000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000140)=0xc) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:11 executing program 4: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x6a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'crct10dif\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003340)=[{{0x0, 0x4000000000000, 0x0}}], 0x600, 0x0, 0x0) 10:36:11 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:36:11 executing program 3: syz_open_procfs$namespace(0x0, &(0x7f0000000140)='ns/cgroup\x00') setns(0xffffffffffffffff, 0x2000000) 10:36:11 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:11 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) 10:36:11 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000140)=0xc) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:12 executing program 3: r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000140)='ns/cgroup\x00') setns(r0, 0x0) 10:36:12 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:36:12 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:12 executing program 3: r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000140)='ns/cgroup\x00') setns(r0, 0x0) 10:36:12 executing program 4: 10:36:12 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) 10:36:12 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:36:12 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000140)=0xc) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:12 executing program 3: r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000140)='ns/cgroup\x00') setns(r0, 0x0) 10:36:13 executing program 4: 10:36:13 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:13 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) 10:36:13 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280), 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:36:13 executing program 4: 10:36:13 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000140)=0xc) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:13 executing program 3: 10:36:13 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:13 executing program 4: 10:36:13 executing program 3: 10:36:14 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280), 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:36:14 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00'}) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) 10:36:14 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000140)=0xc) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:14 executing program 4: 10:36:14 executing program 3: 10:36:14 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:14 executing program 4: 10:36:14 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280), 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:36:14 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000140)=0xc) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:14 executing program 3: 10:36:14 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00'}) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) 10:36:15 executing program 4: 10:36:15 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:15 executing program 3: 10:36:15 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:36:15 executing program 4: 10:36:15 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000140)=0xc) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:15 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00'}) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) 10:36:15 executing program 3: 10:36:15 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) write$P9_RWRITE(0xffffffffffffffff, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r4 = socket$inet6(0xa, 0x400000000001, 0x0) r5 = dup(r4) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r4) setsockopt$inet6_tcp_int(r5, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r6 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r5, r6, 0x0, 0x8000fffffffe) 10:36:15 executing program 4: 10:36:16 executing program 3: 10:36:16 executing program 4: 10:36:16 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:16 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) r1 = socket$kcm(0x29, 0x0, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) 10:36:16 executing program 4: 10:36:17 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:36:17 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) write$P9_RWRITE(0xffffffffffffffff, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r4 = socket$inet6(0xa, 0x400000000001, 0x0) r5 = dup(r4) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r4) setsockopt$inet6_tcp_int(r5, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r6 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r5, r6, 0x0, 0x8000fffffffe) 10:36:17 executing program 3: 10:36:17 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) r1 = socket$kcm(0x29, 0x0, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) 10:36:17 executing program 4: 10:36:17 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:17 executing program 4: 10:36:17 executing program 3: 10:36:17 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) write$P9_RWRITE(0xffffffffffffffff, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r4 = socket$inet6(0xa, 0x400000000001, 0x0) r5 = dup(r4) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r4) setsockopt$inet6_tcp_int(r5, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r6 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r5, r6, 0x0, 0x8000fffffffe) 10:36:17 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) r1 = socket$kcm(0x29, 0x0, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) 10:36:17 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:17 executing program 3: 10:36:18 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:36:18 executing program 4: 10:36:18 executing program 3: 10:36:18 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:18 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) r4 = dup(0xffffffffffffffff) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:36:18 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0x2b, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) 10:36:18 executing program 3: 10:36:18 executing program 4: [ 478.395991][T20078] device nr0 entered promiscuous mode 10:36:19 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) r4 = dup(0xffffffffffffffff) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:36:19 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:19 executing program 4: 10:36:19 executing program 3: 10:36:20 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:36:20 executing program 4: 10:36:20 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0x2b, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) 10:36:20 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:20 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) r4 = dup(0xffffffffffffffff) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:36:20 executing program 3: 10:36:20 executing program 4: 10:36:20 executing program 3: 10:36:20 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) msgget$private(0x0, 0x204) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) [ 480.223314][T20215] device nr0 entered promiscuous mode 10:36:20 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:20 executing program 4: 10:36:20 executing program 3: 10:36:21 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:36:21 executing program 4: 10:36:22 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) msgget$private(0x0, 0x204) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:36:22 executing program 3: 10:36:22 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(0xffffffffffffffff, r7, 0x0, 0x8000fffffffe) 10:36:22 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0x2b, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) 10:36:22 executing program 4: 10:36:22 executing program 3: 10:36:22 executing program 4: 10:36:22 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(0xffffffffffffffff, r7, 0x0, 0x8000fffffffe) 10:36:22 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) msgget$private(0x0, 0x204) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:36:22 executing program 3: [ 482.072329][T20417] device nr0 entered promiscuous mode 10:36:23 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:36:23 executing program 4: 10:36:23 executing program 3: 10:36:23 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) msgctl$IPC_STAT(0x0, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:36:23 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(0xffffffffffffffff, r7, 0x0, 0x8000fffffffe) 10:36:24 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) r1 = socket$kcm(0x29, 0x2, 0x0) socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) 10:36:24 executing program 3: 10:36:24 executing program 4: 10:36:24 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = dup(0xffffffffffffffff) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:36:24 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) msgctl$IPC_STAT(0x0, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:36:24 executing program 3: 10:36:24 executing program 4: [ 483.966413][T20599] device nr0 entered promiscuous mode 10:36:25 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = fcntl$dupfd(0xffffffffffffffff, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r3 = getpid() rt_tgsigqueueinfo(r3, r3, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r3, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:36:25 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = dup(0xffffffffffffffff) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:36:25 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) msgctl$IPC_STAT(0x0, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:36:25 executing program 3: 10:36:25 executing program 4: 10:36:25 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) r1 = socket$kcm(0x29, 0x2, 0x0) socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) 10:36:25 executing program 4: 10:36:25 executing program 3: 10:36:25 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = dup(0xffffffffffffffff) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:36:25 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r2, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(0xffffffffffffffff, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:36:26 executing program 3: 10:36:26 executing program 4: [ 485.647166][T20709] device nr0 entered promiscuous mode 10:36:27 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = fcntl$dupfd(0xffffffffffffffff, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r3 = getpid() rt_tgsigqueueinfo(r3, r3, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r3, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:36:27 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:27 executing program 4: 10:36:27 executing program 3: 10:36:27 executing program 3: 10:36:27 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) r1 = socket$kcm(0x29, 0x2, 0x0) socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) 10:36:27 executing program 4: 10:36:27 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) [ 487.144917][T20760] device nr0 entered promiscuous mode 10:36:27 executing program 3: 10:36:28 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r2, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(0xffffffffffffffff, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:36:28 executing program 4: 10:36:28 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:28 executing program 3: 10:36:28 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = fcntl$dupfd(0xffffffffffffffff, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r3 = getpid() rt_tgsigqueueinfo(r3, r3, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r3, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 488.314781][ T27] audit: type=1800 audit(1576060588.848:68): pid=20694 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed comm="syz-executor.2" name="bus" dev="sda1" ino=17707 res=0 10:36:29 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) 10:36:29 executing program 4: 10:36:29 executing program 3: 10:36:29 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) [ 488.912481][T20922] device nr0 entered promiscuous mode 10:36:29 executing program 3: 10:36:29 executing program 4: 10:36:29 executing program 4: 10:36:31 executing program 3: 10:36:31 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:31 executing program 4: 10:36:31 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, 0xffffffffffffffff) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:36:31 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r2, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(0xffffffffffffffff, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:36:31 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) 10:36:31 executing program 4: 10:36:31 executing program 3: [ 491.238924][T21014] device nr0 entered promiscuous mode 10:36:31 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:32 executing program 4: 10:36:32 executing program 3: 10:36:32 executing program 4: 10:36:32 executing program 3: getpid() write(0xffffffffffffffff, 0x0, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x0, 0x1}, 0x0) accept(0xffffffffffffffff, &(0x7f0000000100)=@pppoe={0x18, 0x0, {0x0, @dev}}, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'eql\x00\x00\x04\x00\x00\x00\x03\x00\x00\x00\xf2\a\x00'}) creat(&(0x7f0000000100)='./bus\x00', 0x0) io_setup(0x0, 0x0) io_submit(0x0, 0x0, 0x0) io_submit(0x0, 0x20000000000000dd, &(0x7f00000006c0)) io_submit(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) mount$fuse(0x0, 0x0, &(0x7f0000000940)='fuse\x00', 0x0, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000940)='fuse\x00', 0x0, &(0x7f0000000140)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8b28, 0x0) open(0x0, 0x0, 0x0) 10:36:32 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) write$P9_RWRITE(0xffffffffffffffff, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r4 = socket$inet6(0xa, 0x400000000001, 0x0) r5 = dup(r4) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r4) setsockopt$inet6_tcp_int(r5, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r6 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r5, r6, 0x0, 0x8000fffffffe) 10:36:32 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x6}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, 0xffffffffffffffff) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {0x0}], 0x2) 10:36:33 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, 0xffffffffffffffff) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:36:34 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) memfd_create(0x0, 0x0) r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x2000002) read$eventfd(r0, 0x0, 0x0) r1 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r2 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r2, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:36:34 executing program 4: 10:36:34 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) write$P9_RWRITE(0xffffffffffffffff, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r4 = socket$inet6(0xa, 0x400000000001, 0x0) r5 = dup(r4) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r4) setsockopt$inet6_tcp_int(r5, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r6 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r5, r6, 0x0, 0x8000fffffffe) 10:36:34 executing program 3: 10:36:34 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) 10:36:34 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, 0xffffffffffffffff) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:36:34 executing program 4: r0 = msgget$private(0x0, 0x0) msgsnd(r0, &(0x7f0000000000)={0x2}, 0x8, 0x0) msgctl$IPC_RMID(r0, 0x0) 10:36:34 executing program 3: r0 = msgget$private(0x0, 0x0) msgsnd(r0, &(0x7f0000000000)={0x2}, 0x8, 0x0) [ 494.399894][T21365] device nr0 entered promiscuous mode 10:36:35 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) write$P9_RWRITE(0xffffffffffffffff, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r4 = socket$inet6(0xa, 0x400000000001, 0x0) r5 = dup(r4) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r4) setsockopt$inet6_tcp_int(r5, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r6 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r5, r6, 0x0, 0x8000fffffffe) 10:36:35 executing program 4: r0 = msgget$private(0x0, 0x0) msgsnd(r0, &(0x7f0000000000)={0x2}, 0x8, 0x0) msgctl$IPC_RMID(r0, 0x0) 10:36:35 executing program 3: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x2ca}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0x2f9, 0x300, &(0x7f0000000040)="b90103000000f000009e40f008001fffffe100004000632177fbac141428e9a33fa1be3e7d2a182fff", 0x0, 0x104, 0x6000000000000000}, 0x28) 10:36:35 executing program 4: perf_event_open(&(0x7f0000000e00)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000500)=ANY=[@ANYBLOB="b702000014000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000e3a333a0daf2f73451c0e17a606fec68cb7d18ad181867514fe60077d4dd90123d27e7cf43548ee85857ad4a77cb56e07dfbdfd4e70ebec677d6ac14c2c794f72cbf5fe31789e70233bfd8115efd90c8c48258f8dbe82e16cf0000000000000000000000000000000000000000000000000000790ae2fd45d54b107c8c247f195e32f17799d6707432ff48bc085763314166443ce72c74f3db890e1ff15a10d91f27e9a232fe2238fff867ba8fd41b29caad2a986e0e244bd117252e47ffda1a869db7e632df4de8572344b419c45c2170fe873692d8255170c16822bdffd3135480dae93c7eafe41389aa3f8b6c60abd8a13c33bdef00000000d8fd8c6e62d0967ab7e43686b4d1e03e326beea7905ef7de375ef8bc8143df20d13c37db2699f1210fab7071cc3094078a044777aab9d86cf50afefd7b72a0950d389bc9cb43aa607b7269561dd50b22bd2491331818a10f2ac8c3249582a20d4e04fd1ab7883f656b84137d5f7a6edba86a7b9a4c2f3b3a8abf93b280ea53ce01dcc2d30f4310e8281b0cdc017f9759060ea88a2f6597e966a85c9a74ca196700218f9197e7a5513c13e79d46bb4b84c16fd56ee450e411d75ab7613b644ba7580b2a0942394ed1737517eed1c892422f54d5a2e1cf1a60fe2dcc1a465aa8"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xff0b}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000140)={r0, 0x1800000000000060, 0xe, 0x0, &(0x7f0000000100)="0000003f0000007e5bc5795e6558", 0x0, 0x100, 0xf2ffffff, 0x0, 0x0, 0x0, 0x0}, 0x40) 10:36:36 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) memfd_create(0x0, 0x0) r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x2000002) read$eventfd(r0, 0x0, 0x0) r1 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r2 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r2, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:36:36 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) r4 = dup(0xffffffffffffffff) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:36:36 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:36:36 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:36:37 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(0xffffffffffffffff, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) 10:36:37 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) memfd_create(0x0, 0x0) r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x2000002) read$eventfd(r0, 0x0, 0x0) r1 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r2 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r2, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:36:37 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) r4 = dup(0xffffffffffffffff) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:36:37 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r3 = getpid() rt_tgsigqueueinfo(r3, r3, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r3, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:36:37 executing program 4: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x1) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r4, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r4, &(0x7f0000000000)=[{0x5, 0x3, 0x0, 0x0, @tick, {}, {}, @connect}], 0xfcc8) 10:36:37 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:36:37 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) [ 496.977951][T21724] device nr0 entered promiscuous mode 10:36:37 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) r4 = dup(0xffffffffffffffff) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:36:37 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:36:38 executing program 4: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x1) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r4, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r4, &(0x7f0000000000)=[{0x5, 0x3, 0x0, 0x0, @tick, {}, {}, @connect}], 0xfcc8) 10:36:38 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) msgget$private(0x0, 0x204) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:36:38 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:39 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(0xffffffffffffffff, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) 10:36:39 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:36:39 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) msgget$private(0x0, 0x204) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:36:39 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:39 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r3 = getpid() rt_tgsigqueueinfo(r3, r3, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r3, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:36:39 executing program 4: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x1) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r4, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r4, &(0x7f0000000000)=[{0x5, 0x0, 0x0, 0x0, @tick, {}, {}, @connect}], 0xfcc8) 10:36:39 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) msgget$private(0x0, 0x204) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) [ 499.096995][T21869] device nr0 entered promiscuous mode 10:36:39 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r1, 0x0) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:36:39 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:40 executing program 4: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x1) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r4, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r4, &(0x7f0000000000)=[{0x5, 0x0, 0x0, 0x0, @tick, {}, {}, @connect}], 0xfcc8) 10:36:40 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) msgctl$IPC_STAT(0x0, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:36:40 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r1, 0x0) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:36:41 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(0xffffffffffffffff, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) 10:36:41 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:41 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r1, 0x0) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:36:41 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) msgctl$IPC_STAT(0x0, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:36:41 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r3 = getpid() rt_tgsigqueueinfo(r3, r3, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r3, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:36:41 executing program 4: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x1) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r4, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r4, &(0x7f0000000000)=[{0x5, 0x0, 0x0, 0x0, @tick, {}, {}, @connect}], 0xfcc8) 10:36:41 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:41 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) msgctl$IPC_STAT(0x0, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:36:41 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:36:42 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) 10:36:42 executing program 4: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x1) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r4, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r4, &(0x7f0000000000)=[{0x5, 0x0, 0x0, 0x0, @tick, {}, {}, @connect}], 0xfcc8) 10:36:42 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x2000002) read$eventfd(0xffffffffffffffff, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r1 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r2 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r2, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:36:42 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) [ 501.804278][T22223] device nr0 entered promiscuous mode 10:36:42 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r2, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(0xffffffffffffffff, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:36:43 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x2000002) read$eventfd(0xffffffffffffffff, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r1 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r2 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r2, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:36:43 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x2000002) read$eventfd(0xffffffffffffffff, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r1 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r2 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r2, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:36:43 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:36:43 executing program 4: mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6000, 0x1) clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000140)=@filename='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f00000000c0)='vfat\x00', 0x0, 0x0) 10:36:43 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) 10:36:43 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) [ 503.590728][T22254] device nr0 entered promiscuous mode 10:36:44 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x2000002) read$eventfd(r0, 0x0, 0x0) fallocate(0xffffffffffffffff, 0x800000000000003, 0xfa9, 0x0) r1 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r2 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r2, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:36:44 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, 0xffffffffffffffff) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) [ 503.762357][ T2608] blk_update_request: I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 503.783196][T22261] FAT-fs (loop9): unable to read boot sector [ 503.819460][ T2609] blk_update_request: I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 503.838718][T22256] FAT-fs (loop9): unable to read boot sector 10:36:44 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = fcntl$dupfd(r1, 0x0, r0) bind$bt_rfcomm(r2, &(0x7f0000000440)={0x1f, {0xffffffffffffffff, 0xffffffff, 0x2}}, 0xa) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_SIOCDELRT(r3, 0x890c, 0x0) 10:36:44 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, 0xffffffffffffffff) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:36:44 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x2000002) read$eventfd(r0, 0x0, 0x0) fallocate(0xffffffffffffffff, 0x800000000000003, 0xfa9, 0x0) r1 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r2 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r2, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) [ 505.166696][ T27] audit: type=1800 audit(1576060605.708:69): pid=22237 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed comm="syz-executor.5" name="bus" dev="sda1" ino=17281 res=0 10:36:45 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r2, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(0xffffffffffffffff, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:36:45 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, 0xffffffffffffffff) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:36:45 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = fcntl$dupfd(r1, 0x0, r0) bind$bt_rfcomm(r2, &(0x7f0000000440)={0x1f, {0xffffffffffffffff, 0xffffffff, 0x2}}, 0xa) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_SIOCDELRT(r3, 0x890c, 0x0) 10:36:45 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x2000002) read$eventfd(r0, 0x0, 0x0) fallocate(0xffffffffffffffff, 0x800000000000003, 0xfa9, 0x0) r1 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r2 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r2, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:36:45 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) 10:36:45 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 505.447761][T22395] device nr0 entered promiscuous mode 10:36:46 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6(0xa, 0x3, 0x100000001) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000380)={{{@in=@remote, @in6=@initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@empty, 0x0, 0x33}, 0x0, @in6=@rand_addr="6f3829d7da47d9bb345810ed11c63d35", 0x0, 0x0, 0x0, 0x6}}, 0xe8) connect$inet6(r2, &(0x7f0000000200)={0xa, 0x0, 0x0, @local, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x400000000000058, 0x0) 10:36:46 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, r1) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:36:46 executing program 2: r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:46 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, r1) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:36:46 executing program 2: r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:47 executing program 2: r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:48 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r2, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(0xffffffffffffffff, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:36:48 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:36:48 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, r1) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:36:48 executing program 4: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) fchdir(0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20004004, &(0x7f0000000040)={0xa, 0x20004e22, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000000)='tls\x00', 0xc498ead121f97dd6) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100)=@gcm_128={{0x303}, "d44eb8c7308ec7c4", "442065238929350ade91900b51fc9534", "6bdda720", "7ee51430da3f51b3"}, 0x28) sendto$inet6(r0, &(0x7f0000000080)="39a110", 0xffffffffffffffc1, 0x40, 0x0, 0xfffffffffffffe5b) socketpair(0x1e, 0x1, 0x0, 0x0) close(0xffffffffffffffff) ioctl$SIOCRSGCAUSE(0xffffffffffffffff, 0x89e0, &(0x7f0000000180)) 10:36:48 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) 10:36:48 executing program 2: syz_open_dev$sndtimer(0x0, 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) [ 508.208896][ C1] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 508.272354][T22540] device nr0 entered promiscuous mode 10:36:49 executing program 2: syz_open_dev$sndtimer(0x0, 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:49 executing program 3: r0 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:36:49 executing program 2: syz_open_dev$sndtimer(0x0, 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:49 executing program 3: r0 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) [ 509.130717][ C0] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 10:36:50 executing program 3: r0 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:36:50 executing program 4: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) fchdir(0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20004004, &(0x7f0000000040)={0xa, 0x20004e22, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000000)='tls\x00', 0xc498ead121f97dd6) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100)=@gcm_128={{0x303}, "d44eb8c7308ec7c4", "442065238929350ade91900b51fc9534", "6bdda720", "7ee51430da3f51b3"}, 0x28) sendto$inet6(r0, &(0x7f0000000080)="39a110", 0xffffffffffffffc1, 0x40, 0x0, 0xfffffffffffffe5b) socketpair(0x1e, 0x1, 0x0, 0x0) close(0xffffffffffffffff) ioctl$SIOCRSGCAUSE(0xffffffffffffffff, 0x89e0, &(0x7f0000000180)) [ 509.914384][ C1] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 10:36:51 executing program 3: r0 = syz_open_dev$sg(0x0, 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:36:51 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:51 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:36:51 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) 10:36:51 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) memfd_create(0x0, 0x0) r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x2000002) read$eventfd(r0, 0x0, 0x0) r1 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r2 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r2, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:36:51 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) [ 511.400821][T22686] device nr0 entered promiscuous mode 10:36:52 executing program 3: r0 = syz_open_dev$sg(0x0, 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:36:52 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:52 executing program 3: r0 = syz_open_dev$sg(0x0, 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:36:52 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:52 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) memfd_create(0x0, 0x0) r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x2000002) read$eventfd(r0, 0x0, 0x0) r1 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r2 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r2, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:36:53 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x0) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:36:53 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) memfd_create(0x0, 0x0) r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x2000002) read$eventfd(r0, 0x0, 0x0) r1 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r2 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r2, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:36:53 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:36:53 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x0) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:36:53 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) 10:36:53 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) [ 513.599928][T22893] device nr0 entered promiscuous mode 10:36:54 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:36:54 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x0) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:36:54 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:54 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:54 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:36:55 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) 10:36:55 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:36:55 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:55 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) [ 515.081724][T23070] device nr0 entered promiscuous mode 10:36:55 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:36:55 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:55 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x0) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:58 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:36:58 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:36:58 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:36:58 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:58 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x0) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:58 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) [ 517.726958][T23095] device nr0 entered promiscuous mode 10:36:58 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:36:58 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:58 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x0) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:58 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:36:59 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(0xffffffffffffffff, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:36:59 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:01 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:37:01 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:37:01 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(0xffffffffffffffff, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:01 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x2000002) read$eventfd(0xffffffffffffffff, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r1 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r2 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r2, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:37:01 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:37:01 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) [ 520.916482][T23238] device nr0 entered promiscuous mode 10:37:01 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:37:01 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x2000002) read$eventfd(0xffffffffffffffff, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r1 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r2 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r2, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:37:01 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(0xffffffffffffffff, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:02 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:37:02 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x2000002) read$eventfd(0xffffffffffffffff, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r1 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r2 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r2, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:37:02 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) memfd_create(0x0, 0x0) r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x2000002) read$eventfd(r0, 0x0, 0x0) fallocate(0xffffffffffffffff, 0x800000000000003, 0xfa9, 0x0) r1 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r2 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r2, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:37:04 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x9, r0, 0x0, 0x0) 10:37:04 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:37:04 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x2000002) read$eventfd(r0, 0x0, 0x0) fallocate(0xffffffffffffffff, 0x800000000000003, 0xfa9, 0x0) r1 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r2 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r2, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:37:04 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:37:04 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) memfd_create(0x0, 0x0) r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x2000002) read$eventfd(r0, 0x0, 0x0) fallocate(0xffffffffffffffff, 0x800000000000003, 0xfa9, 0x0) r1 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r2 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r2, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:37:04 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) [ 524.090872][T23396] device nr0 entered promiscuous mode 10:37:04 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) memfd_create(0x0, 0x0) r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x2000002) read$eventfd(r0, 0x0, 0x0) fallocate(0xffffffffffffffff, 0x800000000000003, 0xfa9, 0x0) r1 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r2 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r2, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:37:04 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:37:04 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x2000002) read$eventfd(r0, 0x0, 0x0) fallocate(0xffffffffffffffff, 0x800000000000003, 0xfa9, 0x0) r1 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r2 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r2, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:37:05 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:37:05 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x0, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:05 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x2000002) read$eventfd(r0, 0x0, 0x0) fallocate(0xffffffffffffffff, 0x800000000000003, 0xfa9, 0x0) r1 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r2 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r2, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:37:07 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x9, r0, 0x0, 0x0) 10:37:07 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:37:07 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x0, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:07 executing program 5: r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:07 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(0x0, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:37:07 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) [ 527.147945][T23619] device nr0 entered promiscuous mode 10:37:07 executing program 5: r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:07 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x0, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:07 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:37:08 executing program 5: r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:08 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0x0, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:08 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:37:10 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x9, r0, 0x0, 0x0) 10:37:10 executing program 5: syz_open_dev$sndtimer(0x0, 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:10 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:37:10 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0x0, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:10 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(0x0, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:37:10 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) [ 530.455466][T23768] device nr0 entered promiscuous mode 10:37:11 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:37:11 executing program 5: syz_open_dev$sndtimer(0x0, 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:11 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0x0, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:11 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:37:11 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(0x0, 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:11 executing program 5: syz_open_dev$sndtimer(0x0, 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:13 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:37:13 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:37:13 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:13 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(0x0, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:37:13 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) 10:37:13 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(0x0, 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) [ 533.589414][T24004] device nr0 entered promiscuous mode 10:37:14 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:14 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:37:14 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:14 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:37:15 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:37:15 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:17 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) 10:37:17 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(0x0, 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:17 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:37:17 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:17 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, 0x0, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:37:17 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) [ 536.849372][T24252] device nr0 entered promiscuous mode 10:37:17 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:37:17 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:17 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:37:18 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x0) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:18 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:37:18 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, 0x0, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:37:18 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) [ 538.727230][T24385] device nr0 entered promiscuous mode [ 539.609212][ T27] audit: type=1800 audit(1576060640.148:70): pid=24245 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed comm="syz-executor.2" name="bus" dev="sda1" ino=17939 res=0 10:37:20 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:37:20 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:37:20 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x0) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:20 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, 0x0, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:37:20 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) socket$kcm(0x29, 0x2, 0x0) r1 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) 10:37:20 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x0) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:20 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:37:20 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) socket$kcm(0x29, 0x2, 0x0) r1 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) 10:37:20 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x0) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:21 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:37:21 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) socket$kcm(0x29, 0x2, 0x0) r1 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) 10:37:21 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(0xffffffffffffffff, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:23 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:37:23 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x0) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:23 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:37:23 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, 0x0) write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) 10:37:23 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(0xffffffffffffffff, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:23 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x0, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:37:23 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:37:23 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, 0x0) write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) 10:37:24 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(0xffffffffffffffff, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:24 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x0) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:24 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:37:24 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, 0x0) write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) 10:37:26 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:37:26 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) memfd_create(0x0, 0x0) r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x2000002) read$eventfd(r0, 0x0, 0x0) fallocate(0xffffffffffffffff, 0x800000000000003, 0xfa9, 0x0) r1 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r2 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r2, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:37:26 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) msgget$private(0x0, 0x204) msgctl$IPC_STAT(0x0, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:37:26 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:37:26 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) 10:37:26 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x0, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 546.296169][T24879] device nr0 entered promiscuous mode 10:37:27 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:37:27 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) msgget$private(0x0, 0x204) msgctl$IPC_STAT(0x0, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:37:27 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) memfd_create(0x0, 0x0) r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x2000002) read$eventfd(r0, 0x0, 0x0) fallocate(0xffffffffffffffff, 0x800000000000003, 0xfa9, 0x0) r1 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r2 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r2, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:37:27 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:37:27 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) msgget$private(0x0, 0x204) msgctl$IPC_STAT(0x0, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:37:27 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) memfd_create(0x0, 0x0) r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x2000002) read$eventfd(r0, 0x0, 0x0) fallocate(0xffffffffffffffff, 0x800000000000003, 0xfa9, 0x0) r1 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r2 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r2, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:37:29 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:37:29 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x10, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:37:29 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:29 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x0, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:37:29 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x0, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:29 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) [ 549.584151][T25028] device nr0 entered promiscuous mode 10:37:30 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x10, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:37:30 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:30 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x0, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:30 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x10, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:37:30 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:30 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x0, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:33 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:37:33 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:37:33 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:33 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, 0x0) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:37:33 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x6}]}, 0x90ad) 10:37:33 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0x0, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) [ 552.571755][T25162] device nr0 entered promiscuous mode 10:37:33 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:37:33 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:37:33 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0x0, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:33 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:33 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:37:33 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:37:34 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:37:34 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:34 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0x0, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:34 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, r1) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:37:34 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, 0x0) r4 = dup(0xffffffffffffffff) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:37:34 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(0x0, 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:34 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, 0x0, 0x0) 10:37:34 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, 0x0) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:37:35 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, 0x0) r4 = dup(0xffffffffffffffff) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:37:35 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, r1) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) [ 554.595416][T25319] device nr0 entered promiscuous mode 10:37:35 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, r1) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:37:35 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, 0x0) r4 = dup(0xffffffffffffffff) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:37:37 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:37:37 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, 0xffffffffffffffff) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:37:37 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) r4 = dup(0xffffffffffffffff) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:37:37 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, 0x0) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:37:37 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, 0x0, 0x0) 10:37:37 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(0x0, 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) [ 556.900715][T25447] device nr0 entered promiscuous mode 10:37:37 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, 0xffffffffffffffff) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:37:37 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) r4 = dup(0xffffffffffffffff) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:37:38 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, 0xffffffffffffffff) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:37:38 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) r4 = dup(0xffffffffffffffff) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:37:38 executing program 3: syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r0 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:37:38 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(0xffffffffffffffff, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:40 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:37:40 executing program 3: syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r0 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) 10:37:40 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, 0x0, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:37:40 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, 0x0, 0x0) 10:37:40 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(0xffffffffffffffff, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:40 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(0x0, 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:40 executing program 3: syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r0 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0xffffffe5}], 0x2) [ 560.146120][T25588] device nr0 entered promiscuous mode 10:37:40 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(0xffffffffffffffff, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:41 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, 0x0, 0x0) 10:37:41 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:41 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, 0x0, 0x0) 10:37:41 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:43 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:37:43 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, 0x0, 0x0) 10:37:43 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:43 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, 0x0, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:37:43 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, &(0x7f00000000c0), 0x0) 10:37:43 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x0) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:43 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}], 0x1) [ 563.294485][T25728] device nr0 entered promiscuous mode 10:37:44 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x0) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:44 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:44 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}], 0x1) 10:37:44 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x0) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:44 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:46 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:37:46 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}], 0x1) 10:37:46 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) msgget$private(0x0, 0x204) msgctl$IPC_STAT(0x0, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:37:46 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:46 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, &(0x7f00000000c0), 0x0) 10:37:46 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, 0x0, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 566.539097][T25876] device nr0 entered promiscuous mode 10:37:47 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {0x0}], 0x2) 10:37:47 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:47 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) msgget$private(0x0, 0x204) msgctl$IPC_STAT(0x0, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:37:47 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {0x0}], 0x2) 10:37:47 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) msgget$private(0x0, 0x204) msgctl$IPC_STAT(0x0, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:37:47 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:50 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:37:50 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {0x0}], 0x2) 10:37:50 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:50 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:50 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x0, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:37:50 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc77a4e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507d0419c09fc1fe6c"}, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)=0xa7) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r0, &(0x7f00000000c0), 0x0) [ 569.665103][T26016] device nr0 entered promiscuous mode 10:37:50 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)}], 0x2) 10:37:50 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:50 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x0, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:50 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)}], 0x2) 10:37:50 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x0, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:50 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:53 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:37:53 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)}], 0x2) 10:37:53 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x0, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:53 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:53 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x0, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:37:53 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x3, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x5, 0xffffffd4, 0x0, 0x0, 0x10}}, &(0x7f0000000240)='GPL\x00', 0x1, 0x348, &(0x7f0000000280)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xffffffffffffff60}, 0x48) 10:37:53 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff77000000001004000000", 0x12}], 0x2) 10:37:53 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:53 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:53 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff77000000001004000000", 0x12}], 0x2) 10:37:54 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:54 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8916, 0x0) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8915, &(0x7f0000000140)={'lo:\x05\xe6\r\x00\x00\x85\x01\x00\x00\x00\x10\x03\x00', {0x2, 0x0, @empty}}) 10:37:56 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:37:56 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff77000000001004000000", 0x12}], 0x2) 10:37:56 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:56 executing program 1: getpid() r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8915, &(0x7f0000000140)={'lo:\x05\xe6\r\x00\x00\x85\x01\x00\x00\x00\x10\x03\x00', {0x2, 0x0, @empty}}) 10:37:56 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x0, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:37:56 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, 0x0) r4 = dup(0xffffffffffffffff) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:37:56 executing program 1: munmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000) mremap(&(0x7f0000ff0000/0x4000)=nil, 0x4000, 0x1000, 0x0, &(0x7f0000ffc000/0x1000)=nil) mremap(&(0x7f0000f33000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f0000fd3000/0x3000)=nil) madvise(&(0x7f0000fed000/0x13000)=nil, 0x13000, 0xca) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0x1000000000ca) 10:37:56 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4", 0x1b}], 0x2) 10:37:56 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x0, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:56 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, 0x0) r4 = dup(0xffffffffffffffff) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:37:57 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4", 0x1b}], 0x2) 10:37:57 executing program 1: open(&(0x7f0000000080)='./file0\x00', 0x2442, 0x0) mount(&(0x7f0000000040)=@filename='./file0\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x1001004, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000400)='./file0\x00', 0x0, 0x0, 0x0, 0x20, &(0x7f00000000c0)={[{@barrier_val={'barrier', 0x3d, 0x5c}}]}) [ 577.254438][T26429] EXT4-fs (sda1): re-mounted. Opts: barrier=0x000000000000005c, [ 577.381557][T26435] EXT4-fs (sda1): re-mounted. Opts: barrier=0x000000000000005c, 10:37:59 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:37:59 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, 0x0) r4 = dup(0xffffffffffffffff) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:37:59 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x0, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:37:59 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:37:59 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4", 0x1b}], 0x2) 10:37:59 executing program 1: open(&(0x7f0000000080)='./file0\x00', 0x2442, 0x0) mount(&(0x7f0000000040)=@filename='./file0\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x1001004, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000400)='./file0\x00', 0x0, 0x0, 0x0, 0x20, &(0x7f00000000c0)={[{@barrier_val={'barrier', 0x3d, 0x5c}}]}) 10:37:59 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a40000000000", 0x20}], 0x2) [ 579.382015][T26449] EXT4-fs (sda1): re-mounted. Opts: barrier=0x000000000000005c, 10:38:00 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) r4 = dup(0xffffffffffffffff) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:38:00 executing program 1: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) futex(&(0x7f000000cffc)=0x4, 0x80000000000b, 0x4, 0x0, &(0x7f0000048000), 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCOUTQ(r1, 0x5411, 0x0) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:38:00 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x0, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:00 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a40000000000", 0x20}], 0x2) 10:38:00 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) r4 = dup(0xffffffffffffffff) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:38:02 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') getdents64(0xffffffffffffffff, &(0x7f0000000400)=""/169, 0xa9) getdents64(0xffffffffffffffff, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:38:02 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(0xffffffffffffffff) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:02 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a40000000000", 0x20}], 0x2) 10:38:02 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) r4 = dup(0xffffffffffffffff) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:38:02 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:38:02 executing program 1: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) futex(&(0x7f000000cffc)=0x4, 0x80000000000b, 0x4, 0x0, &(0x7f0000048000), 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCOUTQ(r1, 0x5411, 0x0) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:38:03 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(0xffffffffffffffff, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:03 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a400000000000000", 0x22}], 0x2) 10:38:03 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(0xffffffffffffffff) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:03 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a400000000000000", 0x22}], 0x2) 10:38:03 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(0xffffffffffffffff, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:03 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(0xffffffffffffffff) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:06 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') getdents64(0xffffffffffffffff, &(0x7f0000000400)=""/169, 0xa9) getdents64(0xffffffffffffffff, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:38:06 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a400000000000000", 0x22}], 0x2) 10:38:06 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(0xffffffffffffffff, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:06 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:06 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:38:06 executing program 1: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) futex(&(0x7f000000cffc)=0x4, 0x80000000000b, 0x4, 0x0, &(0x7f0000048000), 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCOUTQ(r1, 0x5411, 0x0) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:38:06 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a40000000000000000", 0x23}], 0x2) 10:38:06 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:06 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:06 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a40000000000000000", 0x23}], 0x2) 10:38:06 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:06 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:09 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') getdents64(0xffffffffffffffff, &(0x7f0000000400)=""/169, 0xa9) getdents64(0xffffffffffffffff, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:38:09 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a40000000000000000", 0x23}], 0x2) 10:38:09 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:09 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:09 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={0x0}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:38:09 executing program 1: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) futex(&(0x7f000000cffc)=0x4, 0x80000000000b, 0x4, 0x0, &(0x7f0000048000), 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCOUTQ(r1, 0x5411, 0x0) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:38:09 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0x24}], 0x1) 10:38:09 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:09 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:09 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0x24}], 0x1) 10:38:10 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:10 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0x24}], 0x1) 10:38:12 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:38:12 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, &(0x7f0000000240)={0x0, 0x7000, 0x4}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:12 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0x24}], 0x2) 10:38:12 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x0, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:12 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={0x0}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:38:12 executing program 1: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) futex(&(0x7f000000cffc)=0x4, 0x80000000000b, 0x4, 0x0, &(0x7f0000048000), 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:38:12 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x0, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:12 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0x24}], 0x2) 10:38:12 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:13 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0x24}], 0x2) 10:38:13 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x0, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:13 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x0, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:15 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:38:15 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0x24}], 0x2) 10:38:15 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, 0x0, 0x0) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:15 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={0x0}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:38:15 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x0, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:15 executing program 1: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) futex(&(0x7f000000cffc)=0x4, 0x80000000000b, 0x4, 0x0, &(0x7f0000048000), 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) dup(r0) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:38:15 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0x24}], 0x2) 10:38:16 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, 0x0, 0x0) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:16 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x0, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:16 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0x24}], 0x2) 10:38:16 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, 0x0, 0x0) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:16 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee0796", 0x17}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0x24}], 0x2) 10:38:18 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:38:18 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(0xffffffffffffffff) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:18 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee0796", 0x17}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0x24}], 0x2) 10:38:18 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000), 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:18 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(0xffffffffffffffff, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:38:18 executing program 1: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) futex(&(0x7f000000cffc)=0x4, 0x80000000000b, 0x4, 0x0, &(0x7f0000048000), 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) dup(r0) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:38:18 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(0xffffffffffffffff, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:38:19 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee0796", 0x17}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0x24}], 0x2) 10:38:19 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(0xffffffffffffffff) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:19 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000), 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:19 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41b", 0x23}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0x24}], 0x2) 10:38:19 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(0xffffffffffffffff, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:38:21 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:38:21 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(0xffffffffffffffff) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:21 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000), 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:21 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, 0x0, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:38:21 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41b", 0x23}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0x24}], 0x2) 10:38:21 executing program 1: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) futex(&(0x7f000000cffc)=0x4, 0x80000000000b, 0x4, 0x0, &(0x7f0000048000), 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) dup(r0) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:38:22 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, 0x0, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:38:22 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41b", 0x23}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0x24}], 0x2) 10:38:22 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:22 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:38:22 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:22 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43", 0x29}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0x24}], 0x2) 10:38:23 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:38:23 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, 0x0, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:38:23 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:23 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:23 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43", 0x29}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0x24}], 0x2) 10:38:24 executing program 1: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) futex(&(0x7f000000cffc)=0x4, 0x80000000000b, 0x4, 0x0, &(0x7f0000048000), 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:38:24 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r0 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r0, &(0x7f0000000400)=""/169, 0xa9) getdents64(r0, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(0x0, 0x3c) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, 0x0, 0x0, 0x0) 10:38:24 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:24 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:38:24 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:24 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43", 0x29}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0x24}], 0x2) 10:38:24 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r0 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r0, &(0x7f0000000400)=""/169, 0xa9) getdents64(r0, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(0x0, 0x3c) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, 0x0, 0x0, 0x0) 10:38:24 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e4", 0x2c}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0x24}], 0x2) 10:38:24 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, 0x0, 0x0) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:24 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:38:24 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:24 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r0 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r0, &(0x7f0000000400)=""/169, 0xa9) getdents64(r0, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(0x0, 0x3c) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, 0x0, 0x0, 0x0) 10:38:25 executing program 1: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) futex(&(0x7f000000cffc)=0x4, 0x80000000000b, 0x4, 0x0, &(0x7f0000048000), 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:38:25 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e4", 0x2c}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0x24}], 0x2) 10:38:25 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:38:25 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, 0x0, 0x0) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:25 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:38:25 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:26 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e4", 0x2c}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0x24}], 0x2) 10:38:26 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:38:26 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, 0x0, 0x0) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:38:26 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, 0x0, 0x0) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:26 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:26 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e462", 0x2d}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0x24}], 0x2) 10:38:27 executing program 1: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) futex(&(0x7f000000cffc)=0x4, 0x80000000000b, 0x4, 0x0, &(0x7f0000048000), 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:38:27 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, 0x0, 0x0) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:38:27 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:38:27 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e462", 0x2d}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0x24}], 0x2) 10:38:27 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:27 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x0, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:27 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) r1 = perf_event_open(&(0x7f0000000040)={0x400000000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x22, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e462", 0x2d}, {&(0x7f0000000040)="53000000fcffffff770000000010040000009600000000000000a4000000000000000000", 0x24}], 0x2) 10:38:28 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:28 executing program 4: clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:38:28 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x0, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:28 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, 0x0, 0x0) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:38:28 executing program 4: clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) [ 607.827728][T27826] ptrace attach of "/root/syz-executor.4"[27820] was attempted by "/root/syz-executor.4"[27826] [ 608.242366][T27853] ptrace attach of "/root/syz-executor.4"[27852] was attempted by "/root/syz-executor.4"[27853] 10:38:29 executing program 1: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) futex(&(0x7f000000cffc)=0x4, 0x80000000000b, 0x4, 0x0, &(0x7f0000048000), 0x0) r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:38:29 executing program 3: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) futex(&(0x7f000000cffc)=0x4, 0x80000000000b, 0x4, 0x0, &(0x7f0000048000), 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCOUTQ(r1, 0x5411, 0x0) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:38:29 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:38:29 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:29 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x0, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:29 executing program 4: clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) [ 609.040651][T27870] ptrace attach of "/root/syz-executor.4"[27869] was attempted by "/root/syz-executor.4"[27870] 10:38:29 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:38:29 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, 0x0, 0x0) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:29 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:30 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, 0x0, 0x0) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:30 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:38:30 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:31 executing program 1: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) futex(&(0x7f000000cffc)=0x4, 0x80000000000b, 0x4, 0x0, &(0x7f0000048000), 0x0) r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:38:31 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, 0x0, 0x0) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:31 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:38:31 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:31 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:38:31 executing program 3: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) futex(&(0x7f000000cffc)=0x4, 0x80000000000b, 0x4, 0x0, &(0x7f0000048000), 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCOUTQ(r1, 0x5411, 0x0) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:38:32 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x0, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:32 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000), 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:32 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:38:32 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:38:32 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x0, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:32 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000), 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:33 executing program 1: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) futex(&(0x7f000000cffc)=0x4, 0x80000000000b, 0x4, 0x0, &(0x7f0000048000), 0x0) r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:38:33 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:38:33 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000), 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:33 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x0, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:33 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:38:33 executing program 3: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) futex(&(0x7f000000cffc)=0x4, 0x80000000000b, 0x4, 0x0, &(0x7f0000048000), 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCOUTQ(r1, 0x5411, 0x0) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:38:34 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:38:34 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, 0x0, 0x0) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:34 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:34 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, 0x0, 0x0) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:34 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:35 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, 0x0, 0x0) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:35 executing program 1: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:38:35 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:35 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:36 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:38:36 executing program 3: prctl$PR_SET_SECCOMP(0x16, 0x0, &(0x7f0000000000)={0x0, 0x0}) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$EVIOCGABS3F(0xffffffffffffffff, 0x8018457f, &(0x7f0000000440)=""/229) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x42, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89f0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000240)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) write$binfmt_elf64(r0, &(0x7f00000002c0)=ANY=[@ANYBLOB="6f68fde88b508405c8647cfc00b3dd647f450000000000000000fb00efd688ac784bd342f9ce92a06f9100000000004029588171101000720155fd36000900ff030100029ebd6ce1afd40e4ec6ed2fcf490794000000094baa1014256024ffff0000a1e1dc3aa003463851928c68c9ffe5000000"], 0x74) recvmmsg(r0, &(0x7f0000008880), 0x45b, 0x44000102, 0x0) getsockopt$IP6T_SO_GET_REVISION_MATCH(r0, 0x29, 0x44, &(0x7f00000001c0)={'ipvs\x00'}, &(0x7f00000003c0)=0x1e) setsockopt$inet6_MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, &(0x7f0000000340)={{0xa, 0x4e24, 0x100, @mcast1, 0x4}, {0xa, 0x0, 0xd1, @rand_addr="01698a1da41b9f6f95fb201598b43c81", 0x7ff}, 0x3ff, [0x0, 0x0, 0x2, 0x0, 0x1, 0x5a, 0x1]}, 0x5c) creat(&(0x7f0000000100)='./file0\x00', 0x0) getpid() 10:38:36 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, 0x0, 0x0) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:37 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:38:37 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:37 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, 0x0, 0x0) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:37 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) setreuid(0x0, 0x0) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae", 0x1}], 0x1) 10:38:37 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 616.828880][T28724] sg_write: process 5475 (syz-executor.3) changed security contexts after opening file descriptor, this is not allowed. 10:38:37 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:38 executing program 1: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:38:38 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, 0x0, 0x0) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:38 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) creat(&(0x7f00000002c0)='./bus\x00', 0x0) splice(r0, 0x0, r1, 0x0, 0x100000000, 0x0) 10:38:38 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:38 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:38 executing program 1: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:38:40 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:38:40 executing program 3: socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9}, 0x0) r0 = getpid() sched_setattr(r0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{0x0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) accept(0xffffffffffffffff, &(0x7f0000000100)=@pppoe={0x18, 0x0, {0x0, @dev}}, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'eql\x00\x00\x04\x00\x00\x00\x03\x00\x00\x00\xf2\a\x00', 0x2}) creat(0x0, 0x0) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r5, 0x400c6615, &(0x7f0000000200)) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r6 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000940)='fuse\x00', 0x0, &(0x7f0000000140)={{'fd', 0x3d, r6}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) 10:38:40 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:40 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:38:40 executing program 1: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:38:40 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:40 executing program 1: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:38:40 executing program 3: socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) socket$inet6(0xa, 0x2, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) write(r2, &(0x7f0000000340), 0x41395527) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) accept(0xffffffffffffffff, &(0x7f0000000100)=@pppoe={0x18, 0x0, {0x0, @dev}}, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'eql\x00\x00\x04\x00\x00\x00\x03\x00\x00\x00\xf2\a\x00', 0x2}) creat(&(0x7f0000000100)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000080)) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r4, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r4, 0x400c6615, &(0x7f0000000200)) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000940)='fuse\x00', 0x0, &(0x7f0000000140)={{'fd', 0x3d, r5}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) 10:38:40 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:40 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:41 executing program 3: prctl$PR_SET_SECUREBITS(0x1c, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f00000002c0)=[{{&(0x7f0000002ec0)=@nfc_llcp, 0x80, &(0x7f0000000480)}, 0x1}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) getpid() fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3, 0x0, 0x0, 0xfffffffffffffffc}, 0x0) creat(&(0x7f0000000340)='./bus/file0\x00', 0x36) socket$netlink(0x10, 0x3, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000140)='TIPCv2\x00') clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) linkat(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0) r4 = open(0x0, 0x0, 0x0) linkat(0xffffffffffffffff, 0x0, r4, 0x0, 0x0) preadv(0xffffffffffffffff, 0x0, 0xfffffffffffffeb2, 0x10400003) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xd9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x0) r5 = socket$kcm(0x2, 0x2, 0x73) bind$inet(r5, &(0x7f00000000c0)={0x2, 0x0, @multicast1}, 0x10) connect(r5, &(0x7f0000000000)=@pppol2tpv3={0x2, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @remote}}}, 0x80) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x10000) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r6, 0x6, 0xd, &(0x7f0000000540)='dctcp\x00', 0x6) socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240), &(0x7f0000000280)=0xc) syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) r7 = socket$unix(0x1, 0x2, 0x0) r8 = fcntl$dupfd(r7, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) r9 = socket$unix(0x1, 0x2, 0x0) r10 = fcntl$dupfd(r9, 0x0, r9) ioctl$PERF_EVENT_IOC_ENABLE(r10, 0x8912, 0x400200) getsockname(0xffffffffffffffff, 0x0, &(0x7f00000003c0)) open(&(0x7f0000000000)='./bus\x00', 0x1c1042, 0x0) fadvise64(0xffffffffffffffff, 0x0, 0x0, 0x4) syz_open_procfs(0x0, &(0x7f0000000200)='net/ip6_flowlabel\x00') r11 = socket$inet_sctp(0x2, 0x5, 0x84) sendto$inet(r11, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f0000000180)=ANY=[@ANYBLOB="00ffffe2d778d8fd2308588e608c16a1288162b6f705846e0c7970ba06b600000000000000da392eedce38ec163d4728c0b597d091c41e7ddf30dd5bbfabb7fb453e86b2460c7db415afee58", @ANYRES32=0x0], 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000340)) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(0xffffffffffffffff, 0x84, 0x23, &(0x7f0000000440)={0x0, 0x8000}, 0x8) 10:38:41 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, 0x0, 0x0) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:43 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, 0x0) getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:38:43 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:43 executing program 3: socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) accept(0xffffffffffffffff, &(0x7f0000000100)=@pppoe={0x18, 0x0, {0x0, @dev}}, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'eql\x00\x00\x04\x00\x00\x00\x03\x00\x00\x00\xf2\a\x00', 0x2}) creat(&(0x7f0000000100)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000080)=0x0) io_submit(r5, 0x20000000000000dd, &(0x7f00000006c0)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000940)='fuse\x00', 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB="2c726f6f746d6f64653d30303030303030303030303030303030303130303030302c757365725f69643d6f03b8ff39388f71d4d5186ca2c53273be4e1a439d167748588d85e0541a5dfbef32db23ab8513594b26384c3ad0f8c6955eb83004a02a7ec2d3f8cc5372b8020a1723b1ee5deeba472b1fa8993147bd90171849f4e0306f552c3a626b3ef85dd312210e47146a84b19138b98796a09052b8a0357dc9dd64008514466fdcfbfd4f1d75efdfa1d86deadeb544c2b841f113980fa17946236d00a14806a70735d4a316000000", @ANYRESDEC=0x0, @ANYBLOB=',group_i', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) r6 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000940)='fuse\x00', 0x0, &(0x7f0000000140)={{'fd', 0x3d, r6}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8b28, &(0x7f0000000000)='wlan0\x00') open(&(0x7f00000000c0)='./bus\x00', 0x800000141042, 0x42) 10:38:43 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, 0x0, 0x0) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:43 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:38:43 executing program 1: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:38:43 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) creat(0x0, 0x0) close(0xffffffffffffffff) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getpeername$packet(r0, &(0x7f0000000540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000580)=0x14) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! .'], 0x4) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000006480)={'vxcan0\x00'}) 10:38:44 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:44 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, 0x0, 0x0) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:44 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:38:44 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:44 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(0x0, 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:46 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, 0x0) getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:38:46 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:38:46 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x0, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:46 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(0x0, 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:46 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:38:46 executing program 1: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:38:47 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:38:47 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x0, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:47 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(0x0, 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:47 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:38:47 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x0, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:47 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) [ 627.572665][ T27] audit: type=1804 audit(1576060728.108:71): pid=29878 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir872708607/syzkaller.XXqBom/401/bus" dev="sda1" ino=16894 res=1 10:38:49 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, 0x0) getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:38:49 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:38:49 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, 0x0, 0x0) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:49 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:49 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:38:49 executing program 1: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:38:50 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) [ 629.607214][ T27] audit: type=1804 audit(1576060730.148:72): pid=29893 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir872708607/syzkaller.XXqBom/402/bus" dev="sda1" ino=16943 res=1 10:38:50 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, 0x0, 0x0) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:50 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:50 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) [ 630.128419][ T27] audit: type=1804 audit(1576060730.658:73): pid=30010 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir872708607/syzkaller.XXqBom/403/bus" dev="sda1" ino=16957 res=1 10:38:50 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, 0x0, 0x0) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:50 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:38:53 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(0xffffffffffffffff, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:38:53 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r2 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r2, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(0xffffffffffffffff, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:38:53 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:38:53 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:53 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:38:53 executing program 1: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:38:53 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:38:53 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r2 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r2, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(0xffffffffffffffff, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:38:53 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:53 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:38:53 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r2 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r2, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(0xffffffffffffffff, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:38:54 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:38:56 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(0xffffffffffffffff, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:38:56 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:56 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:38:56 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x0) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:56 executing program 1: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:38:56 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:38:56 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:38:56 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:56 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x0) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:56 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:38:57 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:38:57 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:59 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(0xffffffffffffffff, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:38:59 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x0) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:59 executing program 3: setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(0xffffffffffffffff, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:38:59 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:59 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:38:59 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r5, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:38:59 executing program 3: setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(0xffffffffffffffff, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:38:59 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(0xffffffffffffffff, r8, 0x0, 0x8000fffffffe) 10:38:59 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, 0x0, 0x0) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:38:59 executing program 3: setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(0xffffffffffffffff, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:39:00 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(0xffffffffffffffff, r8, 0x0, 0x8000fffffffe) 10:39:00 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:39:02 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, 0x0, 0x0) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:39:02 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, 0x0, 0x0) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:39:02 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:39:02 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(0xffffffffffffffff, r8, 0x0, 0x8000fffffffe) 10:39:02 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:39:02 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:39:02 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:39:03 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, 0x0, 0x0) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:39:03 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, 0xffffffffffffffff, 0x0, 0x8000fffffffe) 10:39:03 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x0, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:39:03 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(0x0, 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:39:03 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, 0xffffffffffffffff, 0x0, 0x8000fffffffe) 10:39:05 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, 0x0, 0x0) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:39:05 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x0, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:39:05 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(0x0, 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:39:05 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, 0xffffffffffffffff, 0x0, 0x8000fffffffe) 10:39:05 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:39:05 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:39:06 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x0, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:39:06 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(0x0, 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:39:06 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x0) 10:39:06 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, 0x0, 0x0) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:39:06 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x0) 10:39:06 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) [ 646.259612][ T27] audit: type=1804 audit(1576060746.798:74): pid=30727 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir161648519/syzkaller.FRmf9q/401/bus" dev="sda1" ino=16691 res=1 10:39:08 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, 0x0, 0x0) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:39:08 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, 0x0, 0x0) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:39:08 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:39:08 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb}, 0xb) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x0, 0x7000}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x0) 10:39:08 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r5, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:39:08 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:39:09 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) [ 648.674163][ T27] audit: type=1804 audit(1576060749.208:75): pid=30743 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir161648519/syzkaller.FRmf9q/402/bus" dev="sda1" ino=17038 res=1 10:39:09 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, 0x0, 0x0) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:39:09 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:39:09 executing program 2: syz_mount_image$ext4(0x0, 0x0, 0x0, 0x1, &(0x7f00000007c0)=[{&(0x7f0000000580)="62f23e748cdfecc0d3bcb88248f9f8f8e87edc5637656d6e511dcdc6041c8d8a0957939950c15c7ac6360c7820e1d5957ba4167f17600b58767db91e29eb92a20f86dddfb0f8dda322d3ddeadba924051c7894f228f090746b1a55e851e7dcaae4d8411f6806d216b4f2e7eca231a301cc0c9bb4bb5598a94336a99790d3b77dcda45483c1fb1194c56ddfddb587442754e6", 0x92, 0x9}], 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000240)={0xdc, 0x0, 0x0, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_DAEMON={0x30, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @initdev={0xac, 0x1e, 0x0, 0x0}}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}]}, @IPVS_CMD_ATTR_DEST={0x18, 0x2, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@local}]}, @IPVS_CMD_ATTR_DEST={0x38, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8}, @IPVS_DEST_ATTR_INACT_CONNS={0x8}, @IPVS_DEST_ATTR_L_THRESH={0x8}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x4}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast1}]}, @IPVS_CMD_ATTR_DEST={0x34, 0x2, [@IPVS_DEST_ATTR_L_THRESH={0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8}, @IPVS_DEST_ATTR_INACT_CONNS={0x8}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x401}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xffffffff}, @IPVS_DEST_ATTR_TUN_TYPE={0x8}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}]}]}, 0xdc}}, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0xabb, &(0x7f0000000100)=[{&(0x7f00000000c0)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0x4db, 0x400}], 0x4801, 0x0) 10:39:09 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:39:09 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040), 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) [ 649.338788][ T27] audit: type=1804 audit(1576060749.868:76): pid=30824 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir161648519/syzkaller.FRmf9q/403/bus" dev="sda1" ino=17035 res=1 [ 649.631318][T30840] EXT4-fs (loop2): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 649.676030][T30840] EXT4-fs (loop2): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 649.731024][T30840] EXT4-fs (loop2): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 649.760090][T30840] EXT4-fs error (device loop2): __ext4_iget:4703: inode #2: block 524296: comm syz-executor.2: invalid block [ 649.860742][T30840] EXT4-fs (loop2): get root inode failed [ 650.005532][T30840] EXT4-fs (loop2): mount failed 10:39:12 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(0xffffffffffffffff, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:39:12 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x10, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:39:12 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r2 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r2, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(0xffffffffffffffff, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:39:12 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040), 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:39:12 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(0x0, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:39:12 executing program 2: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) socket(0x10, 0x803, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000600)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001280)=ANY=[@ANYBLOB="340000001000010400"/18, @ANYRES32, @ANYBLOB='\x00'], 0x3}}, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001280)=ANY=[@ANYBLOB="34000000100001040000", @ANYRES32, @ANYBLOB="0000000000000000140012000c00010062726964676500000300020092ab29e6bc90313f5c14a8d5d4534e466f18e765b4fd2a0e0ffabd5f884b8215627962f7a4aab6691329692afb3fdcc3e7378871f430fe0e63a139f8432b7c88d952fec2b4b054306391450600000008917ef4c83982304f91f231dc1ecf62c4bf0541ff2b5060b6a4d69b9403c96422fd8632e43e946636599dedd725bcd83c8971198e43a29e4b1c15388e01dee5bf7c4e128ff5b5c146c15db0684e76186c1d4209d8b4158f7b359d8efa69231277e09c47884e9fb0b010687409fc6fa73c91c9504b4460a91a865e0897f10dc1c1e0edc0d560f18478d67cc5cf8dbb0ee5003f6cc7185e99bc93bcb9eb76abba12076a8d076c853092edf73f4224c4e770006630b3a7e43c7e4c90ce6a20fac946584d406aa1cc75103f746d1f026456e44c9a39c62eecdb8bb82ca275e24c5c9095cbc8a6701a2447f9f6e6e4a372717366f176f0e4df46e9e28ede8a00e2a8"], 0x3}}, 0x0) 10:39:12 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x10, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:39:12 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040), 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:39:12 executing program 2: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) socket(0x10, 0x803, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000600)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001280)=ANY=[@ANYBLOB="340000001000010400"/18, @ANYRES32, @ANYBLOB='\x00'], 0x3}}, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001280)=ANY=[@ANYBLOB="34000000100001040000", @ANYRES32, @ANYBLOB="0000000000000000140012000c00010062726964676500000300020092ab29e6bc90313f5c14a8d5d4534e466f18e765b4fd2a0e0ffabd5f884b8215627962f7a4aab6691329692afb3fdcc3e7378871f430fe0e63a139f8432b7c88d952fec2b4b054306391450600000008917ef4c83982304f91f231dc1ecf62c4bf0541ff2b5060b6a4d69b9403c96422fd8632e43e946636599dedd725bcd83c8971198e43a29e4b1c15388e01dee5bf7c4e128ff5b5c146c15db0684e76186c1d4209d8b4158f7b359d8efa69231277e09c47884e9fb0b010687409fc6fa73c91c9504b4460a91a865e0897f10dc1c1e0edc0d560f18478d67cc5cf8dbb0ee5003f6cc7185e99bc93bcb9eb76abba12076a8d076c853092edf73f4224c4e770006630b3a7e43c7e4c90ce6a20fac946584d406aa1cc75103f746d1f026456e44c9a39c62eecdb8bb82ca275e24c5c9095cbc8a6701a2447f9f6e6e4a372717366f176f0e4df46e9e28ede8a00e2a8"], 0x3}}, 0x0) 10:39:12 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r2 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r2, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(0xffffffffffffffff, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:39:12 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x10, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:39:12 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:39:15 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(0xffffffffffffffff, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:39:15 executing program 2: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) socket(0x10, 0x803, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000600)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001280)=ANY=[@ANYBLOB="340000001000010400"/18, @ANYRES32, @ANYBLOB='\x00'], 0x3}}, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001280)=ANY=[@ANYBLOB="34000000100001040000", @ANYRES32, @ANYBLOB="0000000000000000140012000c00010062726964676500000300020092ab29e6bc90313f5c14a8d5d4534e466f18e765b4fd2a0e0ffabd5f884b8215627962f7a4aab6691329692afb3fdcc3e7378871f430fe0e63a139f8432b7c88d952fec2b4b054306391450600000008917ef4c83982304f91f231dc1ecf62c4bf0541ff2b5060b6a4d69b9403c96422fd8632e43e946636599dedd725bcd83c8971198e43a29e4b1c15388e01dee5bf7c4e128ff5b5c146c15db0684e76186c1d4209d8b4158f7b359d8efa69231277e09c47884e9fb0b010687409fc6fa73c91c9504b4460a91a865e0897f10dc1c1e0edc0d560f18478d67cc5cf8dbb0ee5003f6cc7185e99bc93bcb9eb76abba12076a8d076c853092edf73f4224c4e770006630b3a7e43c7e4c90ce6a20fac946584d406aa1cc75103f746d1f026456e44c9a39c62eecdb8bb82ca275e24c5c9095cbc8a6701a2447f9f6e6e4a372717366f176f0e4df46e9e28ede8a00e2a8"], 0x3}}, 0x0) 10:39:15 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r2 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r2, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = dup(r3) write$P9_RWRITE(r4, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(0xffffffffffffffff, 0x800fe) sendfile(r6, r7, 0x0, 0x8000fffffffe) 10:39:15 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:39:15 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:39:15 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(0x0, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:39:15 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:39:15 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x0) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:39:15 executing program 2: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) socket(0x10, 0x803, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000600)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001280)=ANY=[@ANYBLOB="340000001000010400"/18, @ANYRES32, @ANYBLOB='\x00'], 0x3}}, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001280)=ANY=[@ANYBLOB="34000000100001040000", @ANYRES32, @ANYBLOB="0000000000000000140012000c00010062726964676500000300020092ab29e6bc90313f5c14a8d5d4534e466f18e765b4fd2a0e0ffabd5f884b8215627962f7a4aab6691329692afb3fdcc3e7378871f430fe0e63a139f8432b7c88d952fec2b4b054306391450600000008917ef4c83982304f91f231dc1ecf62c4bf0541ff2b5060b6a4d69b9403c96422fd8632e43e946636599dedd725bcd83c8971198e43a29e4b1c15388e01dee5bf7c4e128ff5b5c146c15db0684e76186c1d4209d8b4158f7b359d8efa69231277e09c47884e9fb0b010687409fc6fa73c91c9504b4460a91a865e0897f10dc1c1e0edc0d560f18478d67cc5cf8dbb0ee5003f6cc7185e99bc93bcb9eb76abba12076a8d076c853092edf73f4224c4e770006630b3a7e43c7e4c90ce6a20fac946584d406aa1cc75103f746d1f026456e44c9a39c62eecdb8bb82ca275e24c5c9095cbc8a6701a2447f9f6e6e4a372717366f176f0e4df46e9e28ede8a00e2a8"], 0x3}}, 0x0) 10:39:16 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, 0x0, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:39:16 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x0) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:39:16 executing program 2: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) socket(0x10, 0x803, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000600)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001280)=ANY=[@ANYBLOB="340000001000010400"/18, @ANYRES32, @ANYBLOB='\x00'], 0x3}}, 0x0) socket(0x10, 0x803, 0x0) 10:39:18 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(0xffffffffffffffff, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:39:18 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, 0x0, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:39:18 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x0) sendfile(r7, r8, 0x0, 0x8000fffffffe) 10:39:18 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(0x0, 0x11) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:39:18 executing program 2: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) socket(0x10, 0x803, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000600)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001280)=ANY=[@ANYBLOB="340000001000010400"/18, @ANYRES32, @ANYBLOB='\x00'], 0x3}}, 0x0) socket(0x10, 0x803, 0x0) 10:39:18 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:39:18 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, 0x0, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:39:18 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(0xffffffffffffffff, r8, 0x0, 0x8000fffffffe) 10:39:18 executing program 2: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) socket(0x10, 0x803, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000600)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001280)=ANY=[@ANYBLOB="340000001000010400"/18, @ANYRES32, @ANYBLOB='\x00'], 0x3}}, 0x0) socket(0x10, 0x803, 0x0) 10:39:19 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x0, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:39:19 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(0xffffffffffffffff, r8, 0x0, 0x8000fffffffe) 10:39:19 executing program 2: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) socket(0x10, 0x803, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000600)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001280)=ANY=[@ANYBLOB="340000001000010400"/18, @ANYRES32, @ANYBLOB='\x00'], 0x3}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001280)=ANY=[@ANYBLOB="34000000100001040000", @ANYRES32, @ANYBLOB="0000000000000000140012000c00010062726964676500000300020092ab29e6bc90313f5c14a8d5d4534e466f18e765b4fd2a0e0ffabd5f884b8215627962f7a4aab6691329692afb3fdcc3e7378871f430fe0e63a139f8432b7c88d952fec2b4b054306391450600000008917ef4c83982304f91f231dc1ecf62c4bf0541ff2b5060b6a4d69b9403c96422fd8632e43e946636599dedd725bcd83c8971198e43a29e4b1c15388e01dee5bf7c4e128ff5b5c146c15db0684e76186c1d4209d8b4158f7b359d8efa69231277e09c47884e9fb0b010687409fc6fa73c91c9504b4460a91a865e0897f10dc1c1e0edc0d560f18478d67cc5cf8dbb0ee5003f6cc7185e99bc93bcb9eb76abba12076a8d076c853092edf73f4224c4e770006630b3a7e43c7e4c90ce6a20fac946584d406aa1cc75103f746d1f026456e44c9a39c62eecdb8bb82ca275e24c5c9095cbc8a6701a2447f9f6e6e4a372717366f176f0e4df46e9e28ede8a00e2a8"], 0x3}}, 0x0) 10:39:21 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:39:21 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x0, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:39:21 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(0xffffffffffffffff, r8, 0x0, 0x8000fffffffe) 10:39:21 executing program 2: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) socket(0x10, 0x803, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000600)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001280)=ANY=[@ANYBLOB="340000001000010400"/18, @ANYRES32, @ANYBLOB='\x00'], 0x3}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001280)=ANY=[@ANYBLOB="34000000100001040000", @ANYRES32, @ANYBLOB="0000000000000000140012000c00010062726964676500000300020092ab29e6bc90313f5c14a8d5d4534e466f18e765b4fd2a0e0ffabd5f884b8215627962f7a4aab6691329692afb3fdcc3e7378871f430fe0e63a139f8432b7c88d952fec2b4b054306391450600000008917ef4c83982304f91f231dc1ecf62c4bf0541ff2b5060b6a4d69b9403c96422fd8632e43e946636599dedd725bcd83c8971198e43a29e4b1c15388e01dee5bf7c4e128ff5b5c146c15db0684e76186c1d4209d8b4158f7b359d8efa69231277e09c47884e9fb0b010687409fc6fa73c91c9504b4460a91a865e0897f10dc1c1e0edc0d560f18478d67cc5cf8dbb0ee5003f6cc7185e99bc93bcb9eb76abba12076a8d076c853092edf73f4224c4e770006630b3a7e43c7e4c90ce6a20fac946584d406aa1cc75103f746d1f026456e44c9a39c62eecdb8bb82ca275e24c5c9095cbc8a6701a2447f9f6e6e4a372717366f176f0e4df46e9e28ede8a00e2a8"], 0x3}}, 0x0) 10:39:21 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:39:21 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x0) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:39:21 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x0, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:39:22 executing program 2: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) socket(0x10, 0x803, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000600)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001280)=ANY=[@ANYBLOB="340000001000010400"/18, @ANYRES32, @ANYBLOB='\x00'], 0x3}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001280)=ANY=[@ANYBLOB="34000000100001040000", @ANYRES32, @ANYBLOB="0000000000000000140012000c00010062726964676500000300020092ab29e6bc90313f5c14a8d5d4534e466f18e765b4fd2a0e0ffabd5f884b8215627962f7a4aab6691329692afb3fdcc3e7378871f430fe0e63a139f8432b7c88d952fec2b4b054306391450600000008917ef4c83982304f91f231dc1ecf62c4bf0541ff2b5060b6a4d69b9403c96422fd8632e43e946636599dedd725bcd83c8971198e43a29e4b1c15388e01dee5bf7c4e128ff5b5c146c15db0684e76186c1d4209d8b4158f7b359d8efa69231277e09c47884e9fb0b010687409fc6fa73c91c9504b4460a91a865e0897f10dc1c1e0edc0d560f18478d67cc5cf8dbb0ee5003f6cc7185e99bc93bcb9eb76abba12076a8d076c853092edf73f4224c4e770006630b3a7e43c7e4c90ce6a20fac946584d406aa1cc75103f746d1f026456e44c9a39c62eecdb8bb82ca275e24c5c9095cbc8a6701a2447f9f6e6e4a372717366f176f0e4df46e9e28ede8a00e2a8"], 0x3}}, 0x0) 10:39:22 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, 0xffffffffffffffff, 0x0, 0x8000fffffffe) 10:39:22 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:39:22 executing program 2: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) socket(0x10, 0x803, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000600)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001280)=ANY=[@ANYBLOB="34000000100001040000", @ANYRES32, @ANYBLOB="0000000000000000140012000c00010062726964676500000300020092ab29e6bc90313f5c14a8d5d4534e466f18e765b4fd2a0e0ffabd5f884b8215627962f7a4aab6691329692afb3fdcc3e7378871f430fe0e63a139f8432b7c88d952fec2b4b054306391450600000008917ef4c83982304f91f231dc1ecf62c4bf0541ff2b5060b6a4d69b9403c96422fd8632e43e946636599dedd725bcd83c8971198e43a29e4b1c15388e01dee5bf7c4e128ff5b5c146c15db0684e76186c1d4209d8b4158f7b359d8efa69231277e09c47884e9fb0b010687409fc6fa73c91c9504b4460a91a865e0897f10dc1c1e0edc0d560f18478d67cc5cf8dbb0ee5003f6cc7185e99bc93bcb9eb76abba12076a8d076c853092edf73f4224c4e770006630b3a7e43c7e4c90ce6a20fac946584d406aa1cc75103f746d1f026456e44c9a39c62eecdb8bb82ca275e24c5c9095cbc8a6701a2447f9f6e6e4a372717366f176f0e4df46e9e28ede8a00e2a8"], 0x3}}, 0x0) 10:39:22 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, 0xffffffffffffffff, 0x0, 0x8000fffffffe) 10:39:24 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:39:24 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:39:24 executing program 2: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) socket(0x10, 0x803, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000600)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001280)=ANY=[@ANYBLOB="34000000100001040000", @ANYRES32, @ANYBLOB="0000000000000000140012000c00010062726964676500000300020092ab29e6bc90313f5c14a8d5d4534e466f18e765b4fd2a0e0ffabd5f884b8215627962f7a4aab6691329692afb3fdcc3e7378871f430fe0e63a139f8432b7c88d952fec2b4b054306391450600000008917ef4c83982304f91f231dc1ecf62c4bf0541ff2b5060b6a4d69b9403c96422fd8632e43e946636599dedd725bcd83c8971198e43a29e4b1c15388e01dee5bf7c4e128ff5b5c146c15db0684e76186c1d4209d8b4158f7b359d8efa69231277e09c47884e9fb0b010687409fc6fa73c91c9504b4460a91a865e0897f10dc1c1e0edc0d560f18478d67cc5cf8dbb0ee5003f6cc7185e99bc93bcb9eb76abba12076a8d076c853092edf73f4224c4e770006630b3a7e43c7e4c90ce6a20fac946584d406aa1cc75103f746d1f026456e44c9a39c62eecdb8bb82ca275e24c5c9095cbc8a6701a2447f9f6e6e4a372717366f176f0e4df46e9e28ede8a00e2a8"], 0x3}}, 0x0) 10:39:24 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, 0xffffffffffffffff, 0x0, 0x8000fffffffe) 10:39:24 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x0) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:39:24 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:39:25 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x0) 10:39:25 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:39:25 executing program 2: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) socket(0x10, 0x803, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000600)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001280)=ANY=[@ANYBLOB="34000000100001040000", @ANYRES32, @ANYBLOB="0000000000000000140012000c00010062726964676500000300020092ab29e6bc90313f5c14a8d5d4534e466f18e765b4fd2a0e0ffabd5f884b8215627962f7a4aab6691329692afb3fdcc3e7378871f430fe0e63a139f8432b7c88d952fec2b4b054306391450600000008917ef4c83982304f91f231dc1ecf62c4bf0541ff2b5060b6a4d69b9403c96422fd8632e43e946636599dedd725bcd83c8971198e43a29e4b1c15388e01dee5bf7c4e128ff5b5c146c15db0684e76186c1d4209d8b4158f7b359d8efa69231277e09c47884e9fb0b010687409fc6fa73c91c9504b4460a91a865e0897f10dc1c1e0edc0d560f18478d67cc5cf8dbb0ee5003f6cc7185e99bc93bcb9eb76abba12076a8d076c853092edf73f4224c4e770006630b3a7e43c7e4c90ce6a20fac946584d406aa1cc75103f746d1f026456e44c9a39c62eecdb8bb82ca275e24c5c9095cbc8a6701a2447f9f6e6e4a372717366f176f0e4df46e9e28ede8a00e2a8"], 0x3}}, 0x0) 10:39:25 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:39:25 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x0) 10:39:25 executing program 2: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) socket(0x10, 0x803, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000600)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001280)=ANY=[@ANYBLOB="34000000100001040000", @ANYRES32, @ANYBLOB="0000000000000000140012000c00010062726964676500000300020092ab29e6bc90313f5c14a8d5d4534e466f18e765b4fd2a0e0ffabd5f884b8215627962f7a4aab6691329692afb3fdcc3e7378871f430fe0e63a139f8432b7c88d952fec2b4b054306391450600000008917ef4c83982304f91f231dc1ecf62c4bf0541ff2b5060b6a4d69b9403c96422fd8632e43e946636599dedd725bcd83c8971198e43a29e4b1c15388e01dee5bf7c4e128ff5b5c146c15db0684e76186c1d4209d8b4158f7b359d8efa69231277e09c47884e9fb0b010687409fc6fa73c91c9504b4460a91a865e0897f10dc1c1e0edc0d560f18478d67cc5cf8dbb0ee5003f6cc7185e99bc93bcb9eb76abba12076a8d076c853092edf73f4224c4e770006630b3a7e43c7e4c90ce6a20fac946584d406aa1cc75103f746d1f026456e44c9a39c62eecdb8bb82ca275e24c5c9095cbc8a6701a2447f9f6e6e4a372717366f176f0e4df46e9e28ede8a00e2a8"], 0x3}}, 0x0) 10:39:27 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1000000000000004, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:39:27 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:39:27 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(0x0, 0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) read$eventfd(r1, 0x0, 0x0) fallocate(r0, 0x800000000000003, 0xfa9, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = msgget$private(0x0, 0x204) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000002c0)=""/106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = dup(r4) write$P9_RWRITE(r5, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r6) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x800fe) sendfile(r7, r8, 0x0, 0x0) 10:39:27 executing program 2: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) socket(0x10, 0x803, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000600)) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001280)=ANY=[@ANYBLOB="34000000100001040000", @ANYRES32, @ANYBLOB="0000000000000000140012000c00010062726964676500000300020092ab29e6bc90313f5c14a8d5d4534e466f18e765b4fd2a0e0ffabd5f884b8215627962f7a4aab6691329692afb3fdcc3e7378871f430fe0e63a139f8432b7c88d952fec2b4b054306391450600000008917ef4c83982304f91f231dc1ecf62c4bf0541ff2b5060b6a4d69b9403c96422fd8632e43e946636599dedd725bcd83c8971198e43a29e4b1c15388e01dee5bf7c4e128ff5b5c146c15db0684e76186c1d4209d8b4158f7b359d8efa69231277e09c47884e9fb0b010687409fc6fa73c91c9504b4460a91a865e0897f10dc1c1e0edc0d560f18478d67cc5cf8dbb0ee5003f6cc7185e99bc93bcb9eb76abba12076a8d076c853092edf73f4224c4e770006630b3a7e43c7e4c90ce6a20fac946584d406aa1cc75103f746d1f026456e44c9a39c62eecdb8bb82ca275e24c5c9095cbc8a6701a2447f9f6e6e4a372717366f176f0e4df46e9e28ede8a00e2a8"], 0x3}}, 0x0) 10:39:27 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) r4 = getpid() rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f0000000000)) ptrace$getregset(0x4204, r4, 0x202, &(0x7f0000000080)={&(0x7f0000001300)=""/4096, 0x1000}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x0) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) 10:39:27 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:39:28 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:39:28 executing program 2: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) socket(0x10, 0x803, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000600)) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001280)=ANY=[@ANYBLOB="34000000100001040000", @ANYRES32, @ANYBLOB="0000000000000000140012000c00010062726964676500000300020092ab29e6bc90313f5c14a8d5d4534e466f18e765b4fd2a0e0ffabd5f884b8215627962f7a4aab6691329692afb3fdcc3e7378871f430fe0e63a139f8432b7c88d952fec2b4b054306391450600000008917ef4c83982304f91f231dc1ecf62c4bf0541ff2b5060b6a4d69b9403c96422fd8632e43e946636599dedd725bcd83c8971198e43a29e4b1c15388e01dee5bf7c4e128ff5b5c146c15db0684e76186c1d4209d8b4158f7b359d8efa69231277e09c47884e9fb0b010687409fc6fa73c91c9504b4460a91a865e0897f10dc1c1e0edc0d560f18478d67cc5cf8dbb0ee5003f6cc7185e99bc93bcb9eb76abba12076a8d076c853092edf73f4224c4e770006630b3a7e43c7e4c90ce6a20fac946584d406aa1cc75103f746d1f026456e44c9a39c62eecdb8bb82ca275e24c5c9095cbc8a6701a2447f9f6e6e4a372717366f176f0e4df46e9e28ede8a00e2a8"], 0x3}}, 0x0) 10:39:28 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:39:28 executing program 5: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) creat(&(0x7f0000000280)='./file0\x00', 0x0) socket$nl_route(0x10, 0x3, 0x0) 10:39:28 executing program 2: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) socket(0x10, 0x803, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000600)) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001280)=ANY=[@ANYBLOB="34000000100001040000", @ANYRES32, @ANYBLOB="0000000000000000140012000c00010062726964676500000300020092ab29e6bc90313f5c14a8d5d4534e466f18e765b4fd2a0e0ffabd5f884b8215627962f7a4aab6691329692afb3fdcc3e7378871f430fe0e63a139f8432b7c88d952fec2b4b054306391450600000008917ef4c83982304f91f231dc1ecf62c4bf0541ff2b5060b6a4d69b9403c96422fd8632e43e946636599dedd725bcd83c8971198e43a29e4b1c15388e01dee5bf7c4e128ff5b5c146c15db0684e76186c1d4209d8b4158f7b359d8efa69231277e09c47884e9fb0b010687409fc6fa73c91c9504b4460a91a865e0897f10dc1c1e0edc0d560f18478d67cc5cf8dbb0ee5003f6cc7185e99bc93bcb9eb76abba12076a8d076c853092edf73f4224c4e770006630b3a7e43c7e4c90ce6a20fac946584d406aa1cc75103f746d1f026456e44c9a39c62eecdb8bb82ca275e24c5c9095cbc8a6701a2447f9f6e6e4a372717366f176f0e4df46e9e28ede8a00e2a8"], 0x3}}, 0x0) 10:39:29 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:39:31 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:39:31 executing program 2: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001280)=ANY=[@ANYBLOB="34000000100001040000", @ANYRES32, @ANYBLOB="0000000000000000140012000c00010062726964676500000300020092ab29e6bc90313f5c14a8d5d4534e466f18e765b4fd2a0e0ffabd5f884b8215627962f7a4aab6691329692afb3fdcc3e7378871f430fe0e63a139f8432b7c88d952fec2b4b054306391450600000008917ef4c83982304f91f231dc1ecf62c4bf0541ff2b5060b6a4d69b9403c96422fd8632e43e946636599dedd725bcd83c8971198e43a29e4b1c15388e01dee5bf7c4e128ff5b5c146c15db0684e76186c1d4209d8b4158f7b359d8efa69231277e09c47884e9fb0b010687409fc6fa73c91c9504b4460a91a865e0897f10dc1c1e0edc0d560f18478d67cc5cf8dbb0ee5003f6cc7185e99bc93bcb9eb76abba12076a8d076c853092edf73f4224c4e770006630b3a7e43c7e4c90ce6a20fac946584d406aa1cc75103f746d1f026456e44c9a39c62eecdb8bb82ca275e24c5c9095cbc8a6701a2447f9f6e6e4a372717366f176f0e4df46e9e28ede8a00e2a8"], 0x3}}, 0x0) 10:39:31 executing program 5: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) creat(&(0x7f0000000280)='./file0\x00', 0x0) socket$nl_route(0x10, 0x3, 0x0) 10:39:31 executing program 0: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_subtree(r0, &(0x7f00000001c0)='cgroup.subtree_control\x00', 0x2, 0x0) bind(r0, &(0x7f0000000000)=@isdn={0x22, 0xff, 0x36, 0x5, 0x66}, 0x80) write$cgroup_subtree(r1, &(0x7f0000000180)={[{0x800000000002b, 'pids'}]}, 0x6) 10:39:31 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:39:31 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:39:31 executing program 2: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001280)=ANY=[@ANYBLOB="34000000100001040000", @ANYRES32, @ANYBLOB="0000000000000000140012000c00010062726964676500000300020092ab29e6bc90313f5c14a8d5d4534e466f18e765b4fd2a0e0ffabd5f884b8215627962f7a4aab6691329692afb3fdcc3e7378871f430fe0e63a139f8432b7c88d952fec2b4b054306391450600000008917ef4c83982304f91f231dc1ecf62c4bf0541ff2b5060b6a4d69b9403c96422fd8632e43e946636599dedd725bcd83c8971198e43a29e4b1c15388e01dee5bf7c4e128ff5b5c146c15db0684e76186c1d4209d8b4158f7b359d8efa69231277e09c47884e9fb0b010687409fc6fa73c91c9504b4460a91a865e0897f10dc1c1e0edc0d560f18478d67cc5cf8dbb0ee5003f6cc7185e99bc93bcb9eb76abba12076a8d076c853092edf73f4224c4e770006630b3a7e43c7e4c90ce6a20fac946584d406aa1cc75103f746d1f026456e44c9a39c62eecdb8bb82ca275e24c5c9095cbc8a6701a2447f9f6e6e4a372717366f176f0e4df46e9e28ede8a00e2a8"], 0x3}}, 0x0) 10:39:31 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:39:31 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$sock_timeval(r2, 0xffff, 0x1006, &(0x7f0000000080)={0x20002}, 0x10) r3 = dup(r2) setsockopt$inet_mreqsrc(r1, 0x0, 0x46, &(0x7f0000000000)={@remote={0xac, 0x14, 0x0}, @multicast1}, 0xc) recvfrom$inet(r3, 0x0, 0xe5, 0x0, 0x0, 0x800e00551) shutdown(r3, 0x0) 10:39:31 executing program 5: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) creat(&(0x7f0000000280)='./file0\x00', 0x0) socket$nl_route(0x10, 0x3, 0x0) 10:39:31 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:39:32 executing program 0: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x50000}]}) r0 = fcntl$dupfd(0xffffffffffffff9c, 0x0, 0xffffffffffffffff) ioctl$KDGKBMODE(r0, 0x4b44, 0x0) 10:39:34 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:39:34 executing program 2: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001280)=ANY=[@ANYBLOB="34000000100001040000", @ANYRES32, @ANYBLOB="0000000000000000140012000c00010062726964676500000300020092ab29e6bc90313f5c14a8d5d4534e466f18e765b4fd2a0e0ffabd5f884b8215627962f7a4aab6691329692afb3fdcc3e7378871f430fe0e63a139f8432b7c88d952fec2b4b054306391450600000008917ef4c83982304f91f231dc1ecf62c4bf0541ff2b5060b6a4d69b9403c96422fd8632e43e946636599dedd725bcd83c8971198e43a29e4b1c15388e01dee5bf7c4e128ff5b5c146c15db0684e76186c1d4209d8b4158f7b359d8efa69231277e09c47884e9fb0b010687409fc6fa73c91c9504b4460a91a865e0897f10dc1c1e0edc0d560f18478d67cc5cf8dbb0ee5003f6cc7185e99bc93bcb9eb76abba12076a8d076c853092edf73f4224c4e770006630b3a7e43c7e4c90ce6a20fac946584d406aa1cc75103f746d1f026456e44c9a39c62eecdb8bb82ca275e24c5c9095cbc8a6701a2447f9f6e6e4a372717366f176f0e4df46e9e28ede8a00e2a8"], 0x3}}, 0x0) 10:39:34 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:39:34 executing program 5: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) creat(&(0x7f0000000280)='./file0\x00', 0x0) socket$nl_route(0x10, 0x3, 0x0) 10:39:34 executing program 0: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x50000}]}) r0 = fcntl$dupfd(0xffffffffffffff9c, 0x0, 0xffffffffffffffff) ioctl$KDGKBMODE(r0, 0x4b44, 0x0) 10:39:34 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)) r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:39:34 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:39:34 executing program 2: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000600)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001280)=ANY=[@ANYBLOB="34000000100001040000", @ANYRES32, @ANYBLOB="0000000000000000140012000c00010062726964676500000300020092ab29e6bc90313f5c14a8d5d4534e466f18e765b4fd2a0e0ffabd5f884b8215627962f7a4aab6691329692afb3fdcc3e7378871f430fe0e63a139f8432b7c88d952fec2b4b054306391450600000008917ef4c83982304f91f231dc1ecf62c4bf0541ff2b5060b6a4d69b9403c96422fd8632e43e946636599dedd725bcd83c8971198e43a29e4b1c15388e01dee5bf7c4e128ff5b5c146c15db0684e76186c1d4209d8b4158f7b359d8efa69231277e09c47884e9fb0b010687409fc6fa73c91c9504b4460a91a865e0897f10dc1c1e0edc0d560f18478d67cc5cf8dbb0ee5003f6cc7185e99bc93bcb9eb76abba12076a8d076c853092edf73f4224c4e770006630b3a7e43c7e4c90ce6a20fac946584d406aa1cc75103f746d1f026456e44c9a39c62eecdb8bb82ca275e24c5c9095cbc8a6701a2447f9f6e6e4a372717366f176f0e4df46e9e28ede8a00e2a8"], 0x3}}, 0x0) 10:39:34 executing program 0: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x50000}]}) r0 = openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r0, 0x6, 0x21, 0x0, 0x0) 10:39:34 executing program 5: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) creat(&(0x7f0000000280)='./file0\x00', 0x0) 10:39:34 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:39:35 executing program 2: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000600)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001280)=ANY=[@ANYBLOB="34000000100001040000", @ANYRES32, @ANYBLOB="0000000000000000140012000c00010062726964676500000300020092ab29e6bc90313f5c14a8d5d4534e466f18e765b4fd2a0e0ffabd5f884b8215627962f7a4aab6691329692afb3fdcc3e7378871f430fe0e63a139f8432b7c88d952fec2b4b054306391450600000008917ef4c83982304f91f231dc1ecf62c4bf0541ff2b5060b6a4d69b9403c96422fd8632e43e946636599dedd725bcd83c8971198e43a29e4b1c15388e01dee5bf7c4e128ff5b5c146c15db0684e76186c1d4209d8b4158f7b359d8efa69231277e09c47884e9fb0b010687409fc6fa73c91c9504b4460a91a865e0897f10dc1c1e0edc0d560f18478d67cc5cf8dbb0ee5003f6cc7185e99bc93bcb9eb76abba12076a8d076c853092edf73f4224c4e770006630b3a7e43c7e4c90ce6a20fac946584d406aa1cc75103f746d1f026456e44c9a39c62eecdb8bb82ca275e24c5c9095cbc8a6701a2447f9f6e6e4a372717366f176f0e4df46e9e28ede8a00e2a8"], 0x3}}, 0x0) 10:39:37 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:39:37 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:39:37 executing program 0: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x50000}]}) r0 = open(0x0, 0x0, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, 0x0, 0x0) 10:39:37 executing program 5: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) 10:39:37 executing program 2: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000600)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001280)=ANY=[@ANYBLOB="34000000100001040000", @ANYRES32, @ANYBLOB="0000000000000000140012000c00010062726964676500000300020092ab29e6bc90313f5c14a8d5d4534e466f18e765b4fd2a0e0ffabd5f884b8215627962f7a4aab6691329692afb3fdcc3e7378871f430fe0e63a139f8432b7c88d952fec2b4b054306391450600000008917ef4c83982304f91f231dc1ecf62c4bf0541ff2b5060b6a4d69b9403c96422fd8632e43e946636599dedd725bcd83c8971198e43a29e4b1c15388e01dee5bf7c4e128ff5b5c146c15db0684e76186c1d4209d8b4158f7b359d8efa69231277e09c47884e9fb0b010687409fc6fa73c91c9504b4460a91a865e0897f10dc1c1e0edc0d560f18478d67cc5cf8dbb0ee5003f6cc7185e99bc93bcb9eb76abba12076a8d076c853092edf73f4224c4e770006630b3a7e43c7e4c90ce6a20fac946584d406aa1cc75103f746d1f026456e44c9a39c62eecdb8bb82ca275e24c5c9095cbc8a6701a2447f9f6e6e4a372717366f176f0e4df46e9e28ede8a00e2a8"], 0x3}}, 0x0) 10:39:37 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)) r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:39:37 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(0xffffffffffffffff, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:39:37 executing program 5: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 10:39:37 executing program 2: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000480), 0x10000000000002a1, 0x0) socket(0x10, 0x803, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000600)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001280)=ANY=[@ANYBLOB="34000000100001040000", @ANYRES32, @ANYBLOB="0000000000000000140012000c00010062726964676500000300020092ab29e6bc90313f5c14a8d5d4534e466f18e765b4fd2a0e0ffabd5f884b8215627962f7a4aab6691329692afb3fdcc3e7378871f430fe0e63a139f8432b7c88d952fec2b4b054306391450600000008917ef4c83982304f91f231dc1ecf62c4bf0541ff2b5060b6a4d69b9403c96422fd8632e43e946636599dedd725bcd83c8971198e43a29e4b1c15388e01dee5bf7c4e128ff5b5c146c15db0684e76186c1d4209d8b4158f7b359d8efa69231277e09c47884e9fb0b010687409fc6fa73c91c9504b4460a91a865e0897f10dc1c1e0edc0d560f18478d67cc5cf8dbb0ee5003f6cc7185e99bc93bcb9eb76abba12076a8d076c853092edf73f4224c4e770006630b3a7e43c7e4c90ce6a20fac946584d406aa1cc75103f746d1f026456e44c9a39c62eecdb8bb82ca275e24c5c9095cbc8a6701a2447f9f6e6e4a372717366f176f0e4df46e9e28ede8a00e2a8"], 0x3}}, 0x0) 10:39:37 executing program 0: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x50000}]}) r0 = open(0x0, 0x0, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, 0x0, 0x0) 10:39:38 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(0xffffffffffffffff, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:39:38 executing program 5: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000480), 0x10000000000002a1, 0x0) 10:39:40 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:39:40 executing program 2: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000480), 0x10000000000002a1, 0x0) socket(0x10, 0x803, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000600)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001280)=ANY=[@ANYBLOB="34000000100001040000", @ANYRES32, @ANYBLOB="0000000000000000140012000c00010062726964676500000300020092ab29e6bc90313f5c14a8d5d4534e466f18e765b4fd2a0e0ffabd5f884b8215627962f7a4aab6691329692afb3fdcc3e7378871f430fe0e63a139f8432b7c88d952fec2b4b054306391450600000008917ef4c83982304f91f231dc1ecf62c4bf0541ff2b5060b6a4d69b9403c96422fd8632e43e946636599dedd725bcd83c8971198e43a29e4b1c15388e01dee5bf7c4e128ff5b5c146c15db0684e76186c1d4209d8b4158f7b359d8efa69231277e09c47884e9fb0b010687409fc6fa73c91c9504b4460a91a865e0897f10dc1c1e0edc0d560f18478d67cc5cf8dbb0ee5003f6cc7185e99bc93bcb9eb76abba12076a8d076c853092edf73f4224c4e770006630b3a7e43c7e4c90ce6a20fac946584d406aa1cc75103f746d1f026456e44c9a39c62eecdb8bb82ca275e24c5c9095cbc8a6701a2447f9f6e6e4a372717366f176f0e4df46e9e28ede8a00e2a8"], 0x3}}, 0x0) 10:39:40 executing program 0: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x50000}]}) r0 = open(0x0, 0x0, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, 0x0, 0x0) 10:39:40 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(0xffffffffffffffff, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c54827af1f35d0500143160fc7397e6d939dd", 0x48, 0x400c081, 0x0, 0x0) 10:39:40 executing program 5: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000480), 0x10000000000002a1, 0x0) 10:39:40 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)) r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:39:41 executing program 5: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000480), 0x10000000000002a1, 0x0) 10:39:41 executing program 2: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000480), 0x10000000000002a1, 0x0) socket(0x10, 0x803, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000600)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001280)=ANY=[@ANYBLOB="34000000100001040000", @ANYRES32, @ANYBLOB="0000000000000000140012000c00010062726964676500000300020092ab29e6bc90313f5c14a8d5d4534e466f18e765b4fd2a0e0ffabd5f884b8215627962f7a4aab6691329692afb3fdcc3e7378871f430fe0e63a139f8432b7c88d952fec2b4b054306391450600000008917ef4c83982304f91f231dc1ecf62c4bf0541ff2b5060b6a4d69b9403c96422fd8632e43e946636599dedd725bcd83c8971198e43a29e4b1c15388e01dee5bf7c4e128ff5b5c146c15db0684e76186c1d4209d8b4158f7b359d8efa69231277e09c47884e9fb0b010687409fc6fa73c91c9504b4460a91a865e0897f10dc1c1e0edc0d560f18478d67cc5cf8dbb0ee5003f6cc7185e99bc93bcb9eb76abba12076a8d076c853092edf73f4224c4e770006630b3a7e43c7e4c90ce6a20fac946584d406aa1cc75103f746d1f026456e44c9a39c62eecdb8bb82ca275e24c5c9095cbc8a6701a2447f9f6e6e4a372717366f176f0e4df46e9e28ede8a00e2a8"], 0x3}}, 0x0) 10:39:41 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, 0x0, 0x0, 0x400c081, 0x0, 0x0) 10:39:41 executing program 0: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000240)={0x1, &(0x7f00000001c0)=[{0x6, 0x0, 0x0, 0x50000}]}) r0 = openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0) fsetxattr$system_posix_acl(r0, 0x0, 0x0, 0x0, 0x0) 10:39:41 executing program 2: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) socket(0x10, 0x803, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000600)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001280)=ANY=[@ANYBLOB="34000000100001040000", @ANYRES32, @ANYBLOB="0000000000000000140012000c00010062726964676500000300020092ab29e6bc90313f5c14a8d5d4534e466f18e765b4fd2a0e0ffabd5f884b8215627962f7a4aab6691329692afb3fdcc3e7378871f430fe0e63a139f8432b7c88d952fec2b4b054306391450600000008917ef4c83982304f91f231dc1ecf62c4bf0541ff2b5060b6a4d69b9403c96422fd8632e43e946636599dedd725bcd83c8971198e43a29e4b1c15388e01dee5bf7c4e128ff5b5c146c15db0684e76186c1d4209d8b4158f7b359d8efa69231277e09c47884e9fb0b010687409fc6fa73c91c9504b4460a91a865e0897f10dc1c1e0edc0d560f18478d67cc5cf8dbb0ee5003f6cc7185e99bc93bcb9eb76abba12076a8d076c853092edf73f4224c4e770006630b3a7e43c7e4c90ce6a20fac946584d406aa1cc75103f746d1f026456e44c9a39c62eecdb8bb82ca275e24c5c9095cbc8a6701a2447f9f6e6e4a372717366f176f0e4df46e9e28ede8a00e2a8"], 0x3}}, 0x0) 10:39:41 executing program 5: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 10:39:43 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:39:43 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, 0x0, 0x0, 0x400c081, 0x0, 0x0) 10:39:43 executing program 5: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 10:39:43 executing program 0: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000240)={0x1, &(0x7f00000001c0)=[{0x6, 0x0, 0x0, 0x50000}]}) r0 = openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0) fsetxattr$system_posix_acl(r0, 0x0, 0x0, 0x0, 0x0) 10:39:43 executing program 2: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) socket(0x10, 0x803, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000600)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001280)=ANY=[@ANYBLOB="34000000100001040000", @ANYRES32, @ANYBLOB="0000000000000000140012000c00010062726964676500000300020092ab29e6bc90313f5c14a8d5d4534e466f18e765b4fd2a0e0ffabd5f884b8215627962f7a4aab6691329692afb3fdcc3e7378871f430fe0e63a139f8432b7c88d952fec2b4b054306391450600000008917ef4c83982304f91f231dc1ecf62c4bf0541ff2b5060b6a4d69b9403c96422fd8632e43e946636599dedd725bcd83c8971198e43a29e4b1c15388e01dee5bf7c4e128ff5b5c146c15db0684e76186c1d4209d8b4158f7b359d8efa69231277e09c47884e9fb0b010687409fc6fa73c91c9504b4460a91a865e0897f10dc1c1e0edc0d560f18478d67cc5cf8dbb0ee5003f6cc7185e99bc93bcb9eb76abba12076a8d076c853092edf73f4224c4e770006630b3a7e43c7e4c90ce6a20fac946584d406aa1cc75103f746d1f026456e44c9a39c62eecdb8bb82ca275e24c5c9095cbc8a6701a2447f9f6e6e4a372717366f176f0e4df46e9e28ede8a00e2a8"], 0x3}}, 0x0) 10:39:43 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:39:44 executing program 5: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 10:39:44 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, 0x0, 0x0, 0x400c081, 0x0, 0x0) 10:39:44 executing program 2: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) socket(0x10, 0x803, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000600)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001280)=ANY=[@ANYBLOB="34000000100001040000", @ANYRES32, @ANYBLOB="0000000000000000140012000c00010062726964676500000300020092ab29e6bc90313f5c14a8d5d4534e466f18e765b4fd2a0e0ffabd5f884b8215627962f7a4aab6691329692afb3fdcc3e7378871f430fe0e63a139f8432b7c88d952fec2b4b054306391450600000008917ef4c83982304f91f231dc1ecf62c4bf0541ff2b5060b6a4d69b9403c96422fd8632e43e946636599dedd725bcd83c8971198e43a29e4b1c15388e01dee5bf7c4e128ff5b5c146c15db0684e76186c1d4209d8b4158f7b359d8efa69231277e09c47884e9fb0b010687409fc6fa73c91c9504b4460a91a865e0897f10dc1c1e0edc0d560f18478d67cc5cf8dbb0ee5003f6cc7185e99bc93bcb9eb76abba12076a8d076c853092edf73f4224c4e770006630b3a7e43c7e4c90ce6a20fac946584d406aa1cc75103f746d1f026456e44c9a39c62eecdb8bb82ca275e24c5c9095cbc8a6701a2447f9f6e6e4a372717366f176f0e4df46e9e28ede8a00e2a8"], 0x3}}, 0x0) 10:39:44 executing program 0: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000240)={0x1, &(0x7f00000001c0)=[{0x6, 0x0, 0x0, 0x50000}]}) r0 = openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x6000) 10:39:44 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 10:39:44 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240), 0x0, 0x400c081, 0x0, 0x0) 10:39:47 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:39:47 executing program 2: recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) socket(0x10, 0x803, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000600)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001280)=ANY=[@ANYBLOB="34000000100001040000", @ANYRES32, @ANYBLOB="0000000000000000140012000c00010062726964676500000300020092ab29e6bc90313f5c14a8d5d4534e466f18e765b4fd2a0e0ffabd5f884b8215627962f7a4aab6691329692afb3fdcc3e7378871f430fe0e63a139f8432b7c88d952fec2b4b054306391450600000008917ef4c83982304f91f231dc1ecf62c4bf0541ff2b5060b6a4d69b9403c96422fd8632e43e946636599dedd725bcd83c8971198e43a29e4b1c15388e01dee5bf7c4e128ff5b5c146c15db0684e76186c1d4209d8b4158f7b359d8efa69231277e09c47884e9fb0b010687409fc6fa73c91c9504b4460a91a865e0897f10dc1c1e0edc0d560f18478d67cc5cf8dbb0ee5003f6cc7185e99bc93bcb9eb76abba12076a8d076c853092edf73f4224c4e770006630b3a7e43c7e4c90ce6a20fac946584d406aa1cc75103f746d1f026456e44c9a39c62eecdb8bb82ca275e24c5c9095cbc8a6701a2447f9f6e6e4a372717366f176f0e4df46e9e28ede8a00e2a8"], 0x3}}, 0x0) 10:39:47 executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) socket$inet6(0xa, 0x2, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) write(r2, &(0x7f0000000340), 0x41395527) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) accept(0xffffffffffffffff, &(0x7f0000000100)=@pppoe={0x18, 0x0, {0x0, @dev}}, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'eql\x00\x00\x04\x00\x00\x00\x03\x00\x00\x00\xf2\a\x00', 0x2}) creat(&(0x7f0000000100)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000080)) r4 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r4, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r4, 0x400c6615, &(0x7f0000000200)) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000940)='fuse\x00', 0x0, &(0x7f0000000140)={{'fd', 0x3d, r5}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) 10:39:47 executing program 5: recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 10:39:47 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240), 0x0, 0x400c081, 0x0, 0x0) 10:39:47 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:39:47 executing program 5: recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 10:39:47 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240), 0x0, 0x400c081, 0x0, 0x0) 10:39:47 executing program 2: recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) socket(0x10, 0x803, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000600)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001280)=ANY=[@ANYBLOB="34000000100001040000", @ANYRES32, @ANYBLOB="0000000000000000140012000c00010062726964676500000300020092ab29e6bc90313f5c14a8d5d4534e466f18e765b4fd2a0e0ffabd5f884b8215627962f7a4aab6691329692afb3fdcc3e7378871f430fe0e63a139f8432b7c88d952fec2b4b054306391450600000008917ef4c83982304f91f231dc1ecf62c4bf0541ff2b5060b6a4d69b9403c96422fd8632e43e946636599dedd725bcd83c8971198e43a29e4b1c15388e01dee5bf7c4e128ff5b5c146c15db0684e76186c1d4209d8b4158f7b359d8efa69231277e09c47884e9fb0b010687409fc6fa73c91c9504b4460a91a865e0897f10dc1c1e0edc0d560f18478d67cc5cf8dbb0ee5003f6cc7185e99bc93bcb9eb76abba12076a8d076c853092edf73f4224c4e770006630b3a7e43c7e4c90ce6a20fac946584d406aa1cc75103f746d1f026456e44c9a39c62eecdb8bb82ca275e24c5c9095cbc8a6701a2447f9f6e6e4a372717366f176f0e4df46e9e28ede8a00e2a8"], 0x3}}, 0x0) 10:39:47 executing program 5: recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 10:39:47 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8", 0x24, 0x400c081, 0x0, 0x0) 10:39:48 executing program 2: recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) socket(0x10, 0x803, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000600)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001280)=ANY=[@ANYBLOB="34000000100001040000", @ANYRES32, @ANYBLOB="0000000000000000140012000c00010062726964676500000300020092ab29e6bc90313f5c14a8d5d4534e466f18e765b4fd2a0e0ffabd5f884b8215627962f7a4aab6691329692afb3fdcc3e7378871f430fe0e63a139f8432b7c88d952fec2b4b054306391450600000008917ef4c83982304f91f231dc1ecf62c4bf0541ff2b5060b6a4d69b9403c96422fd8632e43e946636599dedd725bcd83c8971198e43a29e4b1c15388e01dee5bf7c4e128ff5b5c146c15db0684e76186c1d4209d8b4158f7b359d8efa69231277e09c47884e9fb0b010687409fc6fa73c91c9504b4460a91a865e0897f10dc1c1e0edc0d560f18478d67cc5cf8dbb0ee5003f6cc7185e99bc93bcb9eb76abba12076a8d076c853092edf73f4224c4e770006630b3a7e43c7e4c90ce6a20fac946584d406aa1cc75103f746d1f026456e44c9a39c62eecdb8bb82ca275e24c5c9095cbc8a6701a2447f9f6e6e4a372717366f176f0e4df46e9e28ede8a00e2a8"], 0x3}}, 0x0) 10:39:50 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{0x0}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:39:50 executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) socket$inet6(0xa, 0x2, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) write(r2, &(0x7f0000000340), 0x41395527) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) accept(0xffffffffffffffff, &(0x7f0000000100)=@pppoe={0x18, 0x0, {0x0, @dev}}, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'eql\x00\x00\x04\x00\x00\x00\x03\x00\x00\x00\xf2\a\x00', 0x2}) creat(&(0x7f0000000100)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000080)) r4 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r4, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r4, 0x400c6615, &(0x7f0000000200)) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000940)='fuse\x00', 0x0, &(0x7f0000000140)={{'fd', 0x3d, r5}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) 10:39:50 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000001c80), 0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 10:39:50 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8", 0x24, 0x400c081, 0x0, 0x0) 10:39:50 executing program 2: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) socket(0x10, 0x803, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000600)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001280)=ANY=[@ANYBLOB="34000000100001040000", @ANYRES32, @ANYBLOB="0000000000000000140012000c00010062726964676500000300020092ab29e6bc90313f5c14a8d5d4534e466f18e765b4fd2a0e0ffabd5f884b8215627962f7a4aab6691329692afb3fdcc3e7378871f430fe0e63a139f8432b7c88d952fec2b4b054306391450600000008917ef4c83982304f91f231dc1ecf62c4bf0541ff2b5060b6a4d69b9403c96422fd8632e43e946636599dedd725bcd83c8971198e43a29e4b1c15388e01dee5bf7c4e128ff5b5c146c15db0684e76186c1d4209d8b4158f7b359d8efa69231277e09c47884e9fb0b010687409fc6fa73c91c9504b4460a91a865e0897f10dc1c1e0edc0d560f18478d67cc5cf8dbb0ee5003f6cc7185e99bc93bcb9eb76abba12076a8d076c853092edf73f4224c4e770006630b3a7e43c7e4c90ce6a20fac946584d406aa1cc75103f746d1f026456e44c9a39c62eecdb8bb82ca275e24c5c9095cbc8a6701a2447f9f6e6e4a372717366f176f0e4df46e9e28ede8a00e2a8"], 0x3}}, 0x0) 10:39:50 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:39:50 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8", 0x24, 0x400c081, 0x0, 0x0) 10:39:50 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000001c80), 0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 10:39:50 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) socket(0x10, 0x803, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000600)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001280)=ANY=[@ANYBLOB="34000000100001040000", @ANYRES32, @ANYBLOB="0000000000000000140012000c00010062726964676500000300020092ab29e6bc90313f5c14a8d5d4534e466f18e765b4fd2a0e0ffabd5f884b8215627962f7a4aab6691329692afb3fdcc3e7378871f430fe0e63a139f8432b7c88d952fec2b4b054306391450600000008917ef4c83982304f91f231dc1ecf62c4bf0541ff2b5060b6a4d69b9403c96422fd8632e43e946636599dedd725bcd83c8971198e43a29e4b1c15388e01dee5bf7c4e128ff5b5c146c15db0684e76186c1d4209d8b4158f7b359d8efa69231277e09c47884e9fb0b010687409fc6fa73c91c9504b4460a91a865e0897f10dc1c1e0edc0d560f18478d67cc5cf8dbb0ee5003f6cc7185e99bc93bcb9eb76abba12076a8d076c853092edf73f4224c4e770006630b3a7e43c7e4c90ce6a20fac946584d406aa1cc75103f746d1f026456e44c9a39c62eecdb8bb82ca275e24c5c9095cbc8a6701a2447f9f6e6e4a372717366f176f0e4df46e9e28ede8a00e2a8"], 0x3}}, 0x0) 10:39:50 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c", 0x36, 0x400c081, 0x0, 0x0) 10:39:51 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000001c80), 0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 10:39:51 executing program 0: r0 = socket$kcm(0x29, 0x1000000000002, 0x0) setsockopt$kcm_KCM_RECV_DISABLE(r0, 0x119, 0x1, &(0x7f0000000240)=0xcef, 0x4) 10:39:53 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r1, &(0x7f0000000400)=""/169, 0xa9) getdents64(r1, &(0x7f0000000080)=""/167, 0xa7) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{0x0}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0, 0xffffffffffffffa4}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 10:39:53 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) socket(0x10, 0x803, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000600)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001280)=ANY=[@ANYBLOB="34000000100001040000", @ANYRES32, @ANYBLOB="0000000000000000140012000c00010062726964676500000300020092ab29e6bc90313f5c14a8d5d4534e466f18e765b4fd2a0e0ffabd5f884b8215627962f7a4aab6691329692afb3fdcc3e7378871f430fe0e63a139f8432b7c88d952fec2b4b054306391450600000008917ef4c83982304f91f231dc1ecf62c4bf0541ff2b5060b6a4d69b9403c96422fd8632e43e946636599dedd725bcd83c8971198e43a29e4b1c15388e01dee5bf7c4e128ff5b5c146c15db0684e76186c1d4209d8b4158f7b359d8efa69231277e09c47884e9fb0b010687409fc6fa73c91c9504b4460a91a865e0897f10dc1c1e0edc0d560f18478d67cc5cf8dbb0ee5003f6cc7185e99bc93bcb9eb76abba12076a8d076c853092edf73f4224c4e770006630b3a7e43c7e4c90ce6a20fac946584d406aa1cc75103f746d1f026456e44c9a39c62eecdb8bb82ca275e24c5c9095cbc8a6701a2447f9f6e6e4a372717366f176f0e4df46e9e28ede8a00e2a8"], 0x3}}, 0x0) 10:39:53 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c", 0x36, 0x400c081, 0x0, 0x0) 10:39:53 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000001c80)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 10:39:53 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000140)='xfs\x00', &(0x7f0000000200)='./file0\x00', 0xffffffff, 0x1, &(0x7f0000000100)=[{&(0x7f0000000040)="58465342000010000000000000ffffffff000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80020000000000000000000000004aa4911300f9ffffffff8000000000000000821c000001000010000000000100000000000006cb8519a9", 0x67}], 0x0, 0x0) 10:39:53 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000048000), 0x0) 10:39:53 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000240)="76fd0ba8a34e00000000009801dc4953d4d37807e705ebe1d64024b2ad6616a7b8a155f8d83f8c3c8d2d418f72fa4811a6d1bc46a84c", 0x36, 0x400c081, 0x0, 0x0) [ 693.220187][T32239] BUG: unable to handle page fault for address: fffff52002d00000 [ 693.227973][T32239] #PF: supervisor read access in kernel mode [ 693.233958][T32239] #PF: error_code(0x0000) - not-present page [ 693.239942][T32239] PGD 21ffee067 P4D 21ffee067 PUD aa51c067 PMD 5abbc067 PTE 0 [ 693.247423][T32239] Oops: 0000 [#1] PREEMPT SMP KASAN [ 693.252632][T32239] CPU: 1 PID: 32239 Comm: syz-executor.0 Not tainted 5.5.0-rc1-syzkaller #0 [ 693.261327][T32239] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 693.271510][T32239] RIP: 0010:xfs_sb_read_verify+0xf0/0x540 [ 693.277247][T32239] Code: fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 18 04 00 00 4d 8b ac 24 30 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 ea 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e a7 03 00 00 41 8b 75 00 bf 58 [ 693.296862][T32239] RSP: 0018:ffffc900029c7918 EFLAGS: 00010a06 [ 693.302939][T32239] RAX: dffffc0000000000 RBX: 1ffff92000538f26 RCX: ffffc90001e99000 [ 693.310923][T32239] RDX: 1ffff92002d00000 RSI: ffffffff82a9f88b RDI: ffff8880a3371a60 [ 693.318905][T32239] RBP: ffffc900029c7af8 R08: ffff8880a03f6580 R09: ffffed1015d2703d [ 693.322876][ T4088] kobject: 'loop3' (0000000014262242): kobject_uevent_env [ 693.326909][T32239] R10: ffffed1015d2703c R11: ffff8880ae9381e3 R12: ffff8880a3371940 [ 693.326918][T32239] R13: ffffc90016800000 R14: ffffc900029c7ad0 R15: ffff888056e98000 [ 693.326930][T32239] FS: 00007f1f6d633700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 [ 693.326938][T32239] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 693.326946][T32239] CR2: fffff52002d00000 CR3: 00000000a8938000 CR4: 00000000001426e0 [ 693.326957][T32239] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 693.326965][T32239] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 693.326971][T32239] Call Trace: [ 693.327079][T32239] ? blk_insert_cloned_request+0x530/0x530 [ 693.327097][T32239] ? xfs_sb_write_verify+0x470/0x470 [ 693.327111][T32239] ? __bio_add_page+0x550/0x550 [ 693.327154][T32239] ? __kasan_check_read+0x11/0x20 [ 693.327167][T32239] ? blk_finish_plug+0x8f/0xa2 [ 693.327200][T32239] ? _xfs_buf_ioapply+0xa35/0x10f0 [ 693.327242][T32239] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 693.327258][T32239] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 693.327271][T32239] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 693.327287][T32239] xfs_buf_ioend+0x3f9/0xde0 [ 693.327302][T32239] __xfs_buf_submit+0x391/0xe70 [ 693.327347][T32239] ? _raw_spin_unlock_irqrestore+0x9f/0xe0 [ 693.327361][T32239] xfs_buf_read_uncached+0x164/0x550 [ 693.327381][T32239] xfs_readsb+0x2c6/0x530 [ 693.327397][T32239] ? xfs_initialize_perag+0x560/0x560 [ 693.327417][T32239] ? _raw_spin_unlock_irqrestore+0x9f/0xe0 [ 693.350756][ T4088] kobject: 'loop3' (0000000014262242): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 693.359411][T32239] xfs_fc_fill_super+0x3e7/0x11c0 [ 693.359523][T32239] get_tree_bdev+0x414/0x650 [ 693.359563][T32239] ? xfs_mount_free+0x80/0x80 [ 693.359578][T32239] xfs_fc_get_tree+0x1d/0x30 [ 693.359592][T32239] vfs_get_tree+0x8e/0x300 [ 693.359645][T32239] do_mount+0x135a/0x1b50 [ 693.359663][T32239] ? retint_kernel+0x2b/0x2b [ 693.359679][T32239] ? copy_mount_string+0x40/0x40 [ 693.359694][T32239] ? copy_mount_options+0x200/0x3f0 [ 693.359732][T32239] ? __sanitizer_cov_trace_pc+0x3b/0x50 [ 693.359748][T32239] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 693.359761][T32239] ? copy_mount_options+0x2e8/0x3f0 [ 693.359777][T32239] ksys_mount+0xdb/0x150 [ 693.359791][T32239] __x64_sys_mount+0xbe/0x150 [ 693.359835][T32239] do_syscall_64+0xfa/0x790 [ 693.359852][T32239] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 693.359864][T32239] RIP: 0033:0x45d29a [ 693.359879][T32239] Code: b8 a6 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 4d 8c fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 2a 8c fb ff c3 66 0f 1f 84 00 00 00 00 00 [ 693.359884][T32239] RSP: 002b:00007f1f6d632a68 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 [ 693.359895][T32239] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 000000000045d29a [ 693.359901][T32239] RDX: 00007f1f6d632ae0 RSI: 0000000020000200 RDI: 00007f1f6d632b00 [ 693.359907][T32239] RBP: 000000000075bf20 R08: 00007f1f6d632b40 R09: 00007f1f6d632ae0 [ 693.359912][T32239] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f1f6d6336d4 [ 693.359918][T32239] R13: 00000000004cadd4 R14: 00000000004e4310 R15: 00000000ffffffff [ 693.359926][T32239] Modules linked in: [ 693.359937][T32239] CR2: fffff52002d00000 [ 693.359957][T32239] ---[ end trace 79553cdc19586666 ]--- [ 693.359975][T32239] RIP: 0010:xfs_sb_read_verify+0xf0/0x540 [ 693.359988][T32239] Code: fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 18 04 00 00 4d 8b ac 24 30 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 ea 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e a7 03 00 00 41 8b 75 00 bf 58 [ 693.359995][T32239] RSP: 0018:ffffc900029c7918 EFLAGS: 00010a06 [ 693.360007][T32239] RAX: dffffc0000000000 RBX: 1ffff92000538f26 RCX: ffffc90001e99000 [ 693.360015][T32239] RDX: 1ffff92002d00000 RSI: ffffffff82a9f88b RDI: ffff8880a3371a60 [ 693.360024][T32239] RBP: ffffc900029c7af8 R08: ffff8880a03f6580 R09: ffffed1015d2703d [ 693.360032][T32239] R10: ffffed1015d2703c R11: ffff8880ae9381e3 R12: ffff8880a3371940 [ 693.360040][T32239] R13: ffffc90016800000 R14: ffffc900029c7ad0 R15: ffff888056e98000 [ 693.360058][T32239] FS: 00007f1f6d633700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 [ 693.360066][T32239] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 693.360074][T32239] CR2: fffff52002d00000 CR3: 00000000a8938000 CR4: 00000000001426e0 [ 693.360085][T32239] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 693.360092][T32239] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 693.360099][T32239] Kernel panic - not syncing: Fatal exception [ 693.361276][T32239] Kernel Offset: disabled [ 693.775374][T32239] Rebooting in 86400 seconds..