) 20:27:32 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000040)) 20:27:32 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x2202) 20:27:32 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000000000000004000000284e6fa64de45efb25d608471a2f5686da3325a2c0fcc13924d2ad49b315f4cd3e2ca25c0e608d3f51bf389c82ec0bf841190d6f6113cd5ca175"]) 20:27:32 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5421) [ 2144.215021][ T2012] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2144.232416][ T2014] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2144.237878][ T2016] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:32 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000401"], 0x1c}}, 0x0) 20:27:32 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000080)=0x6) 20:27:32 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5450) 20:27:32 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000080)=0x6) 20:27:32 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f"]) 20:27:32 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x40000090b3, 0x5e1c83) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) modify_ldt$write2(0x11, &(0x7f0000000180)={0x8001, 0x1000, 0x2000, 0x1, 0x3, 0x0, 0x1, 0x1, 0x0, 0x1}, 0x10) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f00000000c0)=0x10001) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x660800, 0x0) ioctl$LOOP_CTL_ADD(r1, 0x4c80, 0xc) ioctl$EVIOCGLED(r1, 0x80404519, &(0x7f0000000100)=""/106) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r3, 0x84, 0x20, &(0x7f0000000080)=0xffffffff, 0x4) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r3, 0x84, 0x20, &(0x7f00000001c0)=0x6, 0x4) 20:27:32 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x2203) 20:27:32 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000501"], 0x1c}}, 0x0) [ 2144.283953][ T2026] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2144.322889][ T2033] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:32 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5451) 20:27:32 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000080)=0x6) 20:27:32 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x40000090b3, 0x5e1c83) (async, rerun: 32) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (rerun: 32) write$vga_arbiter(r1, 0x0, 0x0) modify_ldt$write2(0x11, &(0x7f0000000180)={0x8001, 0x1000, 0x2000, 0x1, 0x3, 0x0, 0x1, 0x1, 0x0, 0x1}, 0x10) (async, rerun: 32) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) (async, rerun: 32) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f00000000c0)=0x10001) (async, rerun: 64) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x660800, 0x0) (rerun: 64) ioctl$LOOP_CTL_ADD(r1, 0x4c80, 0xc) (async) ioctl$EVIOCGLED(r1, 0x80404519, &(0x7f0000000100)=""/106) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) (async, rerun: 64) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r3, 0x84, 0x20, &(0x7f0000000080)=0xffffffff, 0x4) (async, rerun: 64) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) (async) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r3, 0x84, 0x20, &(0x7f00000001c0)=0x6, 0x4) 20:27:32 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x2, 0x400000) ioctl$SCSI_IOCTL_GET_PCI(r0, 0x5387, &(0x7f0000000080)) 20:27:32 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x2205) 20:27:32 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5452) 20:27:32 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f"]) 20:27:32 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000601"], 0x1c}}, 0x0) [ 2144.359940][ T2044] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2144.379929][ T2048] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:32 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x2270) 20:27:32 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x2, 0x400000) ioctl$SCSI_IOCTL_GET_PCI(r0, 0x5387, &(0x7f0000000080)) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) syz_open_dev$sg(&(0x7f0000000040), 0x2, 0x400000) (async) ioctl$SCSI_IOCTL_GET_PCI(r0, 0x5387, &(0x7f0000000080)) (async) 20:27:32 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5460) 20:27:32 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000701"], 0x1c}}, 0x0) 20:27:32 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f"]) 20:27:32 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000801"], 0x1c}}, 0x0) [ 2144.420308][ T2062] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2144.448864][ T2072] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO 20:27:33 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x2271) 20:27:33 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x40000090b3, 0x5e1c83) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async, rerun: 32) modify_ldt$write2(0x11, &(0x7f0000000180)={0x8001, 0x1000, 0x2000, 0x1, 0x3, 0x0, 0x1, 0x1, 0x0, 0x1}, 0x10) (rerun: 32) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) (async) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f00000000c0)=0x10001) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x660800, 0x0) ioctl$LOOP_CTL_ADD(r1, 0x4c80, 0xc) (async) ioctl$EVIOCGLED(r1, 0x80404519, &(0x7f0000000100)=""/106) (async) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r3, 0x84, 0x20, &(0x7f0000000080)=0xffffffff, 0x4) (async) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r3, 0x84, 0x20, &(0x7f00000001c0)=0x6, 0x4) 20:27:33 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000901"], 0x1c}}, 0x0) 20:27:33 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000a01"], 0x1c}}, 0x0) 20:27:33 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000b01"], 0x1c}}, 0x0) 20:27:33 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x351082) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f0000000080)) 20:27:33 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000c01"], 0x1c}}, 0x0) [ 2145.298055][ T2224] ================================================================== [ 2145.306160][ T2224] BUG: KCSAN: data-race in sg_open / sg_release [ 2145.312446][ T2224] [ 2145.314756][ T2224] write to 0xffff888101ee7128 of 4 bytes by task 2073 on cpu 1: [ 2145.322381][ T2224] sg_release+0x21b/0x2c0 [ 2145.326715][ T2224] __fput+0x295/0x520 [ 2145.330684][ T2224] ____fput+0x11/0x20 [ 2145.334664][ T2224] task_work_run+0x8e/0x110 [ 2145.339165][ T2224] exit_to_user_mode_prepare+0x160/0x190 [ 2145.344804][ T2224] syscall_exit_to_user_mode+0x20/0x40 [ 2145.350251][ T2224] do_syscall_64+0x50/0xd0 [ 2145.354680][ T2224] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2145.360574][ T2224] [ 2145.362883][ T2224] read to 0xffff888101ee7128 of 4 bytes by task 2224 on cpu 0: [ 2145.370407][ T2224] sg_open+0x5a5/0xe00 [ 2145.374482][ T2224] chrdev_open+0x362/0x3d0 [ 2145.378889][ T2224] do_dentry_open+0x52c/0x860 [ 2145.383555][ T2224] vfs_open+0x43/0x50 [ 2145.387520][ T2224] path_openat+0x170c/0x1f30 [ 2145.392099][ T2224] do_filp_open+0x105/0x220 [ 2145.396589][ T2224] do_sys_openat2+0xb5/0x2b0 [ 2145.401166][ T2224] __x64_sys_openat+0xef/0x110 [ 2145.405917][ T2224] do_syscall_64+0x44/0xd0 [ 2145.410326][ T2224] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2145.416229][ T2224] [ 2145.418538][ T2224] value changed: 0x00000001 -> 0x00000000 [ 2145.424238][ T2224] [ 2145.426547][ T2224] Reported by Kernel Concurrency Sanitizer on: [ 2145.432678][ T2224] CPU: 0 PID: 2224 Comm: syz-executor.1 Not tainted 5.17.0-rc1-syzkaller #0 20:27:33 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x2, 0x400000) ioctl$SCSI_IOCTL_GET_PCI(r0, 0x5387, &(0x7f0000000080)) 20:27:33 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x40049409) 20:27:33 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x351082) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f0000000080)) 20:27:33 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000d01"], 0x1c}}, 0x0) 20:27:33 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000000000000004000000284e6fa64de45efb25d608471a2f5686da3325a2c0fcc139"]) [ 2145.441341][ T2224] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2145.451380][ T2224] ================================================================== 20:27:33 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000e01"], 0x1c}}, 0x0) 20:27:33 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x2272) 20:27:33 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x40086602) 20:27:33 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x351082) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f0000000080)) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x351082) (async) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f0000000080)) (async) 20:27:33 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f0000000080)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) [ 2145.492769][ T2245] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO 20:27:33 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x2275) 20:27:33 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000f01"], 0x1c}}, 0x0) 20:27:33 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f00"]) 20:27:33 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f0000000080)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) 20:27:33 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x40087602) 20:27:33 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wg2\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x7c, 0x0, 0x1, 0x70bd25, 0x25dfdbfc, {}, [@WGDEVICE_A_LISTEN_PORT={0x6, 0x6, 0x4e22}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x1}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x1}, @WGDEVICE_A_PRIVATE_KEY={0x24, 0x3, @b}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x8}, @WGDEVICE_A_IFINDEX={0x8, 0x1, r0}, @WGDEVICE_A_IFINDEX={0x8}]}, 0x7c}, 0x1, 0x0, 0x0, 0x20000001}, 0x20004000) 20:27:33 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000001001"], 0x1c}}, 0x0) 20:27:33 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x2276) 20:27:33 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f00"]) 20:27:33 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wg2\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x7c, 0x0, 0x1, 0x70bd25, 0x25dfdbfc, {}, [@WGDEVICE_A_LISTEN_PORT={0x6, 0x6, 0x4e22}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x1}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x1}, @WGDEVICE_A_PRIVATE_KEY={0x24, 0x3, @b}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x8}, @WGDEVICE_A_IFINDEX={0x8, 0x1, r0}, @WGDEVICE_A_IFINDEX={0x8}]}, 0x7c}, 0x1, 0x0, 0x0, 0x20000001}, 0x20004000) 20:27:33 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f0000000080)) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) [ 2145.588763][ T2262] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO 20:27:33 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x401c5820) 20:27:33 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x2279) 20:27:33 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000001101"], 0x1c}}, 0x0) 20:27:33 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000001201"], 0x1c}}, 0x0) 20:27:33 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) 20:27:33 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x4020940d) 20:27:33 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f00"]) [ 2145.629566][ T2275] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO 20:27:33 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wg2\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x7c, 0x0, 0x1, 0x70bd25, 0x25dfdbfc, {}, [@WGDEVICE_A_LISTEN_PORT={0x6, 0x6, 0x4e22}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x1}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x1}, @WGDEVICE_A_PRIVATE_KEY={0x24, 0x3, @b}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x8}, @WGDEVICE_A_IFINDEX={0x8, 0x1, r0}, @WGDEVICE_A_IFINDEX={0x8}]}, 0x7c}, 0x1, 0x0, 0x0, 0x20000001}, 0x20004000) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wg2\x00'}) (async) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x7c, 0x0, 0x1, 0x70bd25, 0x25dfdbfc, {}, [@WGDEVICE_A_LISTEN_PORT={0x6, 0x6, 0x4e22}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x1}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x1}, @WGDEVICE_A_PRIVATE_KEY={0x24, 0x3, @b}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x8}, @WGDEVICE_A_IFINDEX={0x8, 0x1, r0}, @WGDEVICE_A_IFINDEX={0x8}]}, 0x7c}, 0x1, 0x0, 0x0, 0x20000001}, 0x20004000) (async) 20:27:33 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x227a) 20:27:33 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000002501"], 0x1c}}, 0x0) 20:27:33 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x80086601) 20:27:33 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000004801"], 0x1c}}, 0x0) 20:27:33 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000000000000004000000284e6fa64de45e"]) 20:27:33 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000004c01"], 0x1c}}, 0x0) [ 2145.682344][ T2293] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2145.704044][ T2294] program syz-executor.2 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2145.721918][ T2294] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 20:27:33 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x80087601) 20:27:33 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) 20:27:33 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x801c581f) 20:27:33 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000006001"], 0x1c}}, 0x0) 20:27:33 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f00"]) [ 2145.734998][ T2305] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO 20:27:34 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x200002, 0x0) openat$cgroup_int(r0, &(0x7f0000000080)='cgroup.max.descendants\x00', 0x2, 0x0) 20:27:34 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x227b) 20:27:34 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000006801"], 0x1c}}, 0x0) 20:27:34 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) 20:27:34 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f00"]) 20:27:34 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0xc0045878) 20:27:34 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000006c01"], 0x1c}}, 0x0) 20:27:34 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f00"]) 20:27:34 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x200002, 0x0) openat$cgroup_int(r0, &(0x7f0000000080)='cgroup.max.descendants\x00', 0x2, 0x0) 20:27:34 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000007401"], 0x1c}}, 0x0) [ 2146.558720][ T2331] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2146.574512][ T2335] program syz-executor.2 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2146.586494][ T2335] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 20:27:34 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x227c) 20:27:34 executing program 2: setsockopt$RXRPC_EXCLUSIVE_CONNECTION(0xffffffffffffffff, 0x110, 0x3) r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) 20:27:34 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0xc0045878) 20:27:34 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000007a01"], 0x1c}}, 0x0) 20:27:34 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0xc0189436) 20:27:34 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x200002, 0x0) openat$cgroup_int(r0, &(0x7f0000000080)='cgroup.max.descendants\x00', 0x2, 0x0) 20:27:34 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x227d) 20:27:34 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f00000000000000040000"]) [ 2146.607197][ T2343] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO 20:27:34 executing program 2: setsockopt$RXRPC_EXCLUSIVE_CONNECTION(0xffffffffffffffff, 0x110, 0x3) r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) 20:27:34 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000000000000a"], 0x1c}}, 0x0) 20:27:34 executing program 2: setsockopt$RXRPC_EXCLUSIVE_CONNECTION(0xffffffffffffffff, 0x110, 0x3) r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) 20:27:34 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x227e) 20:27:34 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000025"], 0x1c}}, 0x0) 20:27:34 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0xc020660b) 20:27:34 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000040)={0xb4, 0x3, 0x7c90, "3411f544edefd0cdd91450b0a1d1969545339db4ae422ac7b420673c0ea913ebe82f0b0c4541393488491b921df196c23279b4baa22ca0b1117cd4a66c546ffda5725d77776ebc210844f20858cf4cc53a590c84ee8ac707905ca6053bb8a628c37438aaeb5285979703d3dd5c0d9953887f09ab62a82c656e5225c8397fe0140c58d7f269a7c649ea262ed347d61ee86055b9255f557c6c7cd7b55d59d1ff2eb1280f6ba78bca305bf5bd95ac87c81304819747"}) 20:27:34 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000"]) [ 2146.661422][ T2358] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO 20:27:34 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000064"], 0x1c}}, 0x0) 20:27:34 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0xffffffffffffffff, 0x82) r0 = socket(0x18, 0x1, 0x3) sendmsg$IPVS_CMD_NEW_SERVICE(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000080)={&(0x7f0000000140)={0x30, 0x0, 0x400, 0x70bd2a, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x8010}, 0x0) 20:27:34 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0xc0481273) 20:27:34 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x227f) 20:27:34 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000002"], 0x1c}}, 0x0) 20:27:34 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x2282) 20:27:34 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000008"], 0x1c}}, 0x0) 20:27:34 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0xffffffffffffffff, 0x82) r0 = socket(0x18, 0x1, 0x3) sendmsg$IPVS_CMD_NEW_SERVICE(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000080)={&(0x7f0000000140)={0x30, 0x0, 0x400, 0x70bd2a, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x8010}, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0xffffffffffffffff, 0x82) (async) socket(0x18, 0x1, 0x3) (async) sendmsg$IPVS_CMD_NEW_SERVICE(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000080)={&(0x7f0000000140)={0x30, 0x0, 0x400, 0x70bd2a, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x8010}, 0x0) (async) 20:27:34 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000"]) 20:27:34 executing program 5: getpriority(0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_open_dev$sg(&(0x7f00000000c0), 0x80000002, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f0000000100)=ANY=[@ANYBLOB="0000330c0000d16f1e15f2548686000000813a7500004b53965500000000fb0e895fc19e81fda6845706b9678d82bca708bf58670050dd96ee74483aaeea7969b28cf11e9eb7492f0c61eb1b09293ade1cb3a04272"]) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000080)=0x406) 20:27:34 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000040)={0xb4, 0x3, 0x7c90, "3411f544edefd0cdd91450b0a1d1969545339db4ae422ac7b420673c0ea913ebe82f0b0c4541393488491b921df196c23279b4baa22ca0b1117cd4a66c546ffda5725d77776ebc210844f20858cf4cc53a590c84ee8ac707905ca6053bb8a628c37438aaeb5285979703d3dd5c0d9953887f09ab62a82c656e5225c8397fe0140c58d7f269a7c649ea262ed347d61ee86055b9255f557c6c7cd7b55d59d1ff2eb1280f6ba78bca305bf5bd95ac87c81304819747"}) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000040)={0xb4, 0x3, 0x7c90, "3411f544edefd0cdd91450b0a1d1969545339db4ae422ac7b420673c0ea913ebe82f0b0c4541393488491b921df196c23279b4baa22ca0b1117cd4a66c546ffda5725d77776ebc210844f20858cf4cc53a590c84ee8ac707905ca6053bb8a628c37438aaeb5285979703d3dd5c0d9953887f09ab62a82c656e5225c8397fe0140c58d7f269a7c649ea262ed347d61ee86055b9255f557c6c7cd7b55d59d1ff2eb1280f6ba78bca305bf5bd95ac87c81304819747"}) (async) 20:27:34 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x2283) [ 2146.734595][ T2378] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2146.758280][ T2373] program syz-executor.3 is using a deprecated SCSI ioctl, please convert it to SG_IO 20:27:34 executing program 5: getpriority(0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_open_dev$sg(&(0x7f00000000c0), 0x80000002, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f0000000100)=ANY=[@ANYBLOB="0000330c0000d16f1e15f2548686000000813a7500004b53965500000000fb0e895fc19e81fda6845706b9678d82bca708bf58670050dd96ee74483aaeea7969b28cf11e9eb7492f0c61eb1b09293ade1cb3a04272"]) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000080)=0x406) getpriority(0x1, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_open_dev$sg(&(0x7f00000000c0), 0x80000002, 0x0) (async) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f0000000100)=ANY=[@ANYBLOB="0000330c0000d16f1e15f2548686000000813a7500004b53965500000000fb0e895fc19e81fda6845706b9678d82bca708bf58670050dd96ee74483aaeea7969b28cf11e9eb7492f0c61eb1b09293ade1cb3a04272"]) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r2, 0x0, 0x0) (async) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000080)=0x406) (async) 20:27:34 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000000000000a"], 0x1c}}, 0x0) 20:27:34 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x2284) 20:27:34 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0xffffffffffffffff, 0x82) r0 = socket(0x18, 0x1, 0x3) sendmsg$IPVS_CMD_NEW_SERVICE(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000080)={&(0x7f0000000140)={0x30, 0x0, 0x400, 0x70bd2a, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x8010}, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0xffffffffffffffff, 0x82) (async) socket(0x18, 0x1, 0x3) (async) sendmsg$IPVS_CMD_NEW_SERVICE(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000080)={&(0x7f0000000140)={0x30, 0x0, 0x400, 0x70bd2a, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x8010}, 0x0) (async) 20:27:34 executing program 5: getpriority(0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_open_dev$sg(&(0x7f00000000c0), 0x80000002, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f0000000100)=ANY=[@ANYBLOB="0000330c0000d16f1e15f2548686000000813a7500004b53965500000000fb0e895fc19e81fda6845706b9678d82bca708bf58670050dd96ee74483aaeea7969b28cf11e9eb7492f0c61eb1b09293ade1cb3a04272"]) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000080)=0x406) getpriority(0x1, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_open_dev$sg(&(0x7f00000000c0), 0x80000002, 0x0) (async) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f0000000100)=ANY=[@ANYBLOB="0000330c0000d16f1e15f2548686000000813a7500004b53965500000000fb0e895fc19e81fda6845706b9678d82bca708bf58670050dd96ee74483aaeea7969b28cf11e9eb7492f0c61eb1b09293ade1cb3a04272"]) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r2, 0x0, 0x0) (async) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000080)=0x406) (async) 20:27:34 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000010"], 0x1c}}, 0x0) 20:27:34 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000"]) [ 2146.811391][ T2399] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2146.847031][ T2402] program syz-executor.3 is using a deprecated SCSI ioctl, please convert it to SG_IO 20:27:34 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000025"], 0x1c}}, 0x0) 20:27:34 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0xa82) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_SCSI_ID(r1, 0x2276, &(0x7f0000000040)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) write$vga_arbiter(r1, &(0x7f0000000080)=@target={'target ', {'PCI:', '1', ':', 'a', ':', '17', '.', '1d'}}, 0x15) 20:27:34 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000064"], 0x1c}}, 0x0) [ 2146.872722][ T2429] program syz-executor.3 is using a deprecated SCSI ioctl, please convert it to SG_IO 20:27:35 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000040)={0xb4, 0x3, 0x7c90, "3411f544edefd0cdd91450b0a1d1969545339db4ae422ac7b420673c0ea913ebe82f0b0c4541393488491b921df196c23279b4baa22ca0b1117cd4a66c546ffda5725d77776ebc210844f20858cf4cc53a590c84ee8ac707905ca6053bb8a628c37438aaeb5285979703d3dd5c0d9953887f09ab62a82c656e5225c8397fe0140c58d7f269a7c649ea262ed347d61ee86055b9255f557c6c7cd7b55d59d1ff2eb1280f6ba78bca305bf5bd95ac87c81304819747"}) 20:27:35 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0xa82) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_GET_SCSI_ID(r1, 0x2276, &(0x7f0000000040)) (async) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) (async) write$vga_arbiter(r1, &(0x7f0000000080)=@target={'target ', {'PCI:', '1', ':', 'a', ':', '17', '.', '1d'}}, 0x15) 20:27:35 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100"/11], 0x1c}}, 0x0) 20:27:35 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x2285) 20:27:35 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f000000000000"]) 20:27:35 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0xa82) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_GET_SCSI_ID(r1, 0x2276, &(0x7f0000000040)) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) (async) write$vga_arbiter(r1, &(0x7f0000000080)=@target={'target ', {'PCI:', '1', ':', 'a', ':', '17', '.', '1d'}}, 0x15) 20:27:35 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000040)) 20:27:35 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000000000000f2"], 0x1c}}, 0x0) 20:27:35 executing program 2: ioctl$PTP_EXTTS_REQUEST(0xffffffffffffffff, 0x40103d02, &(0x7f0000000000)={0x1ff, 0x9}) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0xf04c0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) ioctl$IMGETDEVINFO(r0, 0x80044944, &(0x7f0000000080)={0x2}) 20:27:35 executing program 3: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x123382) 20:27:35 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x2286) 20:27:35 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000040)) 20:27:35 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f000000000000"]) 20:27:35 executing program 2: ioctl$PTP_EXTTS_REQUEST(0xffffffffffffffff, 0x40103d02, &(0x7f0000000000)={0x1ff, 0x9}) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0xf04c0) (async) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) (async) ioctl$IMGETDEVINFO(r0, 0x80044944, &(0x7f0000000080)={0x2}) 20:27:35 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000000000000f8"], 0x1c}}, 0x0) 20:27:35 executing program 3: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x123382) [ 2147.677089][ T2455] program syz-executor.3 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2147.712065][ T2466] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO 20:27:35 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000040)) 20:27:35 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x2287) 20:27:35 executing program 2: ioctl$PTP_EXTTS_REQUEST(0xffffffffffffffff, 0x40103d02, &(0x7f0000000000)={0x1ff, 0x9}) (async) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0xf04c0) (async) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) (async) ioctl$IMGETDEVINFO(r0, 0x80044944, &(0x7f0000000080)={0x2}) 20:27:35 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01000000000000000000f9"], 0x1c}}, 0x0) 20:27:35 executing program 3: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x123382) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x123382) (async) 20:27:35 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x2288) 20:27:35 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f000000000000"]) 20:27:35 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x5000000000005, 0x42083) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x7, 0x442) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000080)) 20:27:35 executing program 5: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x820400, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000080)={r0}, 0x8) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r3 = bpf$ITER_CREATE(0x21, &(0x7f00000000c0)={r1}, 0x8) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x15, 0x0, 0x523c20f0, 0x0, 0x430, r0, 0x40000000, '\x00', 0x0, r1, 0x4, 0x1, 0x2}, 0x48) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200), 0x400040, 0x0) r6 = bpf$ITER_CREATE(0x21, &(0x7f00000002c0)={r3}, 0x8) r7 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r7, 0x0, 0x0) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@bloom_filter={0x1e, 0x46, 0x1, 0xfffffffd, 0x1108, 0x1, 0x78d6, '\x00', 0x0, r1, 0x0, 0x3, 0x3, 0x4}, 0x48) r9 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r9, 0x0, 0x0) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@bloom_filter={0x1e, 0x85, 0xfff, 0x3f, 0x0, r3, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x0, 0x2, 0xf}, 0x48) r11 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r11, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1, 0x5, &(0x7f0000000180)=@raw=[@btf_id={0x18, 0x1, 0x3, 0x0, 0x2}, @map_fd={0x18, 0x8, 0x1, 0x0, r4}, @exit], &(0x7f00000001c0)='syzkaller\x00', 0x7fffffff, 0x0, 0x0, 0x41000, 0x2, '\x00', 0x0, 0x1c, r5, 0x8, &(0x7f0000000240)={0x7, 0x2}, 0x8, 0x10, &(0x7f0000000280)={0x4, 0x9, 0x800, 0x6}, 0x10, 0x0, r6, 0x0, &(0x7f0000000400)=[r3, r7, r8, r3, r9, r10, r11]}, 0x80) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) 20:27:35 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0xf}}, 0x0) [ 2147.768424][ T2484] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO 20:27:35 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x2289) 20:27:35 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x5000000000005, 0x42083) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x7, 0x442) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000080)) syz_open_dev$sg(&(0x7f0000000000), 0x5000000000005, 0x42083) (async) syz_open_dev$sg(&(0x7f0000000040), 0x7, 0x442) (async) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000080)) (async) 20:27:35 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x10}}, 0x0) 20:27:35 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x5000000000005, 0x42083) (async) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x7, 0x442) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000080)) 20:27:35 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x14}}, 0x0) 20:27:35 executing program 2: r0 = socket(0x1d, 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000000240)={'wpan0\x00'}) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000840), 0xffffffffffffffff) sendmsg$NL802154_CMD_DEL_SEC_DEV(r3, &(0x7f0000000940)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000900)={&(0x7f0000000880)={0x58, r4, 0x20, 0x70bd26, 0x25dfdbfb, {}, [@NL802154_ATTR_SEC_DEVICE={0x10, 0x23, 0x0, 0x1, {0xc, 0x4, {0xaaaaaaaaaaaa0002}}}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_SEC_DEVICE={0x10, 0x23, 0x0, 0x1, {0xc, 0x4, {0xaaaaaaaaaaaa0102}}}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}]}, 0x58}}, 0x4050) ioctl$SG_NEXT_CMD_LEN(r2, 0x2283, &(0x7f0000000740)=0x89) ioctl$BINDER_CTL_ADD(0xffffffffffffffff, 0xc1086201, &(0x7f0000000080)={'binder1\x00'}) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(0xffffffffffffffff, 0x84, 0x21, &(0x7f00000007c0)=0x6, 0x4) syz_open_dev$sg(&(0x7f00000006c0), 0x0, 0x40) sendmsg$AUDIT_ADD_RULE(r0, &(0x7f0000000680)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000640)={&(0x7f0000000200)=ANY=[@ANYBLOB="28040000f303020b2dbd7000ffdbdf2504000000020000000f00000001000000ff7f00002500000003000000140500000900000008000000040000000100008006000000000010e40000020000000600000032ffffff05000000040000000300000007000000ff030000000000000900000065000000ff7f00000800000006000000ff070000010001001a000031fc6d003f0000000001000001000080010000df07000000ffffff7f98094000ffff0000ff070000010000000900000002000000030000000800000001000000003dc8910502000009000000ff0000000600000004000000080000000500000080d400008000000000000000020000000600000001000000040000008b000000060000002000000008000000da4e0000060000004f020000040000000400000000040000ff000000ad0d000009000000080000000700000000040000fb0600008100000004000000c4000000af00000000000000030000000180000005000000faffffff0010000001000000ff0f00000900000000fcffffff0f00005f00000000000000070000007f000000650000000600000000000000050000002c08000005000000bd460000040000000100000006000000c0ffffff00000000010100000104000006000000cf03000005000000ff0700000100000000000100ffff0000040000007f000000fbffffff070000000900000000000000ed02000001000100030000000900000001000000e1ffffff8c6c000055b9000005000000e35600005b0d0000ce000000090000000900000009000000020000000000000006000000040000003f000000050000000010000007000000ffffff7f2e155c6e00100000080000000400000080000000000000000100000002000000fa000000000000000800000000000000030000008f000000415cfc1e08000000ff0f000001040000080000000200000009000000040000000cbd00000180000002000000c70000006c0b0000ffffffff40000000ff0f00009844000001800000000400000000020005000000050000000200000008000000fffffffffefffffffdffffff00000100ffffffff7f000000010000000700000001000000020000000400000000000080050000000008000001000000010400000010000000000000ff030000010000003f00000001000000020000003888bbef45bba99001000000fde200000300000006000000000000003103000081000000020000004707000006000000ff0300000600000001000000d52800000200000005000000423000000200000002000000010000000001000003000000200000000600000005000000090000000300000060010000200000005b342057002080000300000004000000a77c0000050000000600000000c0ff1f010400000500000000000000ffffff7f010000000100000005000000fcffffff000400000900000009000000050000000700000029297d2565"], 0x428}, 0x1, 0x0, 0x0, 0x8040}, 0x800) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000700), 0x80, 0x0) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000780)={0x641c, [0x8, 0xfffffffc], 0xa0}, 0x10) ioctl$SG_GET_SCSI_ID(r1, 0x2276, &(0x7f0000000040)) [ 2147.876862][ T2525] can: request_module (can-proto-0) failed. 20:27:36 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000200), 0x8) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000240)=0x5) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x100, 0x40) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000080)) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000280)={0x93, 0x18da84f7, 0xffffffb6, "7ce3d8beffafefd00d9367a810f94a020a4848895bf2d8b17639245eef65fd675c6c803e825e437e974ea33d39c15754d91f89d5238413841315adc5e6ae2274551c7af98f5d24dbe33b35ed70369ba0be764cb7f6ccf08a7edff8adbc994c76ed3fbeb61ca26a8b2f905243bf60808944b3fc9cd49a337576ccefc0ab2f208eb173df11ad359d08b9c3051ddb4ebd737cf9ee"}) 20:27:36 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0xc0}}, 0x0) 20:27:36 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f0000000000000004"]) 20:27:36 executing program 5: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x820400, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000080)={r0}, 0x8) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) r3 = bpf$ITER_CREATE(0x21, &(0x7f00000000c0)={r1}, 0x8) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x15, 0x0, 0x523c20f0, 0x0, 0x430, r0, 0x40000000, '\x00', 0x0, r1, 0x4, 0x1, 0x2}, 0x48) (async) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200), 0x400040, 0x0) (async) r6 = bpf$ITER_CREATE(0x21, &(0x7f00000002c0)={r3}, 0x8) (async, rerun: 64) r7 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (rerun: 64) write$vga_arbiter(r7, 0x0, 0x0) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@bloom_filter={0x1e, 0x46, 0x1, 0xfffffffd, 0x1108, 0x1, 0x78d6, '\x00', 0x0, r1, 0x0, 0x3, 0x3, 0x4}, 0x48) (async) r9 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r9, 0x0, 0x0) (async) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@bloom_filter={0x1e, 0x85, 0xfff, 0x3f, 0x0, r3, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x0, 0x2, 0xf}, 0x48) r11 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r11, 0x0, 0x0) (async, rerun: 64) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1, 0x5, &(0x7f0000000180)=@raw=[@btf_id={0x18, 0x1, 0x3, 0x0, 0x2}, @map_fd={0x18, 0x8, 0x1, 0x0, r4}, @exit], &(0x7f00000001c0)='syzkaller\x00', 0x7fffffff, 0x0, 0x0, 0x41000, 0x2, '\x00', 0x0, 0x1c, r5, 0x8, &(0x7f0000000240)={0x7, 0x2}, 0x8, 0x10, &(0x7f0000000280)={0x4, 0x9, 0x800, 0x6}, 0x10, 0x0, r6, 0x0, &(0x7f0000000400)=[r3, r7, r8, r3, r9, r10, r11]}, 0x80) (rerun: 64) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) 20:27:36 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x4b47) 20:27:36 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0xec0}}, 0x0) 20:27:36 executing program 2: r0 = socket(0x1d, 0x0, 0x0) (async) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000000240)={'wpan0\x00'}) (async) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000840), 0xffffffffffffffff) sendmsg$NL802154_CMD_DEL_SEC_DEV(r3, &(0x7f0000000940)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000900)={&(0x7f0000000880)={0x58, r4, 0x20, 0x70bd26, 0x25dfdbfb, {}, [@NL802154_ATTR_SEC_DEVICE={0x10, 0x23, 0x0, 0x1, {0xc, 0x4, {0xaaaaaaaaaaaa0002}}}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_SEC_DEVICE={0x10, 0x23, 0x0, 0x1, {0xc, 0x4, {0xaaaaaaaaaaaa0102}}}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}]}, 0x58}}, 0x4050) ioctl$SG_NEXT_CMD_LEN(r2, 0x2283, &(0x7f0000000740)=0x89) (async) ioctl$BINDER_CTL_ADD(0xffffffffffffffff, 0xc1086201, &(0x7f0000000080)={'binder1\x00'}) (async) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(0xffffffffffffffff, 0x84, 0x21, &(0x7f00000007c0)=0x6, 0x4) (async) syz_open_dev$sg(&(0x7f00000006c0), 0x0, 0x40) sendmsg$AUDIT_ADD_RULE(r0, &(0x7f0000000680)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000640)={&(0x7f0000000200)=ANY=[@ANYBLOB="28040000f303020b2dbd7000ffdbdf2504000000020000000f00000001000000ff7f00002500000003000000140500000900000008000000040000000100008006000000000010e40000020000000600000032ffffff05000000040000000300000007000000ff030000000000000900000065000000ff7f00000800000006000000ff070000010001001a000031fc6d003f0000000001000001000080010000df07000000ffffff7f98094000ffff0000ff070000010000000900000002000000030000000800000001000000003dc8910502000009000000ff0000000600000004000000080000000500000080d400008000000000000000020000000600000001000000040000008b000000060000002000000008000000da4e0000060000004f020000040000000400000000040000ff000000ad0d000009000000080000000700000000040000fb0600008100000004000000c4000000af00000000000000030000000180000005000000faffffff0010000001000000ff0f00000900000000fcffffff0f00005f00000000000000070000007f000000650000000600000000000000050000002c08000005000000bd460000040000000100000006000000c0ffffff00000000010100000104000006000000cf03000005000000ff0700000100000000000100ffff0000040000007f000000fbffffff070000000900000000000000ed02000001000100030000000900000001000000e1ffffff8c6c000055b9000005000000e35600005b0d0000ce000000090000000900000009000000020000000000000006000000040000003f000000050000000010000007000000ffffff7f2e155c6e00100000080000000400000080000000000000000100000002000000fa000000000000000800000000000000030000008f000000415cfc1e08000000ff0f000001040000080000000200000009000000040000000cbd00000180000002000000c70000006c0b0000ffffffff40000000ff0f00009844000001800000000400000000020005000000050000000200000008000000fffffffffefffffffdffffff00000100ffffffff7f000000010000000700000001000000020000000400000000000080050000000008000001000000010400000010000000000000ff030000010000003f00000001000000020000003888bbef45bba99001000000fde200000300000006000000000000003103000081000000020000004707000006000000ff0300000600000001000000d52800000200000005000000423000000200000002000000010000000001000003000000200000000600000005000000090000000300000060010000200000005b342057002080000300000004000000a77c0000050000000600000000c0ff1f010400000500000000000000ffffff7f010000000100000005000000fcffffff000400000900000009000000050000000700000029297d2565"], 0x428}, 0x1, 0x0, 0x0, 0x8040}, 0x800) (async) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000700), 0x80, 0x0) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000780)={0x641c, [0x8, 0xfffffffc], 0xa0}, 0x10) (async) ioctl$SG_GET_SCSI_ID(r1, 0x2276, &(0x7f0000000040)) 20:27:36 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000200), 0x8) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000240)=0x5) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x100, 0x40) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000080)) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000280)={0x93, 0x18da84f7, 0xffffffb6, "7ce3d8beffafefd00d9367a810f94a020a4848895bf2d8b17639245eef65fd675c6c803e825e437e974ea33d39c15754d91f89d5238413841315adc5e6ae2274551c7af98f5d24dbe33b35ed70369ba0be764cb7f6ccf08a7edff8adbc994c76ed3fbeb61ca26a8b2f905243bf60808944b3fc9cd49a337576ccefc0ab2f208eb173df11ad359d08b9c3051ddb4ebd737cf9ee"}) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000200), 0x8) (async) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000240)=0x5) (async) syz_open_dev$sg(&(0x7f0000000040), 0x100, 0x40) (async) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000080)) (async) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000280)={0x93, 0x18da84f7, 0xffffffb6, "7ce3d8beffafefd00d9367a810f94a020a4848895bf2d8b17639245eef65fd675c6c803e825e437e974ea33d39c15754d91f89d5238413841315adc5e6ae2274551c7af98f5d24dbe33b35ed70369ba0be764cb7f6ccf08a7edff8adbc994c76ed3fbeb61ca26a8b2f905243bf60808944b3fc9cd49a337576ccefc0ab2f208eb173df11ad359d08b9c3051ddb4ebd737cf9ee"}) (async) 20:27:36 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f000000000000"]) 20:27:36 executing program 5: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x820400, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000080)={r0}, 0x8) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) r3 = bpf$ITER_CREATE(0x21, &(0x7f00000000c0)={r1}, 0x8) (async) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x15, 0x0, 0x523c20f0, 0x0, 0x430, r0, 0x40000000, '\x00', 0x0, r1, 0x4, 0x1, 0x2}, 0x48) (async) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200), 0x400040, 0x0) r6 = bpf$ITER_CREATE(0x21, &(0x7f00000002c0)={r3}, 0x8) (async) r7 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r7, 0x0, 0x0) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@bloom_filter={0x1e, 0x46, 0x1, 0xfffffffd, 0x1108, 0x1, 0x78d6, '\x00', 0x0, r1, 0x0, 0x3, 0x3, 0x4}, 0x48) r9 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r9, 0x0, 0x0) (async) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@bloom_filter={0x1e, 0x85, 0xfff, 0x3f, 0x0, r3, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x0, 0x2, 0xf}, 0x48) r11 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r11, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1, 0x5, &(0x7f0000000180)=@raw=[@btf_id={0x18, 0x1, 0x3, 0x0, 0x2}, @map_fd={0x18, 0x8, 0x1, 0x0, r4}, @exit], &(0x7f00000001c0)='syzkaller\x00', 0x7fffffff, 0x0, 0x0, 0x41000, 0x2, '\x00', 0x0, 0x1c, r5, 0x8, &(0x7f0000000240)={0x7, 0x2}, 0x8, 0x10, &(0x7f0000000280)={0x4, 0x9, 0x800, 0x6}, 0x10, 0x0, r6, 0x0, &(0x7f0000000400)=[r3, r7, r8, r3, r9, r10, r11]}, 0x80) (async) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) 20:27:36 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x4b49) 20:27:36 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x33fe0}}, 0x0) [ 2148.672300][ T2534] __nla_validate_parse: 29 callbacks suppressed [ 2148.672316][ T2534] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2148.690501][ T2537] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2148.707787][ T2547] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:36 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x200000dc}}, 0x0) 20:27:36 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x7ffff000}}, 0x0) 20:27:36 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0xfffffdef}}, 0x0) 20:27:36 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0x2}, 0x0) [ 2148.752711][ T2573] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2148.753125][ T2554] can: request_module (can-proto-0) failed. 20:27:36 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0x8}, 0x0) 20:27:36 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0xa}, 0x0) [ 2148.806895][ T2583] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2148.827127][ T2585] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2148.848111][ T2587] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:37 executing program 2: r0 = socket(0x1d, 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000000240)={'wpan0\x00'}) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000840), 0xffffffffffffffff) sendmsg$NL802154_CMD_DEL_SEC_DEV(r3, &(0x7f0000000940)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000900)={&(0x7f0000000880)={0x58, r4, 0x20, 0x70bd26, 0x25dfdbfb, {}, [@NL802154_ATTR_SEC_DEVICE={0x10, 0x23, 0x0, 0x1, {0xc, 0x4, {0xaaaaaaaaaaaa0002}}}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_SEC_DEVICE={0x10, 0x23, 0x0, 0x1, {0xc, 0x4, {0xaaaaaaaaaaaa0102}}}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}]}, 0x58}}, 0x4050) ioctl$SG_NEXT_CMD_LEN(r2, 0x2283, &(0x7f0000000740)=0x89) ioctl$BINDER_CTL_ADD(0xffffffffffffffff, 0xc1086201, &(0x7f0000000080)={'binder1\x00'}) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(0xffffffffffffffff, 0x84, 0x21, &(0x7f00000007c0)=0x6, 0x4) syz_open_dev$sg(&(0x7f00000006c0), 0x0, 0x40) sendmsg$AUDIT_ADD_RULE(r0, &(0x7f0000000680)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000640)={&(0x7f0000000200)=ANY=[@ANYBLOB="28040000f303020b2dbd7000ffdbdf2504000000020000000f00000001000000ff7f00002500000003000000140500000900000008000000040000000100008006000000000010e40000020000000600000032ffffff05000000040000000300000007000000ff030000000000000900000065000000ff7f00000800000006000000ff070000010001001a000031fc6d003f0000000001000001000080010000df07000000ffffff7f98094000ffff0000ff070000010000000900000002000000030000000800000001000000003dc8910502000009000000ff0000000600000004000000080000000500000080d400008000000000000000020000000600000001000000040000008b000000060000002000000008000000da4e0000060000004f020000040000000400000000040000ff000000ad0d000009000000080000000700000000040000fb0600008100000004000000c4000000af00000000000000030000000180000005000000faffffff0010000001000000ff0f00000900000000fcffffff0f00005f00000000000000070000007f000000650000000600000000000000050000002c08000005000000bd460000040000000100000006000000c0ffffff00000000010100000104000006000000cf03000005000000ff0700000100000000000100ffff0000040000007f000000fbffffff070000000900000000000000ed02000001000100030000000900000001000000e1ffffff8c6c000055b9000005000000e35600005b0d0000ce000000090000000900000009000000020000000000000006000000040000003f000000050000000010000007000000ffffff7f2e155c6e00100000080000000400000080000000000000000100000002000000fa000000000000000800000000000000030000008f000000415cfc1e08000000ff0f000001040000080000000200000009000000040000000cbd00000180000002000000c70000006c0b0000ffffffff40000000ff0f00009844000001800000000400000000020005000000050000000200000008000000fffffffffefffffffdffffff00000100ffffffff7f000000010000000700000001000000020000000400000000000080050000000008000001000000010400000010000000000000ff030000010000003f00000001000000020000003888bbef45bba99001000000fde200000300000006000000000000003103000081000000020000004707000006000000ff0300000600000001000000d52800000200000005000000423000000200000002000000010000000001000003000000200000000600000005000000090000000300000060010000200000005b342057002080000300000004000000a77c0000050000000600000000c0ff1f010400000500000000000000ffffff7f010000000100000005000000fcffffff000400000900000009000000050000000700000029297d2565"], 0x428}, 0x1, 0x0, 0x0, 0x8040}, 0x800) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000700), 0x80, 0x0) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000780)={0x641c, [0x8, 0xfffffffc], 0xa0}, 0x10) ioctl$SG_GET_SCSI_ID(r1, 0x2276, &(0x7f0000000040)) socket(0x1d, 0x0, 0x0) (async) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r2, 0x0, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000000240)={'wpan0\x00'}) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000840), 0xffffffffffffffff) (async) sendmsg$NL802154_CMD_DEL_SEC_DEV(r3, &(0x7f0000000940)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000900)={&(0x7f0000000880)={0x58, r4, 0x20, 0x70bd26, 0x25dfdbfb, {}, [@NL802154_ATTR_SEC_DEVICE={0x10, 0x23, 0x0, 0x1, {0xc, 0x4, {0xaaaaaaaaaaaa0002}}}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_SEC_DEVICE={0x10, 0x23, 0x0, 0x1, {0xc, 0x4, {0xaaaaaaaaaaaa0102}}}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}]}, 0x58}}, 0x4050) (async) ioctl$SG_NEXT_CMD_LEN(r2, 0x2283, &(0x7f0000000740)=0x89) (async) ioctl$BINDER_CTL_ADD(0xffffffffffffffff, 0xc1086201, &(0x7f0000000080)={'binder1\x00'}) (async) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(0xffffffffffffffff, 0x84, 0x21, &(0x7f00000007c0)=0x6, 0x4) (async) syz_open_dev$sg(&(0x7f00000006c0), 0x0, 0x40) (async) sendmsg$AUDIT_ADD_RULE(r0, &(0x7f0000000680)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000640)={&(0x7f0000000200)=ANY=[@ANYBLOB="28040000f303020b2dbd7000ffdbdf2504000000020000000f00000001000000ff7f00002500000003000000140500000900000008000000040000000100008006000000000010e40000020000000600000032ffffff05000000040000000300000007000000ff030000000000000900000065000000ff7f00000800000006000000ff070000010001001a000031fc6d003f0000000001000001000080010000df07000000ffffff7f98094000ffff0000ff070000010000000900000002000000030000000800000001000000003dc8910502000009000000ff0000000600000004000000080000000500000080d400008000000000000000020000000600000001000000040000008b000000060000002000000008000000da4e0000060000004f020000040000000400000000040000ff000000ad0d000009000000080000000700000000040000fb0600008100000004000000c4000000af00000000000000030000000180000005000000faffffff0010000001000000ff0f00000900000000fcffffff0f00005f00000000000000070000007f000000650000000600000000000000050000002c08000005000000bd460000040000000100000006000000c0ffffff00000000010100000104000006000000cf03000005000000ff0700000100000000000100ffff0000040000007f000000fbffffff070000000900000000000000ed02000001000100030000000900000001000000e1ffffff8c6c000055b9000005000000e35600005b0d0000ce000000090000000900000009000000020000000000000006000000040000003f000000050000000010000007000000ffffff7f2e155c6e00100000080000000400000080000000000000000100000002000000fa000000000000000800000000000000030000008f000000415cfc1e08000000ff0f000001040000080000000200000009000000040000000cbd00000180000002000000c70000006c0b0000ffffffff40000000ff0f00009844000001800000000400000000020005000000050000000200000008000000fffffffffefffffffdffffff00000100ffffffff7f000000010000000700000001000000020000000400000000000080050000000008000001000000010400000010000000000000ff030000010000003f00000001000000020000003888bbef45bba99001000000fde200000300000006000000000000003103000081000000020000004707000006000000ff0300000600000001000000d52800000200000005000000423000000200000002000000010000000001000003000000200000000600000005000000090000000300000060010000200000005b342057002080000300000004000000a77c0000050000000600000000c0ff1f010400000500000000000000ffffff7f010000000100000005000000fcffffff000400000900000009000000050000000700000029297d2565"], 0x428}, 0x1, 0x0, 0x0, 0x8040}, 0x800) (async) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000700), 0x80, 0x0) (async) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000780)={0x641c, [0x8, 0xfffffffc], 0xa0}, 0x10) (async) ioctl$SG_GET_SCSI_ID(r1, 0x2276, &(0x7f0000000040)) (async) 20:27:37 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0x10}, 0x0) 20:27:37 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000200), 0x8) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000240)=0x5) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x100, 0x40) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000080)) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000280)={0x93, 0x18da84f7, 0xffffffb6, "7ce3d8beffafefd00d9367a810f94a020a4848895bf2d8b17639245eef65fd675c6c803e825e437e974ea33d39c15754d91f89d5238413841315adc5e6ae2274551c7af98f5d24dbe33b35ed70369ba0be764cb7f6ccf08a7edff8adbc994c76ed3fbeb61ca26a8b2f905243bf60808944b3fc9cd49a337576ccefc0ab2f208eb173df11ad359d08b9c3051ddb4ebd737cf9ee"}) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000200), 0x8) (async) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000240)=0x5) (async) syz_open_dev$sg(&(0x7f0000000040), 0x100, 0x40) (async) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000080)) (async) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000280)={0x93, 0x18da84f7, 0xffffffb6, "7ce3d8beffafefd00d9367a810f94a020a4848895bf2d8b17639245eef65fd675c6c803e825e437e974ea33d39c15754d91f89d5238413841315adc5e6ae2274551c7af98f5d24dbe33b35ed70369ba0be764cb7f6ccf08a7edff8adbc994c76ed3fbeb61ca26a8b2f905243bf60808944b3fc9cd49a337576ccefc0ab2f208eb173df11ad359d08b9c3051ddb4ebd737cf9ee"}) (async) 20:27:37 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5309) 20:27:37 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f000000000000"]) 20:27:37 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0x25}, 0x0) [ 2149.586219][ T2589] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2149.597374][ T2591] can: request_module (can-proto-0) failed. 20:27:37 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={&(0x7f0000000180), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x36}]}, 0x24}}, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f0000000040)) 20:27:37 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0x64}, 0x0) 20:27:37 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0x300}, 0x0) 20:27:37 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0x7ffffff2}, 0x0) [ 2149.630629][ T2605] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2149.651038][ T2609] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2149.671639][ T2612] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:37 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0x7ffffff8}, 0x0) 20:27:37 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0x7ffffff9}, 0x0) 20:27:37 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x20000000, 0x56b403) 20:27:37 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0x1, 0x2}, 0x0) [ 2149.725444][ T2622] can: request_module (can-proto-0) failed. 20:27:38 executing program 3: r0 = socket(0x22, 0x3, 0x0) sendmsg$AUDIT_TTY_SET(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x18, 0x3f9, 0x30, 0x70bd2a, 0x25dfdbfc, {}, ["", ""]}, 0x18}, 0x1, 0x0, 0x0, 0x4008040}, 0x10) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x34e, 0x42) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) 20:27:38 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5319) 20:27:38 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0x1, 0x3}, 0x0) 20:27:38 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x20000000, 0x56b403) 20:27:38 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f000000000000"]) 20:27:38 executing program 3: r0 = socket(0x22, 0x3, 0x0) sendmsg$AUDIT_TTY_SET(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x18, 0x3f9, 0x30, 0x70bd2a, 0x25dfdbfc, {}, ["", ""]}, 0x18}, 0x1, 0x0, 0x0, 0x4008040}, 0x10) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x34e, 0x42) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) 20:27:38 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (rerun: 64) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={&(0x7f0000000180), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x36}]}, 0x24}}, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f0000000040)) 20:27:38 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x20000000, 0x56b403) 20:27:38 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) 20:27:38 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0x1, 0x4}, 0x0) 20:27:38 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000240)) write$vga_arbiter(r0, 0x0, 0x0) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000040)) r1 = syz_open_dev$sg(&(0x7f0000000080), 0x1d5, 0x80) r2 = socket(0x17, 0x5, 0x20) sendmsg$IPVS_CMD_NEW_SERVICE(r2, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="080627bd7000ffdbdf250100000008000400ff7fffff080006000100000014000280080004000000008006000f008d0000003400028008000400ff00000008000900ff7f00000800090028000000080004000000000008000700130100000800030003000000"], 0x6c}, 0x1, 0x0, 0x0, 0x4054010}, 0x40000) ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f00000000c0)=0x2) 20:27:38 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5381) [ 2150.463819][ T2638] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 2150.473970][ T2643] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO 20:27:38 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0x1, 0x5}, 0x0) 20:27:38 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f00000000000000"]) 20:27:38 executing program 3: r0 = socket(0x22, 0x3, 0x0) sendmsg$AUDIT_TTY_SET(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x18, 0x3f9, 0x30, 0x70bd2a, 0x25dfdbfc, {}, ["", ""]}, 0x18}, 0x1, 0x0, 0x0, 0x4008040}, 0x10) (async) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x34e, 0x42) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) 20:27:38 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={&(0x7f0000000180), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x36}]}, 0x24}}, 0x0) (async) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) (async) ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f0000000040)) 20:27:38 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0x1, 0x6}, 0x0) 20:27:38 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5382) 20:27:38 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000240)) (async, rerun: 64) write$vga_arbiter(r0, 0x0, 0x0) (async, rerun: 64) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000040)) r1 = syz_open_dev$sg(&(0x7f0000000080), 0x1d5, 0x80) (async, rerun: 64) r2 = socket(0x17, 0x5, 0x20) (rerun: 64) sendmsg$IPVS_CMD_NEW_SERVICE(r2, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="080627bd7000ffdbdf250100000008000400ff7fffff080006000100000014000280080004000000008006000f008d0000003400028008000400ff00000008000900ff7f00000800090028000000080004000000000008000700130100000800030003000000"], 0x6c}, 0x1, 0x0, 0x0, 0x4054010}, 0x40000) (async, rerun: 32) ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f00000000c0)=0x2) (rerun: 32) 20:27:38 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0x1, 0x7}, 0x0) 20:27:38 executing program 3: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_MPATH(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, r1, 0x302, 0x70bd28, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0xb21, 0x2a}}}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000800}, 0x1) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) 20:27:38 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x4, 0x101082) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r4, 0x0, 0x0) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r5, 0x0, 0x0) r6 = bpf$ITER_CREATE(0x21, &(0x7f00000001c0), 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x12, 0xb, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x9}, [@map_fd={0x18, 0x7, 0x1, 0x0, r1}, @alu={0x4, 0x1, 0x1, 0xc95c647874fd47d8, 0x8, 0x6, 0x89533c83a36759ce}, @map_fd={0x18, 0x3, 0x1, 0x0, r2}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x5}, @map_idx_val={0x18, 0x2, 0x6, 0x0, 0x10, 0x0, 0x0, 0x0, 0x7d}]}, &(0x7f0000000100)='GPL\x00', 0x3f, 0x0, 0x0, 0x41100, 0x4, '\x00', 0x0, 0xc1423aeda0b98d73, r1, 0x8, &(0x7f0000000140)={0x7, 0x4}, 0x8, 0x10, &(0x7f0000000180)={0x2, 0xd, 0x9, 0x8}, 0x10, 0x0, r3, 0x0, &(0x7f0000000200)=[r4, r1, r1, r1, r1, r1, r5, r6]}, 0x80) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f0000000040)={0xd930, [0x100, 0x80000040], 0xa}, 0x10) 20:27:38 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5385) 20:27:38 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f00000000000000"]) [ 2150.554949][ T2666] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO 20:27:38 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x4, 0x101082) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r4, 0x0, 0x0) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r5, 0x0, 0x0) r6 = bpf$ITER_CREATE(0x21, &(0x7f00000001c0), 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x12, 0xb, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x9}, [@map_fd={0x18, 0x7, 0x1, 0x0, r1}, @alu={0x4, 0x1, 0x1, 0xc95c647874fd47d8, 0x8, 0x6, 0x89533c83a36759ce}, @map_fd={0x18, 0x3, 0x1, 0x0, r2}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x5}, @map_idx_val={0x18, 0x2, 0x6, 0x0, 0x10, 0x0, 0x0, 0x0, 0x7d}]}, &(0x7f0000000100)='GPL\x00', 0x3f, 0x0, 0x0, 0x41100, 0x4, '\x00', 0x0, 0xc1423aeda0b98d73, r1, 0x8, &(0x7f0000000140)={0x7, 0x4}, 0x8, 0x10, &(0x7f0000000180)={0x2, 0xd, 0x9, 0x8}, 0x10, 0x0, r3, 0x0, &(0x7f0000000200)=[r4, r1, r1, r1, r1, r1, r5, r6]}, 0x80) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f0000000040)={0xd930, [0x100, 0x80000040], 0xa}, 0x10) syz_open_dev$sg(&(0x7f0000000000), 0x4, 0x101082) (async) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r2, 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r3, 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r4, 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r5, 0x0, 0x0) (async) bpf$ITER_CREATE(0x21, &(0x7f00000001c0), 0x8) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x12, 0xb, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x9}, [@map_fd={0x18, 0x7, 0x1, 0x0, r1}, @alu={0x4, 0x1, 0x1, 0xc95c647874fd47d8, 0x8, 0x6, 0x89533c83a36759ce}, @map_fd={0x18, 0x3, 0x1, 0x0, r2}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x5}, @map_idx_val={0x18, 0x2, 0x6, 0x0, 0x10, 0x0, 0x0, 0x0, 0x7d}]}, &(0x7f0000000100)='GPL\x00', 0x3f, 0x0, 0x0, 0x41100, 0x4, '\x00', 0x0, 0xc1423aeda0b98d73, r1, 0x8, &(0x7f0000000140)={0x7, 0x4}, 0x8, 0x10, &(0x7f0000000180)={0x2, 0xd, 0x9, 0x8}, 0x10, 0x0, r3, 0x0, &(0x7f0000000200)=[r4, r1, r1, r1, r1, r1, r5, r6]}, 0x80) (async) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f0000000040)={0xd930, [0x100, 0x80000040], 0xa}, 0x10) (async) 20:27:38 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0x1, 0x8}, 0x0) 20:27:38 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x4, 0x101082) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r3, 0x0, 0x0) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r4, 0x0, 0x0) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r5, 0x0, 0x0) r6 = bpf$ITER_CREATE(0x21, &(0x7f00000001c0), 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x12, 0xb, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x9}, [@map_fd={0x18, 0x7, 0x1, 0x0, r1}, @alu={0x4, 0x1, 0x1, 0xc95c647874fd47d8, 0x8, 0x6, 0x89533c83a36759ce}, @map_fd={0x18, 0x3, 0x1, 0x0, r2}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x5}, @map_idx_val={0x18, 0x2, 0x6, 0x0, 0x10, 0x0, 0x0, 0x0, 0x7d}]}, &(0x7f0000000100)='GPL\x00', 0x3f, 0x0, 0x0, 0x41100, 0x4, '\x00', 0x0, 0xc1423aeda0b98d73, r1, 0x8, &(0x7f0000000140)={0x7, 0x4}, 0x8, 0x10, &(0x7f0000000180)={0x2, 0xd, 0x9, 0x8}, 0x10, 0x0, r3, 0x0, &(0x7f0000000200)=[r4, r1, r1, r1, r1, r1, r5, r6]}, 0x80) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f0000000040)={0xd930, [0x100, 0x80000040], 0xa}, 0x10) syz_open_dev$sg(&(0x7f0000000000), 0x4, 0x101082) (async) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r1, 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r2, 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r3, 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r4, 0x0, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r5, 0x0, 0x0) (async) bpf$ITER_CREATE(0x21, &(0x7f00000001c0), 0x8) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x12, 0xb, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x9}, [@map_fd={0x18, 0x7, 0x1, 0x0, r1}, @alu={0x4, 0x1, 0x1, 0xc95c647874fd47d8, 0x8, 0x6, 0x89533c83a36759ce}, @map_fd={0x18, 0x3, 0x1, 0x0, r2}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x5}, @map_idx_val={0x18, 0x2, 0x6, 0x0, 0x10, 0x0, 0x0, 0x0, 0x7d}]}, &(0x7f0000000100)='GPL\x00', 0x3f, 0x0, 0x0, 0x41100, 0x4, '\x00', 0x0, 0xc1423aeda0b98d73, r1, 0x8, &(0x7f0000000140)={0x7, 0x4}, 0x8, 0x10, &(0x7f0000000180)={0x2, 0xd, 0x9, 0x8}, 0x10, 0x0, r3, 0x0, &(0x7f0000000200)=[r4, r1, r1, r1, r1, r1, r5, r6]}, 0x80) (async) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f0000000040)={0xd930, [0x100, 0x80000040], 0xa}, 0x10) (async) 20:27:38 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0x1, 0x9}, 0x0) 20:27:38 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0x1, 0xa}, 0x0) 20:27:38 executing program 5: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SG_EMULATED_HOST(0xffffffffffffffff, 0x2203, &(0x7f0000000040)) syz_open_dev$sg(&(0x7f0000000080), 0x7, 0x205) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) sendmsg$AUDIT_DEL_RULE(r0, &(0x7f0000000640)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000600)={&(0x7f0000000180)={0x444, 0x3f4, 0x702, 0x70bd2d, 0x25dfdbfe, {0x0, 0x1, 0xd, [0x2, 0x8, 0xffff, 0xaf89, 0x7, 0x7, 0x53d, 0xa67, 0x60, 0x800, 0x50c, 0x20, 0x7f, 0xc7, 0x3, 0x800, 0x800, 0x60, 0x9, 0x0, 0x80000001, 0x1ff, 0x40, 0x1, 0x5, 0x500000, 0xa6, 0xffff, 0x5, 0x7, 0x2, 0x98bb, 0x9, 0xffff, 0x1, 0x6, 0x0, 0x10000, 0x60800000, 0xc9a, 0x8000, 0x7, 0xfffffffc, 0x6, 0x1, 0x0, 0x6b4a68ba, 0x10000, 0xfffffffa, 0x9, 0x7, 0xfffffffd, 0x1000, 0x1, 0x2, 0x2, 0xfffff5a9, 0xb33, 0x6, 0x7, 0x7f, 0x7, 0x40, 0x4], [0x2, 0x326, 0x6, 0x0, 0x9, 0x1, 0x7, 0x8, 0xfffffff8, 0x6, 0x10001, 0x8000, 0xddef, 0x6, 0x101, 0x4, 0x0, 0xfff, 0x100, 0x5, 0x7, 0x6, 0x7fff, 0x4, 0x1f, 0x9f, 0x0, 0x5, 0x29eabe6f, 0x9, 0x5, 0x6, 0x4, 0x970, 0x4, 0xfa22, 0x1000, 0x7fff, 0x16c0, 0x1, 0x400, 0x0, 0x0, 0x363b, 0x80000000, 0x2, 0x8a9, 0xfffffffb, 0x5, 0x5, 0x0, 0x5, 0x9, 0x5, 0x15, 0x1, 0x200, 0xcd, 0x5, 0x2, 0x7, 0x1, 0x101, 0x9], [0x85, 0x0, 0x400, 0x7, 0x3, 0x10001, 0x3, 0x1, 0x6, 0x401, 0x28e, 0x1000, 0x9, 0x3, 0x4de6, 0xbee, 0x1, 0x2, 0xf5, 0x81, 0xce, 0x2, 0x2, 0x3f, 0xbb, 0xffffffff, 0x3f, 0x77ff, 0x8, 0x5ace, 0x800, 0x9, 0x3, 0x27, 0x8, 0x9, 0x0, 0xd92, 0x9, 0x3, 0x9, 0x8, 0x200, 0x1, 0x6, 0xf82a64f, 0xfffffffd, 0x8000, 0x7, 0x5, 0x400, 0x1, 0x200, 0x0, 0x3, 0x1, 0x4, 0x9, 0x10001, 0x4, 0x40, 0x6, 0x3, 0x2f], [0x3, 0x2, 0x899d, 0xfe, 0x7f, 0xffffffff, 0x0, 0xc6, 0x2, 0xfffff7bf, 0xfffffffa, 0x8, 0x3, 0x3, 0x4e43, 0x1ff, 0x81, 0x0, 0x3f, 0x80000000, 0x8, 0x101, 0x8, 0x8000, 0x0, 0x4, 0x8, 0x1, 0x4, 0x800, 0x9, 0x1, 0x13d5, 0x5, 0x1000, 0x8, 0x2, 0xe0, 0x9, 0x1, 0x80000001, 0x1, 0x10000, 0x86e, 0xffffffff, 0x5, 0x8, 0x8, 0x101, 0x5, 0x1, 0x5, 0x8001, 0xa1, 0x1, 0x10001, 0xf76, 0x400, 0x2, 0x6, 0xa00b, 0x2, 0x3f, 0x100], 0x22, ['.-+^\xa9\xe6%.:$})&]\x00', '\x00', ',::],!\x00', '/dev/hwrng\x00']}, ["", "", ""]}, 0x444}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) ioctl$SG_GET_RESERVED_SIZE(r0, 0x2272, &(0x7f0000000100)) openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) 20:27:38 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000240)) (async) write$vga_arbiter(r0, 0x0, 0x0) (async) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000040)) (async) r1 = syz_open_dev$sg(&(0x7f0000000080), 0x1d5, 0x80) r2 = socket(0x17, 0x5, 0x20) sendmsg$IPVS_CMD_NEW_SERVICE(r2, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="080627bd7000ffdbdf250100000008000400ff7fffff080006000100000014000280080004000000008006000f008d0000003400028008000400ff00000008000900ff7f00000800090028000000080004000000000008000700130100000800030003000000"], 0x6c}, 0x1, 0x0, 0x0, 0x4054010}, 0x40000) ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f00000000c0)=0x2) 20:27:38 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0x1, 0xb}, 0x0) 20:27:38 executing program 3: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_MPATH(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, r1, 0x302, 0x70bd28, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0xb21, 0x2a}}}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000800}, 0x1) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r0, 0x0, 0x0) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) sendmsg$NL80211_CMD_NEW_MPATH(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, r1, 0x302, 0x70bd28, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0xb21, 0x2a}}}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000800}, 0x1) (async) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) 20:27:38 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5386) 20:27:38 executing program 5: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) ioctl$SG_EMULATED_HOST(0xffffffffffffffff, 0x2203, &(0x7f0000000040)) syz_open_dev$sg(&(0x7f0000000080), 0x7, 0x205) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) (async) sendmsg$AUDIT_DEL_RULE(r0, &(0x7f0000000640)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000600)={&(0x7f0000000180)={0x444, 0x3f4, 0x702, 0x70bd2d, 0x25dfdbfe, {0x0, 0x1, 0xd, [0x2, 0x8, 0xffff, 0xaf89, 0x7, 0x7, 0x53d, 0xa67, 0x60, 0x800, 0x50c, 0x20, 0x7f, 0xc7, 0x3, 0x800, 0x800, 0x60, 0x9, 0x0, 0x80000001, 0x1ff, 0x40, 0x1, 0x5, 0x500000, 0xa6, 0xffff, 0x5, 0x7, 0x2, 0x98bb, 0x9, 0xffff, 0x1, 0x6, 0x0, 0x10000, 0x60800000, 0xc9a, 0x8000, 0x7, 0xfffffffc, 0x6, 0x1, 0x0, 0x6b4a68ba, 0x10000, 0xfffffffa, 0x9, 0x7, 0xfffffffd, 0x1000, 0x1, 0x2, 0x2, 0xfffff5a9, 0xb33, 0x6, 0x7, 0x7f, 0x7, 0x40, 0x4], [0x2, 0x326, 0x6, 0x0, 0x9, 0x1, 0x7, 0x8, 0xfffffff8, 0x6, 0x10001, 0x8000, 0xddef, 0x6, 0x101, 0x4, 0x0, 0xfff, 0x100, 0x5, 0x7, 0x6, 0x7fff, 0x4, 0x1f, 0x9f, 0x0, 0x5, 0x29eabe6f, 0x9, 0x5, 0x6, 0x4, 0x970, 0x4, 0xfa22, 0x1000, 0x7fff, 0x16c0, 0x1, 0x400, 0x0, 0x0, 0x363b, 0x80000000, 0x2, 0x8a9, 0xfffffffb, 0x5, 0x5, 0x0, 0x5, 0x9, 0x5, 0x15, 0x1, 0x200, 0xcd, 0x5, 0x2, 0x7, 0x1, 0x101, 0x9], [0x85, 0x0, 0x400, 0x7, 0x3, 0x10001, 0x3, 0x1, 0x6, 0x401, 0x28e, 0x1000, 0x9, 0x3, 0x4de6, 0xbee, 0x1, 0x2, 0xf5, 0x81, 0xce, 0x2, 0x2, 0x3f, 0xbb, 0xffffffff, 0x3f, 0x77ff, 0x8, 0x5ace, 0x800, 0x9, 0x3, 0x27, 0x8, 0x9, 0x0, 0xd92, 0x9, 0x3, 0x9, 0x8, 0x200, 0x1, 0x6, 0xf82a64f, 0xfffffffd, 0x8000, 0x7, 0x5, 0x400, 0x1, 0x200, 0x0, 0x3, 0x1, 0x4, 0x9, 0x10001, 0x4, 0x40, 0x6, 0x3, 0x2f], [0x3, 0x2, 0x899d, 0xfe, 0x7f, 0xffffffff, 0x0, 0xc6, 0x2, 0xfffff7bf, 0xfffffffa, 0x8, 0x3, 0x3, 0x4e43, 0x1ff, 0x81, 0x0, 0x3f, 0x80000000, 0x8, 0x101, 0x8, 0x8000, 0x0, 0x4, 0x8, 0x1, 0x4, 0x800, 0x9, 0x1, 0x13d5, 0x5, 0x1000, 0x8, 0x2, 0xe0, 0x9, 0x1, 0x80000001, 0x1, 0x10000, 0x86e, 0xffffffff, 0x5, 0x8, 0x8, 0x101, 0x5, 0x1, 0x5, 0x8001, 0xa1, 0x1, 0x10001, 0xf76, 0x400, 0x2, 0x6, 0xa00b, 0x2, 0x3f, 0x100], 0x22, ['.-+^\xa9\xe6%.:$})&]\x00', '\x00', ',::],!\x00', '/dev/hwrng\x00']}, ["", "", ""]}, 0x444}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) ioctl$SG_GET_RESERVED_SIZE(r0, 0x2272, &(0x7f0000000100)) (async, rerun: 32) openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) (async, rerun: 32) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) (async) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) 20:27:38 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000380), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f00000000000000"]) 20:27:38 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0x1, 0xc}, 0x0) 20:27:38 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5387) 20:27:38 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0x1, 0xd}, 0x0) 20:27:39 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x100) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) sendmsg$key(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)={0x2, 0xc, 0x7, 0x9, 0x29, 0x0, 0x70bd2b, 0x25dfdbfe, [@sadb_x_nat_t_port={0x1, 0x16, 0x4e22}, @sadb_address={0x5, 0x6, 0x6c, 0x20, 0x0, @in6={0xa, 0x4e21, 0x5, @mcast2, 0x6}}, @sadb_x_policy={0x8, 0x12, 0x0, 0x2, 0x0, 0x0, 0x1, {0x6, 0x6c, 0x5, 0x0, 0x0, 0x0, 0x0, @in6=@rand_addr=' \x01\x00', @in6=@dev={0xfe, 0x80, '\x00', 0x28}}}, @sadb_x_sa2={0x2, 0x13, 0x4, 0x0, 0x0, 0x70bd25, 0x34ff}, @sadb_x_sec_ctx={0x10, 0x18, 0x7, 0x0, 0x78, "720e8a3759379406e0a796cc8a00431ae54c2688df54948698a2484f5e8d3bf47448914d13559390b77d9e6edf0d4200453fb79eb5a1fa3be3d26546757ec285675a40c50a30ab2a74274b9cf69dbb902789ce66ed0fa80c9e2acf40f74424eb52dca1101b429467df6766226ec807750787019f3b7b8eb5"}, @sadb_address={0x5, 0x6, 0x3c, 0xa0, 0x0, @in6={0xa, 0x4e23, 0x400, @mcast1, 0x5}}, @sadb_spirange={0x2, 0x10, 0x4d5, 0x4d2}]}, 0x148}}, 0x4084) 20:27:39 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0x1, 0xe}, 0x0) 20:27:39 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5393) 20:27:39 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5387) 20:27:39 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0x1, 0xf}, 0x0) [ 2151.069068][ T2795] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO 20:27:39 executing program 3: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_MPATH(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, r1, 0x302, 0x70bd28, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0xb21, 0x2a}}}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000800}, 0x1) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r0, 0x0, 0x0) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) sendmsg$NL80211_CMD_NEW_MPATH(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, r1, 0x302, 0x70bd28, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0xb21, 0x2a}}}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000800}, 0x1) (async) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) 20:27:39 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0x1, 0x10}, 0x0) 20:27:39 executing program 5: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SG_EMULATED_HOST(0xffffffffffffffff, 0x2203, &(0x7f0000000040)) (async) syz_open_dev$sg(&(0x7f0000000080), 0x7, 0x205) (async, rerun: 64) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (rerun: 64) write$vga_arbiter(r0, 0x0, 0x0) sendmsg$AUDIT_DEL_RULE(r0, &(0x7f0000000640)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000600)={&(0x7f0000000180)={0x444, 0x3f4, 0x702, 0x70bd2d, 0x25dfdbfe, {0x0, 0x1, 0xd, [0x2, 0x8, 0xffff, 0xaf89, 0x7, 0x7, 0x53d, 0xa67, 0x60, 0x800, 0x50c, 0x20, 0x7f, 0xc7, 0x3, 0x800, 0x800, 0x60, 0x9, 0x0, 0x80000001, 0x1ff, 0x40, 0x1, 0x5, 0x500000, 0xa6, 0xffff, 0x5, 0x7, 0x2, 0x98bb, 0x9, 0xffff, 0x1, 0x6, 0x0, 0x10000, 0x60800000, 0xc9a, 0x8000, 0x7, 0xfffffffc, 0x6, 0x1, 0x0, 0x6b4a68ba, 0x10000, 0xfffffffa, 0x9, 0x7, 0xfffffffd, 0x1000, 0x1, 0x2, 0x2, 0xfffff5a9, 0xb33, 0x6, 0x7, 0x7f, 0x7, 0x40, 0x4], [0x2, 0x326, 0x6, 0x0, 0x9, 0x1, 0x7, 0x8, 0xfffffff8, 0x6, 0x10001, 0x8000, 0xddef, 0x6, 0x101, 0x4, 0x0, 0xfff, 0x100, 0x5, 0x7, 0x6, 0x7fff, 0x4, 0x1f, 0x9f, 0x0, 0x5, 0x29eabe6f, 0x9, 0x5, 0x6, 0x4, 0x970, 0x4, 0xfa22, 0x1000, 0x7fff, 0x16c0, 0x1, 0x400, 0x0, 0x0, 0x363b, 0x80000000, 0x2, 0x8a9, 0xfffffffb, 0x5, 0x5, 0x0, 0x5, 0x9, 0x5, 0x15, 0x1, 0x200, 0xcd, 0x5, 0x2, 0x7, 0x1, 0x101, 0x9], [0x85, 0x0, 0x400, 0x7, 0x3, 0x10001, 0x3, 0x1, 0x6, 0x401, 0x28e, 0x1000, 0x9, 0x3, 0x4de6, 0xbee, 0x1, 0x2, 0xf5, 0x81, 0xce, 0x2, 0x2, 0x3f, 0xbb, 0xffffffff, 0x3f, 0x77ff, 0x8, 0x5ace, 0x800, 0x9, 0x3, 0x27, 0x8, 0x9, 0x0, 0xd92, 0x9, 0x3, 0x9, 0x8, 0x200, 0x1, 0x6, 0xf82a64f, 0xfffffffd, 0x8000, 0x7, 0x5, 0x400, 0x1, 0x200, 0x0, 0x3, 0x1, 0x4, 0x9, 0x10001, 0x4, 0x40, 0x6, 0x3, 0x2f], [0x3, 0x2, 0x899d, 0xfe, 0x7f, 0xffffffff, 0x0, 0xc6, 0x2, 0xfffff7bf, 0xfffffffa, 0x8, 0x3, 0x3, 0x4e43, 0x1ff, 0x81, 0x0, 0x3f, 0x80000000, 0x8, 0x101, 0x8, 0x8000, 0x0, 0x4, 0x8, 0x1, 0x4, 0x800, 0x9, 0x1, 0x13d5, 0x5, 0x1000, 0x8, 0x2, 0xe0, 0x9, 0x1, 0x80000001, 0x1, 0x10000, 0x86e, 0xffffffff, 0x5, 0x8, 0x8, 0x101, 0x5, 0x1, 0x5, 0x8001, 0xa1, 0x1, 0x10001, 0xf76, 0x400, 0x2, 0x6, 0xa00b, 0x2, 0x3f, 0x100], 0x22, ['.-+^\xa9\xe6%.:$})&]\x00', '\x00', ',::],!\x00', '/dev/hwrng\x00']}, ["", "", ""]}, 0x444}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) ioctl$SG_GET_RESERVED_SIZE(r0, 0x2272, &(0x7f0000000100)) openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) 20:27:39 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0x1, 0x11}, 0x0) 20:27:39 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0x1, 0x12}, 0x0) 20:27:39 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x100) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) sendmsg$key(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)={0x2, 0xc, 0x7, 0x9, 0x29, 0x0, 0x70bd2b, 0x25dfdbfe, [@sadb_x_nat_t_port={0x1, 0x16, 0x4e22}, @sadb_address={0x5, 0x6, 0x6c, 0x20, 0x0, @in6={0xa, 0x4e21, 0x5, @mcast2, 0x6}}, @sadb_x_policy={0x8, 0x12, 0x0, 0x2, 0x0, 0x0, 0x1, {0x6, 0x6c, 0x5, 0x0, 0x0, 0x0, 0x0, @in6=@rand_addr=' \x01\x00', @in6=@dev={0xfe, 0x80, '\x00', 0x28}}}, @sadb_x_sa2={0x2, 0x13, 0x4, 0x0, 0x0, 0x70bd25, 0x34ff}, @sadb_x_sec_ctx={0x10, 0x18, 0x7, 0x0, 0x78, "720e8a3759379406e0a796cc8a00431ae54c2688df54948698a2484f5e8d3bf47448914d13559390b77d9e6edf0d4200453fb79eb5a1fa3be3d26546757ec285675a40c50a30ab2a74274b9cf69dbb902789ce66ed0fa80c9e2acf40f74424eb52dca1101b429467df6766226ec807750787019f3b7b8eb5"}, @sadb_address={0x5, 0x6, 0x3c, 0xa0, 0x0, @in6={0xa, 0x4e23, 0x400, @mcast1, 0x5}}, @sadb_spirange={0x2, 0x10, 0x4d5, 0x4d2}]}, 0x148}}, 0x4084) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x100) (async) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) (async) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) sendmsg$key(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)={0x2, 0xc, 0x7, 0x9, 0x29, 0x0, 0x70bd2b, 0x25dfdbfe, [@sadb_x_nat_t_port={0x1, 0x16, 0x4e22}, @sadb_address={0x5, 0x6, 0x6c, 0x20, 0x0, @in6={0xa, 0x4e21, 0x5, @mcast2, 0x6}}, @sadb_x_policy={0x8, 0x12, 0x0, 0x2, 0x0, 0x0, 0x1, {0x6, 0x6c, 0x5, 0x0, 0x0, 0x0, 0x0, @in6=@rand_addr=' \x01\x00', @in6=@dev={0xfe, 0x80, '\x00', 0x28}}}, @sadb_x_sa2={0x2, 0x13, 0x4, 0x0, 0x0, 0x70bd25, 0x34ff}, @sadb_x_sec_ctx={0x10, 0x18, 0x7, 0x0, 0x78, "720e8a3759379406e0a796cc8a00431ae54c2688df54948698a2484f5e8d3bf47448914d13559390b77d9e6edf0d4200453fb79eb5a1fa3be3d26546757ec285675a40c50a30ab2a74274b9cf69dbb902789ce66ed0fa80c9e2acf40f74424eb52dca1101b429467df6766226ec807750787019f3b7b8eb5"}, @sadb_address={0x5, 0x6, 0x3c, 0xa0, 0x0, @in6={0xa, 0x4e23, 0x400, @mcast1, 0x5}}, @sadb_spirange={0x2, 0x10, 0x4d5, 0x4d2}]}, 0x148}}, 0x4084) (async) 20:27:39 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0x1, 0x25}, 0x0) 20:27:39 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5319) 20:27:39 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x541b) 20:27:39 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0x1, 0x48}, 0x0) 20:27:39 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0x1, 0x4c}, 0x0) 20:27:39 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0x1, 0x60}, 0x0) 20:27:40 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040), 0xe00, 0x70902) syz_genetlink_get_family_id$gtp(&(0x7f0000000000), 0xffffffffffffffff) ioctl$SG_GET_COMMAND_Q(r0, 0x2270, &(0x7f0000000080)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) ioctl$SG_GET_KEEP_ORPHAN(r1, 0x2288, &(0x7f0000000140)) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SG_GET_KEEP_ORPHAN(r1, 0x2288, &(0x7f00000000c0)) 20:27:40 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0x1, 0x68}, 0x0) 20:27:40 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) 20:27:40 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x100) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) sendmsg$key(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)={0x2, 0xc, 0x7, 0x9, 0x29, 0x0, 0x70bd2b, 0x25dfdbfe, [@sadb_x_nat_t_port={0x1, 0x16, 0x4e22}, @sadb_address={0x5, 0x6, 0x6c, 0x20, 0x0, @in6={0xa, 0x4e21, 0x5, @mcast2, 0x6}}, @sadb_x_policy={0x8, 0x12, 0x0, 0x2, 0x0, 0x0, 0x1, {0x6, 0x6c, 0x5, 0x0, 0x0, 0x0, 0x0, @in6=@rand_addr=' \x01\x00', @in6=@dev={0xfe, 0x80, '\x00', 0x28}}}, @sadb_x_sa2={0x2, 0x13, 0x4, 0x0, 0x0, 0x70bd25, 0x34ff}, @sadb_x_sec_ctx={0x10, 0x18, 0x7, 0x0, 0x78, "720e8a3759379406e0a796cc8a00431ae54c2688df54948698a2484f5e8d3bf47448914d13559390b77d9e6edf0d4200453fb79eb5a1fa3be3d26546757ec285675a40c50a30ab2a74274b9cf69dbb902789ce66ed0fa80c9e2acf40f74424eb52dca1101b429467df6766226ec807750787019f3b7b8eb5"}, @sadb_address={0x5, 0x6, 0x3c, 0xa0, 0x0, @in6={0xa, 0x4e23, 0x400, @mcast1, 0x5}}, @sadb_spirange={0x2, 0x10, 0x4d5, 0x4d2}]}, 0x148}}, 0x4084) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x100) (async) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) (async) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) sendmsg$key(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)={0x2, 0xc, 0x7, 0x9, 0x29, 0x0, 0x70bd2b, 0x25dfdbfe, [@sadb_x_nat_t_port={0x1, 0x16, 0x4e22}, @sadb_address={0x5, 0x6, 0x6c, 0x20, 0x0, @in6={0xa, 0x4e21, 0x5, @mcast2, 0x6}}, @sadb_x_policy={0x8, 0x12, 0x0, 0x2, 0x0, 0x0, 0x1, {0x6, 0x6c, 0x5, 0x0, 0x0, 0x0, 0x0, @in6=@rand_addr=' \x01\x00', @in6=@dev={0xfe, 0x80, '\x00', 0x28}}}, @sadb_x_sa2={0x2, 0x13, 0x4, 0x0, 0x0, 0x70bd25, 0x34ff}, @sadb_x_sec_ctx={0x10, 0x18, 0x7, 0x0, 0x78, "720e8a3759379406e0a796cc8a00431ae54c2688df54948698a2484f5e8d3bf47448914d13559390b77d9e6edf0d4200453fb79eb5a1fa3be3d26546757ec285675a40c50a30ab2a74274b9cf69dbb902789ce66ed0fa80c9e2acf40f74424eb52dca1101b429467df6766226ec807750787019f3b7b8eb5"}, @sadb_address={0x5, 0x6, 0x3c, 0xa0, 0x0, @in6={0xa, 0x4e23, 0x400, @mcast1, 0x5}}, @sadb_spirange={0x2, 0x10, 0x4d5, 0x4d2}]}, 0x148}}, 0x4084) (async) 20:27:40 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5319) 20:27:40 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040), 0xe00, 0x70902) syz_genetlink_get_family_id$gtp(&(0x7f0000000000), 0xffffffffffffffff) ioctl$SG_GET_COMMAND_Q(r0, 0x2270, &(0x7f0000000080)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) ioctl$SG_GET_KEEP_ORPHAN(r1, 0x2288, &(0x7f0000000140)) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SG_GET_KEEP_ORPHAN(r1, 0x2288, &(0x7f00000000c0)) syz_open_dev$sg(&(0x7f0000000040), 0xe00, 0x70902) (async) syz_genetlink_get_family_id$gtp(&(0x7f0000000000), 0xffffffffffffffff) (async) ioctl$SG_GET_COMMAND_Q(r0, 0x2270, &(0x7f0000000080)) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) (async) ioctl$SG_GET_KEEP_ORPHAN(r1, 0x2288, &(0x7f0000000140)) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$vga_arbiter(r2, 0x0, 0x0) (async) ioctl$SG_GET_KEEP_ORPHAN(r1, 0x2288, &(0x7f00000000c0)) (async) 20:27:40 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5421) 20:27:40 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0x1, 0x6c}, 0x0) 20:27:40 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) (async) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) (async) 20:27:40 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040), 0xe00, 0x70902) (async) syz_genetlink_get_family_id$gtp(&(0x7f0000000000), 0xffffffffffffffff) ioctl$SG_GET_COMMAND_Q(r0, 0x2270, &(0x7f0000000080)) (async) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) ioctl$SG_GET_KEEP_ORPHAN(r1, 0x2288, &(0x7f0000000140)) (async) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r2, 0x0, 0x0) ioctl$SG_GET_KEEP_ORPHAN(r1, 0x2288, &(0x7f00000000c0)) 20:27:40 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0x1, 0x74}, 0x0) 20:27:40 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) syz_open_dev$sg(&(0x7f0000000040), 0xec, 0x4000) r0 = syz_open_dev$sg(&(0x7f0000000080), 0x81, 0x400) syz_open_dev$sg(&(0x7f0000000100), 0xa6, 0x24000) syz_open_dev$sg(&(0x7f0000000180), 0x6, 0x22000) r1 = bpf$ITER_CREATE(0x21, &(0x7f00000001c0), 0x8) ioctl$SG_GET_COMMAND_Q(r1, 0x2270, &(0x7f0000000140)) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f00000000c0)) 20:27:40 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0x1, 0x7a}, 0x0) 20:27:40 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0x1, 0x300}, 0x0) 20:27:40 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0x1, 0x500}, 0x0) 20:27:41 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x6, 0xc2) 20:27:41 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0x1, 0x600}, 0x0) 20:27:41 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5450) 20:27:41 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5319) 20:27:41 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) syz_open_dev$sg(&(0x7f0000000040), 0xec, 0x4000) r0 = syz_open_dev$sg(&(0x7f0000000080), 0x81, 0x400) syz_open_dev$sg(&(0x7f0000000100), 0xa6, 0x24000) syz_open_dev$sg(&(0x7f0000000180), 0x6, 0x22000) r1 = bpf$ITER_CREATE(0x21, &(0x7f00000001c0), 0x8) ioctl$SG_GET_COMMAND_Q(r1, 0x2270, &(0x7f0000000140)) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f00000000c0)) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) syz_open_dev$sg(&(0x7f0000000040), 0xec, 0x4000) (async) syz_open_dev$sg(&(0x7f0000000080), 0x81, 0x400) (async) syz_open_dev$sg(&(0x7f0000000100), 0xa6, 0x24000) (async) syz_open_dev$sg(&(0x7f0000000180), 0x6, 0x22000) (async) bpf$ITER_CREATE(0x21, &(0x7f00000001c0), 0x8) (async) ioctl$SG_GET_COMMAND_Q(r1, 0x2270, &(0x7f0000000140)) (async) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f00000000c0)) (async) 20:27:41 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) (async) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) (async) 20:27:41 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x6, 0xc2) 20:27:41 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0x1, 0x700}, 0x0) 20:27:41 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x6, 0xc2) 20:27:41 executing program 0: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5319) 20:27:41 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) syz_open_dev$sg(&(0x7f0000000040), 0xec, 0x4000) (async, rerun: 32) r0 = syz_open_dev$sg(&(0x7f0000000080), 0x81, 0x400) (async, rerun: 32) syz_open_dev$sg(&(0x7f0000000100), 0xa6, 0x24000) syz_open_dev$sg(&(0x7f0000000180), 0x6, 0x22000) (async) r1 = bpf$ITER_CREATE(0x21, &(0x7f00000001c0), 0x8) ioctl$SG_GET_COMMAND_Q(r1, 0x2270, &(0x7f0000000140)) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f00000000c0)) 20:27:41 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5451) [ 2153.649259][ T2912] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 20:27:41 executing program 2: syz_genetlink_get_family_id$tipc(&(0x7f0000000000), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan0\x00'}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_TX_POWER(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x100, 0x70bd2a, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x4c}, 0x1, 0x0, 0x0, 0x840}, 0x4044800) 20:27:41 executing program 0: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5319) 20:27:41 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0x1, 0x900}, 0x0) 20:27:41 executing program 2: syz_genetlink_get_family_id$tipc(&(0x7f0000000000), 0xffffffffffffffff) (async) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan0\x00'}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_TX_POWER(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x100, 0x70bd2a, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x4c}, 0x1, 0x0, 0x0, 0x840}, 0x4044800) 20:27:41 executing program 0: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5319) [ 2153.700500][ T2931] __nla_validate_parse: 28 callbacks suppressed [ 2153.700515][ T2931] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2153.735828][ T2945] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:42 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x800000000000008, 0x230081) ioctl$PTP_ENABLE_PPS(0xffffffffffffffff, 0x40043d04, 0x1) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) 20:27:42 executing program 2: syz_genetlink_get_family_id$tipc(&(0x7f0000000000), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan0\x00'}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_TX_POWER(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x100, 0x70bd2a, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x4c}, 0x1, 0x0, 0x0, 0x840}, 0x4044800) syz_genetlink_get_family_id$tipc(&(0x7f0000000000), 0xffffffffffffffff) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan0\x00'}) (async) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan4\x00'}) (async) sendmsg$NL802154_CMD_SET_TX_POWER(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x100, 0x70bd2a, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x4c}, 0x1, 0x0, 0x0, 0x840}, 0x4044800) (async) 20:27:42 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0x1, 0xa00}, 0x0) 20:27:42 executing program 0: r0 = syz_open_dev$sg(0x0, 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5319) 20:27:42 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x1000000000000000, 0x82) 20:27:42 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5452) 20:27:42 executing program 0: r0 = syz_open_dev$sg(0x0, 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5319) 20:27:42 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5460) 20:27:42 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x322fc100c069419e) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f0000000000)) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000080)=0x1) 20:27:42 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x800000000000008, 0x230081) ioctl$PTP_ENABLE_PPS(0xffffffffffffffff, 0x40043d04, 0x1) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) syz_open_dev$sg(&(0x7f0000000000), 0x800000000000008, 0x230081) (async) ioctl$PTP_ENABLE_PPS(0xffffffffffffffff, 0x40043d04, 0x1) (async) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) (async) 20:27:42 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x1000000000000000, 0x82) syz_open_dev$sg(&(0x7f0000000000), 0x1000000000000000, 0x82) (async) 20:27:42 executing program 0: r0 = syz_open_dev$sg(0x0, 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5319) 20:27:42 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0x1, 0xb00}, 0x0) [ 2154.512612][ T2958] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:42 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x322fc100c069419e) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f0000000000)) (async) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000080)=0x1) 20:27:42 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x40049409) 20:27:42 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x1000000000000000, 0x82) 20:27:42 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x800000000000008, 0x230081) ioctl$PTP_ENABLE_PPS(0xffffffffffffffff, 0x40043d04, 0x1) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) syz_open_dev$sg(&(0x7f0000000000), 0x800000000000008, 0x230081) (async) ioctl$PTP_ENABLE_PPS(0xffffffffffffffff, 0x40043d04, 0x1) (async) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) (async) 20:27:42 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0xfff7fffffffffffd, 0x82) 20:27:42 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5319) 20:27:42 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x4, 0x8000) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f0000000080)) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) 20:27:42 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x322fc100c069419e) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f0000000000)) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000080)=0x1) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x322fc100c069419e) (async) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f0000000000)) (async) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000080)=0x1) (async) 20:27:42 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x40086602) [ 2154.577632][ T2984] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:42 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0x1, 0xc00}, 0x0) 20:27:42 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5319) 20:27:42 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x2270, &(0x7f0000000080)) 20:27:42 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0xfff7fffffffffffd, 0x82) 20:27:42 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5319) 20:27:42 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x4, 0x8000) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f0000000080)) (async, rerun: 64) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) (rerun: 64) 20:27:42 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x40087602) 20:27:42 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0xfff7fffffffffffd, 0x82) 20:27:42 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x2270, &(0x7f0000000080)) 20:27:42 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x4, 0x8000) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f0000000080)) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) 20:27:42 executing program 0: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5319) 20:27:42 executing program 2: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) (async) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x2270, &(0x7f0000000080)) 20:27:42 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0x1, 0xd00}, 0x0) 20:27:42 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x401c5820) [ 2154.663854][ T3009] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 20:27:42 executing program 3: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) setsockopt$RXRPC_UPGRADEABLE_SERVICE(r0, 0x110, 0x5, &(0x7f0000000040)=[0x0, 0x1], 0x2) syz_open_dev$sg(&(0x7f0000000000), 0x800000, 0x64cc0) ioctl$EVIOCSABS3F(r0, 0x401845ff, &(0x7f0000000080)={0x0, 0x4, 0x2, 0x7ff, 0x7, 0xe2}) 20:27:42 executing program 3: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r0, 0x0, 0x0) (async) setsockopt$RXRPC_UPGRADEABLE_SERVICE(r0, 0x110, 0x5, &(0x7f0000000040)=[0x0, 0x1], 0x2) (async) syz_open_dev$sg(&(0x7f0000000000), 0x800000, 0x64cc0) (async) ioctl$EVIOCSABS3F(r0, 0x401845ff, &(0x7f0000000080)={0x0, 0x4, 0x2, 0x7ff, 0x7, 0xe2}) 20:27:42 executing program 0: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5319) 20:27:42 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x4020940d) 20:27:42 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$vga_arbiter(r1, 0x0, 0x0) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000040)) r2 = socket(0x27, 0x5, 0x2b5) syz_genetlink_get_family_id$gtp(&(0x7f00000001c0), r2) 20:27:42 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001"], 0x1c}, 0x1, 0xd26}, 0x0) 20:27:42 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) 20:27:42 executing program 0: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x82) ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5319) 20:27:42 executing program 3: r0 = openat$hw