Warning: Permanently added '10.128.1.92' (ECDSA) to the list of known hosts. 2021/10/20 14:37:55 fuzzer started 2021/10/20 14:37:56 dialing manager at 10.128.0.163:46135 [ 21.174117][ T22] audit: type=1400 audit(1634740677.689:73): avc: denied { mounton } for pid=303 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=1136 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.184670][ T303] cgroup1: Unknown subsys name 'net' [ 21.196720][ T22] audit: type=1400 audit(1634740677.709:74): avc: denied { mount } for pid=303 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.202331][ T303] cgroup1: Unknown subsys name 'net_prio' [ 21.230530][ T303] cgroup1: Unknown subsys name 'devices' [ 21.236372][ T303] cgroup1: Unknown subsys name 'blkio' [ 21.242598][ T22] audit: type=1400 audit(1634740677.759:75): avc: denied { unmount } for pid=303 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.412576][ T303] cgroup1: Unknown subsys name 'hugetlb' [ 21.418494][ T303] cgroup1: Unknown subsys name 'rlimit' 2021/10/20 14:37:58 syscalls: 200 2021/10/20 14:37:58 code coverage: enabled 2021/10/20 14:37:58 comparison tracing: enabled 2021/10/20 14:37:58 extra coverage: enabled 2021/10/20 14:37:58 setuid sandbox: enabled 2021/10/20 14:37:58 namespace sandbox: enabled 2021/10/20 14:37:58 Android sandbox: enabled 2021/10/20 14:37:58 fault injection: enabled 2021/10/20 14:37:58 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2021/10/20 14:37:58 net packet injection: enabled 2021/10/20 14:37:58 net device setup: enabled 2021/10/20 14:37:58 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2021/10/20 14:37:58 devlink PCI setup: PCI device 0000:00:10.0 is not available 2021/10/20 14:37:58 USB emulation: enabled 2021/10/20 14:37:58 hci packet injection: /dev/vhci does not exist 2021/10/20 14:37:58 wifi device emulation: /sys/class/mac80211_hwsim/ does not exist 2021/10/20 14:37:58 802.15.4 emulation: /sys/bus/platform/devices/mac802154_hwsim does not exist 2021/10/20 14:37:58 fetching corpus: 0, signal 0/0 (executing program) [ 21.512118][ T22] audit: type=1400 audit(1634740678.029:76): avc: denied { mounton } for pid=303 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 21.537008][ T22] audit: type=1400 audit(1634740678.029:77): avc: denied { mount } for pid=303 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 21.560393][ T22] audit: type=1400 audit(1634740678.029:78): avc: denied { setattr } for pid=303 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=913 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 2021/10/20 14:37:58 starting 6 fuzzer processes 14:37:58 executing program 0: clock_getres(0x4, &(0x7f0000000000)) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$UI_SET_SWBIT(r0, 0x4004556d, 0x0) clock_gettime(0x4, &(0x7f0000000080)) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) setsockopt$bt_hci_HCI_DATA_DIR(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000000c0)=0x81, 0x4) clock_getres(0x6, &(0x7f0000000100)) write$uinput_user_dev(r0, &(0x7f0000000140)={'syz1\x00', {0x800, 0x19, 0x100, 0x6}, 0xf, [0x5, 0xfffff800, 0xe, 0x8, 0x9, 0x1, 0x40, 0xff, 0x0, 0x1, 0xa87, 0xfffffffb, 0x8, 0x9, 0x7, 0x1, 0x1, 0x80000000, 0xfffffffe, 0x4, 0x3b, 0x7ff, 0x1, 0x5, 0xffffffff, 0x0, 0x7, 0x4, 0x7d0, 0x3b, 0x1ff, 0xffff, 0x5f0b, 0x7, 0xfffff000, 0x1, 0xa5, 0x6, 0x6, 0x10001, 0x2, 0xffffffff, 0xfc91, 0x0, 0x6, 0xfffffff8, 0xdca7, 0x2, 0xc0d, 0x80000000, 0x6, 0xffffffff, 0x0, 0x401, 0x3, 0x7, 0x2, 0x0, 0xfffffffc, 0x7ff, 0x7, 0x6, 0xf0a5, 0x81], [0x1c, 0x4, 0x1, 0xa86e, 0x8001, 0x100, 0x3, 0x5, 0x1, 0x6, 0x3568, 0x0, 0x9, 0x6, 0x7fffffff, 0x6f, 0x103, 0x4, 0xffa, 0x4, 0x0, 0x81, 0x2, 0x81f, 0x75ad, 0x4, 0x1873, 0x72e, 0x1, 0xd1, 0x6, 0x0, 0x83, 0x9, 0xc5e, 0x10000, 0x0, 0x1, 0x6, 0x9de, 0x3ff, 0x7f, 0x7, 0x8000, 0xf4c, 0x0, 0x8, 0x3f, 0x1, 0x80000001, 0xffffffff, 0xfffffffb, 0x6, 0x4d1, 0x6, 0x4, 0x5, 0xff, 0x1, 0x9, 0x6, 0x3, 0xffffffff, 0x3], [0xcd, 0x3, 0xf, 0x80000000, 0x5, 0x7, 0x1, 0x7, 0x80000000, 0x0, 0x4, 0x4, 0x7, 0x1, 0x1, 0x0, 0x8, 0x1, 0x855, 0x5, 0x75ae, 0x4411, 0x8, 0xffff, 0x200, 0x7, 0xc4, 0x11fedc7, 0xffff, 0x101, 0xffffffff, 0x7fff, 0x0, 0xffffffff, 0xf30, 0x7, 0x6, 0x2, 0x3f, 0x40000000, 0x23, 0x0, 0x21, 0x1, 0x5, 0x6, 0x401, 0x53f, 0x1, 0x10000, 0x800, 0x2, 0x0, 0x800, 0x7, 0x0, 0x7, 0x1, 0x3, 0x50000000, 0x10000, 0xffffffff, 0x2, 0x3], [0x4, 0x0, 0xffff, 0xc82d, 0xe02, 0x80000000, 0x2, 0xff, 0x5, 0x4, 0x5a, 0x80000000, 0x1ff, 0x4, 0x2, 0x89, 0x5, 0x4, 0x81, 0x5, 0xfffffeff, 0x9, 0x0, 0xb8e, 0x79ed, 0x4, 0x4, 0x1ff, 0x0, 0xde, 0x80, 0x3, 0x4, 0x5, 0x10001, 0x3f, 0x8001, 0x2, 0xdf56, 0xffff, 0x4, 0x52, 0x6, 0x7ff, 0x80000001, 0x4, 0x5, 0x8, 0x1, 0x31f24a7, 0x5, 0x1ff, 0x4f, 0x3, 0x100, 0x80000001, 0xfff, 0xd9f, 0x6f, 0x7, 0x1, 0x1, 0x9, 0x227d]}, 0x45c) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT(0xffffffffffffffff, 0x28, 0x6, &(0x7f00000005c0)={0x77359400}, 0x10) capset(&(0x7f0000000600)={0xf1504}, &(0x7f0000000640)={0x0, 0x1, 0x20, 0x20, 0x3, 0xffffffff}) select(0x40, &(0x7f0000000680)={0x5, 0x9, 0xf84, 0xfffffffffffffffc, 0x1ff, 0xded, 0xb1, 0x2}, &(0x7f00000006c0)={0xe0000000000000, 0x4, 0x3, 0x7, 0x49b5, 0x7, 0xffffffff00000000, 0x6}, &(0x7f0000000700)={0xfffffffffffffffd, 0x100000001, 0x5, 0xcdb, 0x3ff, 0x81, 0x81, 0x7c0}, &(0x7f0000000740)={0x0, 0xea60}) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000780), 0x802, 0x0) write$uinput_user_dev(r1, &(0x7f00000007c0)={'syz1\x00', {0x2, 0x9a, 0x9, 0x8}, 0x14, [0x8000, 0x52, 0x8, 0x8, 0x7, 0xfff, 0x1, 0x7fffffff, 0x10001, 0x10001, 0x4, 0x2, 0x10000, 0x1000, 0x8, 0x0, 0x1, 0x4, 0x10000, 0x6, 0x8e, 0xffffffff, 0x7, 0xd23, 0xfd67, 0x20000000, 0x800, 0x7, 0x10001, 0x8, 0x0, 0x2, 0x6, 0xfffffffa, 0x3f, 0x4, 0xfffffff8, 0x1f, 0x3, 0x418, 0x8, 0x1f, 0x101, 0x2a, 0x1f, 0x4, 0x80000000, 0x9, 0x2, 0x7, 0x0, 0x10000, 0x5, 0x8000, 0x3, 0x4, 0x63b, 0x0, 0x7fff, 0xdb33, 0xe6f4, 0x5, 0x7, 0x1000], [0x1, 0x40000000, 0x800, 0xfa9c, 0x3f6, 0xffffff35, 0x9, 0x7f, 0x6, 0x42, 0x6, 0x3, 0x8, 0xde, 0x0, 0x5, 0x7, 0x9, 0x4, 0x8, 0x80000001, 0x3, 0x1, 0x7, 0x3, 0x1, 0x64a4a95f, 0x7, 0x1000, 0x4, 0x101, 0x5, 0x80, 0x7fff, 0x7, 0x14, 0x1ff, 0xee, 0x0, 0x3, 0xffffffe1, 0x81, 0x7fff, 0x9, 0x6, 0x0, 0x401, 0x7, 0x3f, 0x9, 0x7fffffff, 0x1f, 0x3, 0x7, 0x9, 0x40, 0x30000, 0x4, 0x401, 0x8, 0x0, 0x7fff, 0x1ff, 0x20], [0x1f, 0x5, 0x7, 0x4036, 0x2, 0xfffffff9, 0x7, 0x45, 0x7fffffff, 0x6, 0x9, 0x8, 0x1, 0x7ff, 0x8, 0xfffffff8, 0x2ffac02c, 0x80, 0x100, 0xff, 0x800, 0x3, 0x9, 0x3, 0xffffffff, 0x2, 0x3, 0x0, 0x2ff, 0x5, 0x7f, 0x20, 0x3, 0x2, 0x6, 0xbd3b, 0x2, 0xfffffffb, 0x7f, 0x7, 0x8000, 0x5, 0xfffffffe, 0x8000, 0x3, 0x8, 0x5c, 0x40, 0x8, 0x200, 0x8, 0x8000, 0xe7b, 0x80000000, 0x9, 0x7ff, 0xfffffffa, 0x1, 0xf418, 0x100, 0x2722, 0x3, 0x7ff, 0xff], [0x1d47a776, 0x2, 0x6, 0x8, 0x7f, 0x3, 0x9, 0x1000, 0x40, 0x1ff, 0xfffffff7, 0x0, 0x6, 0x80, 0x90000, 0x11, 0x3, 0x3, 0x5, 0x1, 0x3ff, 0x100, 0x450, 0xffff8001, 0x400, 0x7, 0x8, 0x7, 0x2, 0x2, 0x20, 0x0, 0x9, 0x4, 0x800, 0xd7, 0x10001, 0x8, 0xfff, 0x1, 0x3, 0x7f, 0xd76b, 0xee, 0x5, 0x4, 0x2, 0x9, 0x8, 0x8, 0x2, 0x0, 0x9fc9, 0x9, 0x8, 0x2, 0x0, 0x0, 0xffff, 0x9, 0x95e1, 0x0, 0x0, 0x101]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x7) ioctl$UI_DEV_CREATE(r0, 0x5501) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000c40), 0x802, 0x0) ioctl$UI_GET_SYSNAME(r2, 0x8040552c, &(0x7f0000000c80)) futex(&(0x7f0000000cc0)=0x1, 0x0, 0x0, &(0x7f0000000d00), &(0x7f0000000d40)=0x2, 0x0) r3 = syz_open_dev$vcsa(&(0x7f0000000d80), 0x0, 0x10000) write$P9_RXATTRWALK(r3, &(0x7f0000000dc0)={0xf, 0x1f, 0x2, 0x8}, 0xf) 14:37:58 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) ioctl$UI_SET_KEYBIT(r0, 0x40045565, 0x54) prctl$PR_SET_SECUREBITS(0x1c, 0x8) sendmsg$NL80211_CMD_SET_PMKSA(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x4000015) prctl$PR_SET_SECUREBITS(0x1c, 0x20) r1 = syz_open_dev$vcsa(&(0x7f0000000100), 0x920, 0x240) ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1d6) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000140), 0x802, 0x0) ioctl$UI_SET_EVBIT(r2, 0x40045564, 0x1d) ioctl$UI_BEGIN_FF_UPLOAD(r2, 0xc06855c8, &(0x7f00000001c0)={0x5, 0x9, {0x54, 0xfff8, 0x62, {0x100, 0x9d2}, {0x7ff, 0x101}, @period={0x59, 0x2, 0x3, 0x5, 0x8, {0x4, 0x3f7, 0x9, 0x3d9b}, 0x8, &(0x7f0000000180)=[0xfbe0, 0x31a7, 0x6, 0x3, 0xa9c, 0x1, 0x6145, 0x7]}}, {0x54, 0x20, 0x6, {0x8000, 0x401}, {0x3, 0x3ff}, @ramp={0x2, 0x3e5c, {0x1, 0x4, 0x3, 0x1000}}}}) r3 = syz_open_dev$vcsa(&(0x7f0000000240), 0x6, 0x111000) ioctl$UI_SET_PHYS(r3, 0x4008556c, &(0x7f0000000280)='syz1\x00') r4 = openat$uinput(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) clock_gettime(0x0, &(0x7f0000000300)={0x0, 0x0}) write$input_event(r4, &(0x7f0000000340)={{r5, r6/1000+10000}, 0x1, 0xfff7}, 0x18) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r1) ioctl$UI_END_FF_ERASE(r4, 0x400c55cb, &(0x7f00000003c0)={0x5, 0x4, 0x1}) r7 = syz_open_pts(r1, 0x218040) ioctl$TIOCSETD(r7, 0x5423, &(0x7f0000000400)=0x16) ioctl$TIOCCBRK(0xffffffffffffffff, 0x5428) 14:37:58 executing program 1: clock_getres(0x7, &(0x7f0000000000)) pselect6(0x40, &(0x7f0000000040)={0x5, 0x7fffffff, 0x5, 0xb1, 0x10000, 0x7, 0x7, 0xe4ee}, &(0x7f0000000080)={0x1, 0x5, 0x283, 0x7e, 0x57dc, 0xffff, 0x363b2f21, 0x9}, &(0x7f00000000c0)={0x6, 0x8, 0x101, 0x1, 0x1f, 0xe68, 0x5, 0x9}, &(0x7f0000000100)={0x0, 0x989680}, &(0x7f0000000180)={&(0x7f0000000140)={[0x800]}, 0x8}) clock_gettime(0x0, &(0x7f0000000200)={0x0, 0x0}) futex(&(0x7f00000001c0), 0x4, 0x1, &(0x7f0000000240)={r0, r1+10000000}, &(0x7f0000000280)=0x2, 0x2) prctl$PR_GET_PDEATHSIG(0x2, &(0x7f00000002c0)) pselect6(0x40, &(0x7f0000000300)={0x7, 0x3, 0x2, 0x800, 0x4f7, 0x3, 0x3, 0x10001}, &(0x7f0000000340)={0x5, 0x2, 0x7ff, 0x40, 0xff, 0x2, 0x5, 0x4}, &(0x7f0000000380)={0x7, 0x0, 0x101, 0x662, 0x0, 0x5, 0x2, 0x7b4}, &(0x7f00000003c0)={0x0, 0x989680}, &(0x7f0000000440)={&(0x7f0000000400), 0x8}) ioctl$UI_SET_PROPBIT(0xffffffffffffffff, 0x4004556e, 0x15) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, &(0x7f0000000480)='syz1\x00') ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x6) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f00000004c0), 0x802, 0x0) ioctl$UI_SET_RELBIT(r2, 0x40045566, 0x7) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000500), 0x802, 0x0) ioctl$UI_SET_KEYBIT(r3, 0x40045565, 0x6c) ioctl$UI_SET_RELBIT(r2, 0x40045566, 0xa) sendmsg$NL80211_CMD_START_P2P_DEVICE(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x1c, 0x0, 0x20, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x8}, @void}}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4049000}, 0x20000000) r4 = syz_open_dev$vcsa(&(0x7f0000000640), 0x3, 0x400000) ioctl$UI_SET_ABSBIT(r4, 0x40045567, 0x5) clock_gettime(0x6, &(0x7f0000000680)) ioctl$UI_END_FF_UPLOAD(r4, 0x406855c9, &(0x7f0000000700)={0xd, 0x7, {0x54, 0x7ff, 0x1f, {0x80, 0x7}, {0x3, 0x7}, @cond=[{0x27ed, 0x401, 0x7, 0x2, 0x1000, 0x228}, {0x878c, 0xffe0, 0x9, 0xdc6a, 0x6, 0xff}]}, {0x53, 0xd3b, 0x800, {0xf7, 0x71a6}, {0x6, 0xf}, @period={0x5a, 0x1000, 0x5c, 0x5, 0x4d48, {0x3, 0x4, 0x8001, 0x1ff}, 0x9, &(0x7f00000006c0)=[0xfbff, 0x9, 0xbb0, 0xfff9, 0xe1a, 0x6509, 0x2e8f, 0xb01b, 0x6a0]}}}) ioctl$USBDEVFS_RESETEP(0xffffffffffffffff, 0x80045503, &(0x7f00000007c0)={0xf}) 14:37:58 executing program 4: r0 = socket(0x0, 0x1, 0x2) sendmsg$NL80211_CMD_GET_KEY(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x7c, 0x0, 0xc30, 0x70bd28, 0x25dfdbfb, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac05}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "b98e1c15b9504b03c1de98fdff"}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "a448a9969794224f53b27f76e3"}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac01}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "0c2e0e097645692b3641dbc8ff"}]}, 0x7c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10000) io_uring_setup(0x3d2a, &(0x7f0000000140)={0x0, 0xee28, 0x2, 0x2, 0xf5}) r1 = syz_open_dev$vcsa(&(0x7f00000001c0), 0x8, 0x402082) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEL_STATION(r1, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x54, 0x0, 0x800, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_STA_TX_POWER_SETTING={0x5, 0x113, 0x1}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x9d}, @NL80211_ATTR_STA_FLAGS2={0xc, 0x43, {0x7}}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_AIRTIME_WEIGHT={0x6, 0x112, 0x6}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x7012}]}, 0x54}, 0x1, 0x0, 0x0, 0x20000000}, 0x4040004) sendmsg$NL80211_CMD_GET_MPP(r1, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x44, 0x0, 0x2, 0x70bd25, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}]}, 0x44}, 0x1, 0x0, 0x0, 0x804}, 0x81) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r1, 0x40082102, &(0x7f00000004c0)) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000580)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_MCAST_RATE(r1, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x40, r3, 0x300, 0x70bd2d, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0x8, 0x61}}}}, [@NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x21c}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0xf0}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x78}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000010}, 0x1010) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f00000007c0)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000780)={&(0x7f00000006c0)={0xac, r3, 0x10, 0x70bd2a, 0x25dfdbfe, {{}, {@void, @void, @val={0xc, 0x99, {0x8000, 0x1a}}}}, [@NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @mon_options=[@NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "694edb82987efca9726b73dbad87aee9c82f5881a01e260e"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "3a6891e4f568a688f298dd323c27c3d5337f12d8da63e512"}, @NL80211_ATTR_MNTR_FLAGS={0x14, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}]}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "b402286e97edaf79b6a5ca4ad38ae0d1859405033784ba8b"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "d11a0cbf38e9334c37895f93e68d51c754bb1b6faa3e765f"}]]}, 0xac}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000000900)={0x3, 0x9, 0x1, 0x4195, 0xdd, 0x8, &(0x7f0000000800)="63f58ea60fe7dd9b64b9d78660f645dfa5779ae6a8b497cfb0441078497694e79203c3a069573f0c7b12c0d93febab8b1ba2ca2d951e0b9d8182d058ee8f22353bfecf2e666011b3851e9f916949e18a292547d2cca0da41625139c16d7c060634113556136ff3f94e70dde9f920a1a5b79567f27850358e5a704e657e7505912a6b687db7380cc01c4bda0e7303a5dfa4bc8abdfadcefbcd2ae5c09943c382692f48f967d7ceb6306166902ecbcabb032e0bed88c6b2f700aa406ec1f8175d6d80d0a1bac05373ced80901199b41b51aad80839106297d33b37df84b5"}) r5 = syz_open_dev$vcsa(&(0x7f0000000940), 0x10001, 0x880) sendmsg$NL80211_CMD_SET_REG(r5, &(0x7f0000000a40)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000a00)={&(0x7f00000009c0)={0x24, r3, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8, 0x1, 0x26}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x50}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x20008000) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a80), r0) r7 = syz_open_dev$usbfs(&(0x7f0000000ac0), 0x10000, 0x84000) ioctl$USBDEVFS_CONTROL(r7, 0xc0185500, &(0x7f0000000c00)={0x20, 0x15, 0x400, 0x8c, 0xcb, 0x3, &(0x7f0000000b00)="bb9f37e5f888ed7c5bf4bae605138e599a478480df77808c2c6b73862935705cf1d56bc20ba7a3c6ebcfc9fe0f61e1ccac9e5c9bcaeee7d7f6b5f1579f430ad4f0b632d92fcc3fc71110e0bba4a8b012d132b77360f379455122038ba8cc67f62f0e3e9656eb99b6f79ccc860088b670787669edbc0f4322ae1da014a737b224300f03272c230885ad11d2066a8418773d82c481dcca7c876c8bd177b06772978372fa95f02f2386b63e129010b4c945eb2c159084202ad1f67d49be3c72e91fc56d1e30a717e902cd42ba"}) sendmsg$NL80211_CMD_SET_PMKSA(r0, &(0x7f0000000d00)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r6, 0x4, 0x70bd26, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x2, 0x2d}}}}, [@NL80211_ATTR_PMK_LIFETIME={0x8, 0x11f, 0x7}, @NL80211_ATTR_PMK_REAUTH_THRESHOLD={0x5, 0x120, 0x50}]}, 0x30}, 0x1, 0x0, 0x0, 0x4010}, 0x20000800) sendmsg$NL80211_CMD_NEW_INTERFACE(r5, &(0x7f0000000ec0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000e80)={&(0x7f0000000d80)={0xc8, r3, 0x10, 0x70bd2b, 0x25dfdbfd, {{}, {@void, @void, @val={0xc, 0x99, {0x7fffffff, 0x5e}}}}, [@NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'caif0\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}, @NL80211_ATTR_MESH_ID={0xa}, @mon_options=[@NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MNTR_FLAGS={0x14, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}]}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "001ced75eb761e7c39dce96d8b6485ea2569a829bac7ed06"}, @NL80211_ATTR_MNTR_FLAGS={0x20, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}]}]]}, 0xc8}, 0x1, 0x0, 0x0, 0x4000080}, 0x10) 14:37:58 executing program 3: pselect6(0x40, &(0x7f0000000000)={0xe1, 0x1000, 0x5, 0x5, 0x400, 0xfffffffffffffffa, 0xffffffffffff0001, 0x8}, &(0x7f0000000040)={0x8, 0x100000001, 0x6ed0, 0x82, 0x401, 0x8, 0x3, 0x2}, &(0x7f0000000080)={0x1, 0x8000, 0x1, 0xffff, 0x6, 0x7fffffff, 0x4, 0xfffffffeffffffff}, &(0x7f00000000c0)={0x77359400}, &(0x7f0000000140)={&(0x7f0000000100)={[0x5]}, 0x8}) futex(&(0x7f0000000180)=0x1, 0x0, 0x2, &(0x7f00000001c0)={0x0, 0x989680}, &(0x7f0000000200)=0x1, 0x1) clock_getres(0x0, &(0x7f0000000240)) clock_gettime(0x0, &(0x7f0000000340)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000280)={0xffffffffffff8001, 0x8, 0x3, 0x8001, 0x1d, 0x5, 0x100000000, 0x6}, &(0x7f00000002c0)={0x10000, 0xf5, 0x9, 0x3, 0x3f, 0x10000, 0xafaa, 0xf0}, &(0x7f0000000300)={0x3f, 0x100000000, 0x9, 0xd7d9, 0xcffb, 0x854, 0x9, 0xffffffffffffffe0}, &(0x7f0000000380)={r0, r1+60000000}, &(0x7f0000000400)={&(0x7f00000003c0)={[0x80000000]}, 0x8}) clock_settime(0x4, &(0x7f0000000440)={0x77359400}) prctl$PR_SET_THP_DISABLE(0x29, 0x1) clock_getres(0x6, &(0x7f0000000480)) clock_gettime(0x3, &(0x7f00000004c0)) clock_settime(0x5, &(0x7f0000000500)={0x77359400}) pselect6(0x40, &(0x7f0000000540)={0x9, 0x9, 0x4, 0x3, 0xbc88, 0x3, 0x2, 0x2}, &(0x7f0000000580)={0x1f, 0x6, 0x26ba, 0x8, 0x1, 0x8000, 0x1, 0x8}, 0x0, &(0x7f00000005c0)={0x0, 0x3938700}, &(0x7f0000000640)={&(0x7f0000000600)={[0x10001]}, 0x8}) accept4$vsock_stream(0xffffffffffffffff, &(0x7f0000000680)={0x28, 0x0, 0x0, @local}, 0x10, 0x80800) pselect6(0x40, &(0x7f00000006c0)={0x1, 0x1, 0x89e, 0x4, 0xffffffffffffff16, 0x400, 0x1, 0x9}, &(0x7f0000000700)={0x9, 0x5, 0xc56, 0xf732, 0x1, 0x1, 0x20, 0x101}, &(0x7f0000000740)={0x1df0a00000, 0x9, 0x7, 0x8001, 0x2, 0x80000000, 0xfffffffffffff801}, &(0x7f0000000780)={0x0, 0x3938700}, &(0x7f0000000800)={&(0x7f00000007c0)={[0x6]}, 0x8}) sendmsg$IEEE802154_ASSOCIATE_RESP(0xffffffffffffffff, &(0x7f0000000900)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000880)={0x40, 0x0, 0x20, 0x70bd29, 0x25dfdbfc, {}, [@IEEE802154_ATTR_STATUS={0x5, 0x3, 0x6}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x5}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x1}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa0}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4008000}, 0x4000000) prctl$PR_SET_THP_DISABLE(0x29, 0x1) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, &(0x7f0000000b40)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000980)={0x150, 0x0, 0x8, 0x70bd27, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_TESTDATA={0x72, 0x45, "d97d387e742764bac778bb3cf8eddb74f6a0a2f307b791b5e8b34f0ade3bdf9e54c3eceaea6cb6df5b0c18b5592815a59ff23c80d0dac40899af314b43f1d59c398a3ddbb01337581bb654d085d00128fffcb5c19245582a2c27b84e7ec713533232ad3ab44266f3ab3c6b36eff1"}, @NL80211_ATTR_TESTDATA={0x3a, 0x45, "c42820db057701f4a5e00d1e4afa5f62b894abca71006d976fe37af6d520a2624f98dea90fb1c69ee242d278373e963d021b8326d139"}, @NL80211_ATTR_TESTDATA={0x8a, 0x45, "a8a46af0c5e6cab9624ddfafbdfbf1b1391ffee937b7efc28b8ebd4c2cdb69000fccee43bfeb334e39495770f937e53da7eee55ae11dd18453dc85d6a4ac88846238770ab62907521962e3bdd5d1c811b3d6d1ab00c3a4ca316c41716e8d60c7a27e8922eef2c5baa3214c5fce29d2ab15cfbf5edcb76d1221921d1bf0ccb0c4be515cbefe15"}]}, 0x150}, 0x1, 0x0, 0x0, 0x10}, 0x8) futex(&(0x7f0000000b80), 0x3, 0x2, &(0x7f0000000bc0)={0x77359400}, &(0x7f0000000c00)=0x1, 0x1) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000c80), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_MPATH(0xffffffffffffffff, &(0x7f0000000d80)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000cc0)={0x4c, r2, 0x100, 0x70bd29, 0x25dfdbfd, {{}, {@val={0x8}, @val={0xc, 0x99, {0x9, 0x2b}}}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}]}, 0x4c}}, 0x0) pselect6(0x40, &(0x7f0000000dc0)={0x1, 0x81, 0x0, 0x9c31, 0x502, 0xe101, 0x0, 0x4}, &(0x7f0000000e00)={0x2, 0x2e4b, 0xa6, 0x200, 0x2, 0x0, 0x8, 0x7ff}, &(0x7f0000000e40)={0x95, 0x3, 0xff, 0xffffffffffffb022, 0x96f7, 0x7fff, 0x9, 0x9}, &(0x7f0000000e80), &(0x7f0000000f00)={&(0x7f0000000ec0)={[0x2]}, 0x8}) 14:37:58 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$fou(&(0x7f0000000000), r0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, 0xffffffffffffffff) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) sendmsg$NL80211_CMD_DISASSOCIATE(r0, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)={0x164, r1, 0x400, 0x70bd2c, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_IE={0x14d, 0x2a, [@link_id={0x65, 0x12, {@from_mac, @device_a, @broadcast}}, @ssid={0x0, 0x6, @default_ibss_ssid}, @supported_rates={0x1, 0x6, [{0x29}, {0x30, 0x1}, {0x5}, {0x1}, {0x4}, {0x4, 0x1}]}, @tim={0x5, 0xc0, {0x7, 0x68, 0x80, "61657e60f0801a300509aab918ab1971761a963dd21eb9e9c9024899cca7173fff84acb5125eef28533baeb1d9fda0d6669cc46ce466affeb608cbf1fe42d44a07d717b07203f58dc1c6f7355c1fc80ce920418fdcaadfb61589d8fc9f9bffa45113d826d1b5f403b18c2b55a83a0ab727c4d8f3ba995882944dfd7e7b71a7d6b910b06173fca2d1c86a9adec4a962145f1bb9a95e974795a6ac80352c76d60f8de261d13a3cc1414b28ce86f725c97c5c24154048d4dab242e3e8fa86"}}, @link_id={0x65, 0x12, {@random="ae81ff7d5170", @broadcast}}, @ibss={0x6, 0x2, 0xc81c}, @random={0x1, 0x3c, "7045311358996128f2395883547f6b80b2fd27a9f69591031ecd896f20eeb76ad877ab6038afa87a277368ce754cf5ed8866f880e8a8be8ff4db00ef"}, @gcr_ga={0xbd, 0x6, @device_b}, @channel_switch={0x25, 0x3, {0x1, 0x8c, 0xa2}}]}]}, 0x164}, 0x1, 0x0, 0x0, 0xc814}, 0xc040) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TDLS_CHANNEL_SWITCH(r0, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x58, r1, 0x2, 0x70bd27, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x400, 0x3b}}}}, [@NL80211_ATTR_OPER_CLASS={0x5, 0xd6, 0x3}, @chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0xb}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x3c7}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x1}], @NL80211_ATTR_OPER_CLASS={0x5, 0xd6, 0x34}]}, 0x58}}, 0x10000080) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000480), r2) sendmsg$NL80211_CMD_TDLS_CHANNEL_SWITCH(r2, &(0x7f0000000580)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000540)={&(0x7f00000004c0)={0x64, r4, 0x300, 0x70bd27, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x80, 0x53}}}}, [@NL80211_ATTR_OPER_CLASS={0x5, 0xd6, 0x1}, @NL80211_ATTR_OPER_CLASS={0x5}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_OPER_CLASS={0x5, 0xd6, 0x1}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x64}, 0x1, 0x0, 0x0, 0x2000000}, 0x40000) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_RELOAD_REGDB(r5, &(0x7f0000000680)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x400802}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x14, r1, 0x4, 0x70bd28, 0x25dfdbff, {}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x840) r6 = syz_open_dev$vcsa(&(0x7f00000006c0), 0xfffffffffffeffff, 0x20103) sendmsg$NL80211_CMD_DEL_STATION(r6, &(0x7f0000000800)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000740)={0x6c, r4, 0x8, 0x70bd2c, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_STA_WME={0x2c, 0x81, [@NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0x6}, @NL80211_STA_WME_MAX_SP={0x5}, @NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0x2}, @NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0x9}, @NL80211_STA_WME_MAX_SP={0x5, 0x2, 0x3}]}, @NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x723}, @NL80211_ATTR_AIRTIME_WEIGHT={0x6, 0x112, 0x1}, @NL80211_ATTR_STA_WME={0x14, 0x81, [@NL80211_STA_WME_MAX_SP={0x5, 0x2, 0x7e}, @NL80211_STA_WME_MAX_SP={0x5, 0x2, 0x3}]}, @NL80211_ATTR_LOCAL_MESH_POWER_MODE={0x8, 0xa4, 0x2}]}, 0x6c}, 0x1, 0x0, 0x0, 0x8040}, 0x8000) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NET_DM_CMD_STOP(r7, &(0x7f0000000900)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000880)={0x14, 0x0, 0x10, 0x70bd2c, 0x25dfdbfb, {}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) getpgrp(0xffffffffffffffff) sendmsg$NL80211_CMD_START_P2P_DEVICE(r5, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x28, r4, 0x100, 0x70bd26, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x0, 0xe}}}}, ["", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x810}, 0x400c014) prctl$PR_SCHED_CORE(0x3e, 0x1, 0xffffffffffffffff, 0x0, &(0x7f0000000a40)) sendmsg$NL80211_CMD_RELOAD_REGDB(r5, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14, r4, 0x1, 0x70bd28, 0x25dfdbfe, {}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4040881}, 0x0) [ 22.291902][ T22] audit: type=1400 audit(1634740678.809:79): avc: denied { execmem } for pid=304 comm="syz-executor.0" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 22.372237][ T22] audit: type=1400 audit(1634740678.889:80): avc: denied { mounton } for pid=310 comm="syz-executor.0" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 22.440264][ T22] audit: type=1400 audit(1634740678.919:81): avc: denied { mount } for pid=310 comm="syz-executor.0" name="/" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 22.530255][ T22] audit: type=1400 audit(1634740678.919:82): avc: denied { read } for pid=310 comm="syz-executor.0" dev="nsfs" ino=4026531999 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 22.612703][ T310] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.619736][ T310] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.630699][ T310] device bridge_slave_0 entered promiscuous mode [ 22.639000][ T310] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.646086][ T310] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.653396][ T310] device bridge_slave_1 entered promiscuous mode [ 22.836525][ T313] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.843557][ T313] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.850967][ T313] device bridge_slave_0 entered promiscuous mode [ 22.862092][ T313] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.869104][ T313] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.876477][ T313] device bridge_slave_1 entered promiscuous mode [ 22.909720][ T319] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.916893][ T319] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.924341][ T319] device bridge_slave_0 entered promiscuous mode [ 22.943652][ T319] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.950719][ T319] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.958071][ T319] device bridge_slave_1 entered promiscuous mode [ 22.976253][ T317] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.983385][ T317] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.990800][ T317] device bridge_slave_0 entered promiscuous mode [ 22.997722][ T317] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.004761][ T317] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.012122][ T317] device bridge_slave_1 entered promiscuous mode [ 23.027979][ T318] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.035112][ T318] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.042578][ T318] device bridge_slave_0 entered promiscuous mode [ 23.067978][ T310] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.075117][ T310] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.082391][ T310] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.089381][ T310] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.097476][ T316] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.104595][ T316] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.111983][ T316] device bridge_slave_0 entered promiscuous mode [ 23.125470][ T316] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.132628][ T316] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.139912][ T316] device bridge_slave_1 entered promiscuous mode [ 23.146672][ T318] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.153752][ T318] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.161177][ T318] device bridge_slave_1 entered promiscuous mode [ 23.310422][ T101] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.318677][ T101] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.329128][ T101] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.336681][ T101] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.398219][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.428123][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.436255][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.444637][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.453633][ T118] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.460650][ T118] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.468371][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.476500][ T118] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.483513][ T118] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.490826][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 23.518081][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.525862][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.534218][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.542952][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.551347][ T118] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.558342][ T118] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.566354][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.574622][ T118] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.581635][ T118] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.589056][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 23.613332][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.621364][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.629228][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 23.638687][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.656789][ T67] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.665350][ T67] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.690713][ T67] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 23.698690][ T67] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.707051][ T67] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.714891][ T67] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.722427][ T67] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 23.730762][ T67] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.738820][ T67] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.745875][ T67] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.753640][ T67] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.761055][ T67] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.768393][ T67] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.776547][ T67] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.784588][ T67] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 23.792943][ T67] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.801209][ T67] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.808218][ T67] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.834092][ T67] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 23.841839][ T67] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 23.850550][ T67] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.858677][ T67] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.865714][ T67] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.873742][ T67] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 23.882018][ T67] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.890081][ T67] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.897099][ T67] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.904448][ T67] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.912099][ T67] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.919414][ T67] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.927616][ T67] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.935845][ T67] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 23.944206][ T67] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.952373][ T67] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.959382][ T67] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.966806][ T67] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.975149][ T67] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.983485][ T67] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 23.991748][ T67] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.999900][ T67] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.006958][ T67] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.014670][ T67] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 24.022354][ T67] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 24.041251][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.049526][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.057853][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.066186][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.074509][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.082908][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.121015][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.129142][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.139429][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.147928][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.150101][ T339] input: syz1 as /devices/virtual/input/input4 [ 24.156408][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready 14:38:00 executing program 0: clock_getres(0x4, &(0x7f0000000000)) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$UI_SET_SWBIT(r0, 0x4004556d, 0x0) clock_gettime(0x4, &(0x7f0000000080)) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) setsockopt$bt_hci_HCI_DATA_DIR(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000000c0)=0x81, 0x4) clock_getres(0x6, &(0x7f0000000100)) write$uinput_user_dev(r0, &(0x7f0000000140)={'syz1\x00', {0x800, 0x19, 0x100, 0x6}, 0xf, [0x5, 0xfffff800, 0xe, 0x8, 0x9, 0x1, 0x40, 0xff, 0x0, 0x1, 0xa87, 0xfffffffb, 0x8, 0x9, 0x7, 0x1, 0x1, 0x80000000, 0xfffffffe, 0x4, 0x3b, 0x7ff, 0x1, 0x5, 0xffffffff, 0x0, 0x7, 0x4, 0x7d0, 0x3b, 0x1ff, 0xffff, 0x5f0b, 0x7, 0xfffff000, 0x1, 0xa5, 0x6, 0x6, 0x10001, 0x2, 0xffffffff, 0xfc91, 0x0, 0x6, 0xfffffff8, 0xdca7, 0x2, 0xc0d, 0x80000000, 0x6, 0xffffffff, 0x0, 0x401, 0x3, 0x7, 0x2, 0x0, 0xfffffffc, 0x7ff, 0x7, 0x6, 0xf0a5, 0x81], [0x1c, 0x4, 0x1, 0xa86e, 0x8001, 0x100, 0x3, 0x5, 0x1, 0x6, 0x3568, 0x0, 0x9, 0x6, 0x7fffffff, 0x6f, 0x103, 0x4, 0xffa, 0x4, 0x0, 0x81, 0x2, 0x81f, 0x75ad, 0x4, 0x1873, 0x72e, 0x1, 0xd1, 0x6, 0x0, 0x83, 0x9, 0xc5e, 0x10000, 0x0, 0x1, 0x6, 0x9de, 0x3ff, 0x7f, 0x7, 0x8000, 0xf4c, 0x0, 0x8, 0x3f, 0x1, 0x80000001, 0xffffffff, 0xfffffffb, 0x6, 0x4d1, 0x6, 0x4, 0x5, 0xff, 0x1, 0x9, 0x6, 0x3, 0xffffffff, 0x3], [0xcd, 0x3, 0xf, 0x80000000, 0x5, 0x7, 0x1, 0x7, 0x80000000, 0x0, 0x4, 0x4, 0x7, 0x1, 0x1, 0x0, 0x8, 0x1, 0x855, 0x5, 0x75ae, 0x4411, 0x8, 0xffff, 0x200, 0x7, 0xc4, 0x11fedc7, 0xffff, 0x101, 0xffffffff, 0x7fff, 0x0, 0xffffffff, 0xf30, 0x7, 0x6, 0x2, 0x3f, 0x40000000, 0x23, 0x0, 0x21, 0x1, 0x5, 0x6, 0x401, 0x53f, 0x1, 0x10000, 0x800, 0x2, 0x0, 0x800, 0x7, 0x0, 0x7, 0x1, 0x3, 0x50000000, 0x10000, 0xffffffff, 0x2, 0x3], [0x4, 0x0, 0xffff, 0xc82d, 0xe02, 0x80000000, 0x2, 0xff, 0x5, 0x4, 0x5a, 0x80000000, 0x1ff, 0x4, 0x2, 0x89, 0x5, 0x4, 0x81, 0x5, 0xfffffeff, 0x9, 0x0, 0xb8e, 0x79ed, 0x4, 0x4, 0x1ff, 0x0, 0xde, 0x80, 0x3, 0x4, 0x5, 0x10001, 0x3f, 0x8001, 0x2, 0xdf56, 0xffff, 0x4, 0x52, 0x6, 0x7ff, 0x80000001, 0x4, 0x5, 0x8, 0x1, 0x31f24a7, 0x5, 0x1ff, 0x4f, 0x3, 0x100, 0x80000001, 0xfff, 0xd9f, 0x6f, 0x7, 0x1, 0x1, 0x9, 0x227d]}, 0x45c) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT(0xffffffffffffffff, 0x28, 0x6, &(0x7f00000005c0)={0x77359400}, 0x10) capset(&(0x7f0000000600)={0xf1504}, &(0x7f0000000640)={0x0, 0x1, 0x20, 0x20, 0x3, 0xffffffff}) select(0x40, &(0x7f0000000680)={0x5, 0x9, 0xf84, 0xfffffffffffffffc, 0x1ff, 0xded, 0xb1, 0x2}, &(0x7f00000006c0)={0xe0000000000000, 0x4, 0x3, 0x7, 0x49b5, 0x7, 0xffffffff00000000, 0x6}, &(0x7f0000000700)={0xfffffffffffffffd, 0x100000001, 0x5, 0xcdb, 0x3ff, 0x81, 0x81, 0x7c0}, &(0x7f0000000740)={0x0, 0xea60}) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000780), 0x802, 0x0) write$uinput_user_dev(r1, &(0x7f00000007c0)={'syz1\x00', {0x2, 0x9a, 0x9, 0x8}, 0x14, [0x8000, 0x52, 0x8, 0x8, 0x7, 0xfff, 0x1, 0x7fffffff, 0x10001, 0x10001, 0x4, 0x2, 0x10000, 0x1000, 0x8, 0x0, 0x1, 0x4, 0x10000, 0x6, 0x8e, 0xffffffff, 0x7, 0xd23, 0xfd67, 0x20000000, 0x800, 0x7, 0x10001, 0x8, 0x0, 0x2, 0x6, 0xfffffffa, 0x3f, 0x4, 0xfffffff8, 0x1f, 0x3, 0x418, 0x8, 0x1f, 0x101, 0x2a, 0x1f, 0x4, 0x80000000, 0x9, 0x2, 0x7, 0x0, 0x10000, 0x5, 0x8000, 0x3, 0x4, 0x63b, 0x0, 0x7fff, 0xdb33, 0xe6f4, 0x5, 0x7, 0x1000], [0x1, 0x40000000, 0x800, 0xfa9c, 0x3f6, 0xffffff35, 0x9, 0x7f, 0x6, 0x42, 0x6, 0x3, 0x8, 0xde, 0x0, 0x5, 0x7, 0x9, 0x4, 0x8, 0x80000001, 0x3, 0x1, 0x7, 0x3, 0x1, 0x64a4a95f, 0x7, 0x1000, 0x4, 0x101, 0x5, 0x80, 0x7fff, 0x7, 0x14, 0x1ff, 0xee, 0x0, 0x3, 0xffffffe1, 0x81, 0x7fff, 0x9, 0x6, 0x0, 0x401, 0x7, 0x3f, 0x9, 0x7fffffff, 0x1f, 0x3, 0x7, 0x9, 0x40, 0x30000, 0x4, 0x401, 0x8, 0x0, 0x7fff, 0x1ff, 0x20], [0x1f, 0x5, 0x7, 0x4036, 0x2, 0xfffffff9, 0x7, 0x45, 0x7fffffff, 0x6, 0x9, 0x8, 0x1, 0x7ff, 0x8, 0xfffffff8, 0x2ffac02c, 0x80, 0x100, 0xff, 0x800, 0x3, 0x9, 0x3, 0xffffffff, 0x2, 0x3, 0x0, 0x2ff, 0x5, 0x7f, 0x20, 0x3, 0x2, 0x6, 0xbd3b, 0x2, 0xfffffffb, 0x7f, 0x7, 0x8000, 0x5, 0xfffffffe, 0x8000, 0x3, 0x8, 0x5c, 0x40, 0x8, 0x200, 0x8, 0x8000, 0xe7b, 0x80000000, 0x9, 0x7ff, 0xfffffffa, 0x1, 0xf418, 0x100, 0x2722, 0x3, 0x7ff, 0xff], [0x1d47a776, 0x2, 0x6, 0x8, 0x7f, 0x3, 0x9, 0x1000, 0x40, 0x1ff, 0xfffffff7, 0x0, 0x6, 0x80, 0x90000, 0x11, 0x3, 0x3, 0x5, 0x1, 0x3ff, 0x100, 0x450, 0xffff8001, 0x400, 0x7, 0x8, 0x7, 0x2, 0x2, 0x20, 0x0, 0x9, 0x4, 0x800, 0xd7, 0x10001, 0x8, 0xfff, 0x1, 0x3, 0x7f, 0xd76b, 0xee, 0x5, 0x4, 0x2, 0x9, 0x8, 0x8, 0x2, 0x0, 0x9fc9, 0x9, 0x8, 0x2, 0x0, 0x0, 0xffff, 0x9, 0x95e1, 0x0, 0x0, 0x101]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x7) ioctl$UI_DEV_CREATE(r0, 0x5501) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000c40), 0x802, 0x0) ioctl$UI_GET_SYSNAME(r2, 0x8040552c, &(0x7f0000000c80)) futex(&(0x7f0000000cc0)=0x1, 0x0, 0x0, &(0x7f0000000d00), &(0x7f0000000d40)=0x2, 0x0) r3 = syz_open_dev$vcsa(&(0x7f0000000d80), 0x0, 0x10000) write$P9_RXATTRWALK(r3, &(0x7f0000000dc0)={0xf, 0x1f, 0x2, 0x8}, 0xf) [ 24.170759][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.176954][ T340] input: syz1 as /devices/virtual/input/input7 [ 24.178825][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.192753][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.200852][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.208979][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.225934][ T342] input: syz1 as /devices/virtual/input/input10 [ 24.249740][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.259298][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.267964][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready 14:38:00 executing program 0: clock_getres(0x4, &(0x7f0000000000)) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$UI_SET_SWBIT(r0, 0x4004556d, 0x0) clock_gettime(0x4, &(0x7f0000000080)) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) setsockopt$bt_hci_HCI_DATA_DIR(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000000c0)=0x81, 0x4) clock_getres(0x6, &(0x7f0000000100)) write$uinput_user_dev(r0, &(0x7f0000000140)={'syz1\x00', {0x800, 0x19, 0x100, 0x6}, 0xf, [0x5, 0xfffff800, 0xe, 0x8, 0x9, 0x1, 0x40, 0xff, 0x0, 0x1, 0xa87, 0xfffffffb, 0x8, 0x9, 0x7, 0x1, 0x1, 0x80000000, 0xfffffffe, 0x4, 0x3b, 0x7ff, 0x1, 0x5, 0xffffffff, 0x0, 0x7, 0x4, 0x7d0, 0x3b, 0x1ff, 0xffff, 0x5f0b, 0x7, 0xfffff000, 0x1, 0xa5, 0x6, 0x6, 0x10001, 0x2, 0xffffffff, 0xfc91, 0x0, 0x6, 0xfffffff8, 0xdca7, 0x2, 0xc0d, 0x80000000, 0x6, 0xffffffff, 0x0, 0x401, 0x3, 0x7, 0x2, 0x0, 0xfffffffc, 0x7ff, 0x7, 0x6, 0xf0a5, 0x81], [0x1c, 0x4, 0x1, 0xa86e, 0x8001, 0x100, 0x3, 0x5, 0x1, 0x6, 0x3568, 0x0, 0x9, 0x6, 0x7fffffff, 0x6f, 0x103, 0x4, 0xffa, 0x4, 0x0, 0x81, 0x2, 0x81f, 0x75ad, 0x4, 0x1873, 0x72e, 0x1, 0xd1, 0x6, 0x0, 0x83, 0x9, 0xc5e, 0x10000, 0x0, 0x1, 0x6, 0x9de, 0x3ff, 0x7f, 0x7, 0x8000, 0xf4c, 0x0, 0x8, 0x3f, 0x1, 0x80000001, 0xffffffff, 0xfffffffb, 0x6, 0x4d1, 0x6, 0x4, 0x5, 0xff, 0x1, 0x9, 0x6, 0x3, 0xffffffff, 0x3], [0xcd, 0x3, 0xf, 0x80000000, 0x5, 0x7, 0x1, 0x7, 0x80000000, 0x0, 0x4, 0x4, 0x7, 0x1, 0x1, 0x0, 0x8, 0x1, 0x855, 0x5, 0x75ae, 0x4411, 0x8, 0xffff, 0x200, 0x7, 0xc4, 0x11fedc7, 0xffff, 0x101, 0xffffffff, 0x7fff, 0x0, 0xffffffff, 0xf30, 0x7, 0x6, 0x2, 0x3f, 0x40000000, 0x23, 0x0, 0x21, 0x1, 0x5, 0x6, 0x401, 0x53f, 0x1, 0x10000, 0x800, 0x2, 0x0, 0x800, 0x7, 0x0, 0x7, 0x1, 0x3, 0x50000000, 0x10000, 0xffffffff, 0x2, 0x3], [0x4, 0x0, 0xffff, 0xc82d, 0xe02, 0x80000000, 0x2, 0xff, 0x5, 0x4, 0x5a, 0x80000000, 0x1ff, 0x4, 0x2, 0x89, 0x5, 0x4, 0x81, 0x5, 0xfffffeff, 0x9, 0x0, 0xb8e, 0x79ed, 0x4, 0x4, 0x1ff, 0x0, 0xde, 0x80, 0x3, 0x4, 0x5, 0x10001, 0x3f, 0x8001, 0x2, 0xdf56, 0xffff, 0x4, 0x52, 0x6, 0x7ff, 0x80000001, 0x4, 0x5, 0x8, 0x1, 0x31f24a7, 0x5, 0x1ff, 0x4f, 0x3, 0x100, 0x80000001, 0xfff, 0xd9f, 0x6f, 0x7, 0x1, 0x1, 0x9, 0x227d]}, 0x45c) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT(0xffffffffffffffff, 0x28, 0x6, &(0x7f00000005c0)={0x77359400}, 0x10) capset(&(0x7f0000000600)={0xf1504}, &(0x7f0000000640)={0x0, 0x1, 0x20, 0x20, 0x3, 0xffffffff}) select(0x40, &(0x7f0000000680)={0x5, 0x9, 0xf84, 0xfffffffffffffffc, 0x1ff, 0xded, 0xb1, 0x2}, &(0x7f00000006c0)={0xe0000000000000, 0x4, 0x3, 0x7, 0x49b5, 0x7, 0xffffffff00000000, 0x6}, &(0x7f0000000700)={0xfffffffffffffffd, 0x100000001, 0x5, 0xcdb, 0x3ff, 0x81, 0x81, 0x7c0}, &(0x7f0000000740)={0x0, 0xea60}) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000780), 0x802, 0x0) write$uinput_user_dev(r1, &(0x7f00000007c0)={'syz1\x00', {0x2, 0x9a, 0x9, 0x8}, 0x14, [0x8000, 0x52, 0x8, 0x8, 0x7, 0xfff, 0x1, 0x7fffffff, 0x10001, 0x10001, 0x4, 0x2, 0x10000, 0x1000, 0x8, 0x0, 0x1, 0x4, 0x10000, 0x6, 0x8e, 0xffffffff, 0x7, 0xd23, 0xfd67, 0x20000000, 0x800, 0x7, 0x10001, 0x8, 0x0, 0x2, 0x6, 0xfffffffa, 0x3f, 0x4, 0xfffffff8, 0x1f, 0x3, 0x418, 0x8, 0x1f, 0x101, 0x2a, 0x1f, 0x4, 0x80000000, 0x9, 0x2, 0x7, 0x0, 0x10000, 0x5, 0x8000, 0x3, 0x4, 0x63b, 0x0, 0x7fff, 0xdb33, 0xe6f4, 0x5, 0x7, 0x1000], [0x1, 0x40000000, 0x800, 0xfa9c, 0x3f6, 0xffffff35, 0x9, 0x7f, 0x6, 0x42, 0x6, 0x3, 0x8, 0xde, 0x0, 0x5, 0x7, 0x9, 0x4, 0x8, 0x80000001, 0x3, 0x1, 0x7, 0x3, 0x1, 0x64a4a95f, 0x7, 0x1000, 0x4, 0x101, 0x5, 0x80, 0x7fff, 0x7, 0x14, 0x1ff, 0xee, 0x0, 0x3, 0xffffffe1, 0x81, 0x7fff, 0x9, 0x6, 0x0, 0x401, 0x7, 0x3f, 0x9, 0x7fffffff, 0x1f, 0x3, 0x7, 0x9, 0x40, 0x30000, 0x4, 0x401, 0x8, 0x0, 0x7fff, 0x1ff, 0x20], [0x1f, 0x5, 0x7, 0x4036, 0x2, 0xfffffff9, 0x7, 0x45, 0x7fffffff, 0x6, 0x9, 0x8, 0x1, 0x7ff, 0x8, 0xfffffff8, 0x2ffac02c, 0x80, 0x100, 0xff, 0x800, 0x3, 0x9, 0x3, 0xffffffff, 0x2, 0x3, 0x0, 0x2ff, 0x5, 0x7f, 0x20, 0x3, 0x2, 0x6, 0xbd3b, 0x2, 0xfffffffb, 0x7f, 0x7, 0x8000, 0x5, 0xfffffffe, 0x8000, 0x3, 0x8, 0x5c, 0x40, 0x8, 0x200, 0x8, 0x8000, 0xe7b, 0x80000000, 0x9, 0x7ff, 0xfffffffa, 0x1, 0xf418, 0x100, 0x2722, 0x3, 0x7ff, 0xff], [0x1d47a776, 0x2, 0x6, 0x8, 0x7f, 0x3, 0x9, 0x1000, 0x40, 0x1ff, 0xfffffff7, 0x0, 0x6, 0x80, 0x90000, 0x11, 0x3, 0x3, 0x5, 0x1, 0x3ff, 0x100, 0x450, 0xffff8001, 0x400, 0x7, 0x8, 0x7, 0x2, 0x2, 0x20, 0x0, 0x9, 0x4, 0x800, 0xd7, 0x10001, 0x8, 0xfff, 0x1, 0x3, 0x7f, 0xd76b, 0xee, 0x5, 0x4, 0x2, 0x9, 0x8, 0x8, 0x2, 0x0, 0x9fc9, 0x9, 0x8, 0x2, 0x0, 0x0, 0xffff, 0x9, 0x95e1, 0x0, 0x0, 0x101]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x7) ioctl$UI_DEV_CREATE(r0, 0x5501) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000c40), 0x802, 0x0) ioctl$UI_GET_SYSNAME(r2, 0x8040552c, &(0x7f0000000c80)) futex(&(0x7f0000000cc0)=0x1, 0x0, 0x0, &(0x7f0000000d00), &(0x7f0000000d40)=0x2, 0x0) r3 = syz_open_dev$vcsa(&(0x7f0000000d80), 0x0, 0x10000) write$P9_RXATTRWALK(r3, &(0x7f0000000dc0)={0xf, 0x1f, 0x2, 0x8}, 0xf) [ 24.276656][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.285300][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.287060][ T345] input: syz1 as /devices/virtual/input/input13 [ 24.293432][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.307329][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.316114][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready 14:38:00 executing program 0: clock_getres(0x4, &(0x7f0000000000)) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$UI_SET_SWBIT(r0, 0x4004556d, 0x0) clock_gettime(0x4, &(0x7f0000000080)) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) setsockopt$bt_hci_HCI_DATA_DIR(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000000c0)=0x81, 0x4) clock_getres(0x6, &(0x7f0000000100)) write$uinput_user_dev(r0, &(0x7f0000000140)={'syz1\x00', {0x800, 0x19, 0x100, 0x6}, 0xf, [0x5, 0xfffff800, 0xe, 0x8, 0x9, 0x1, 0x40, 0xff, 0x0, 0x1, 0xa87, 0xfffffffb, 0x8, 0x9, 0x7, 0x1, 0x1, 0x80000000, 0xfffffffe, 0x4, 0x3b, 0x7ff, 0x1, 0x5, 0xffffffff, 0x0, 0x7, 0x4, 0x7d0, 0x3b, 0x1ff, 0xffff, 0x5f0b, 0x7, 0xfffff000, 0x1, 0xa5, 0x6, 0x6, 0x10001, 0x2, 0xffffffff, 0xfc91, 0x0, 0x6, 0xfffffff8, 0xdca7, 0x2, 0xc0d, 0x80000000, 0x6, 0xffffffff, 0x0, 0x401, 0x3, 0x7, 0x2, 0x0, 0xfffffffc, 0x7ff, 0x7, 0x6, 0xf0a5, 0x81], [0x1c, 0x4, 0x1, 0xa86e, 0x8001, 0x100, 0x3, 0x5, 0x1, 0x6, 0x3568, 0x0, 0x9, 0x6, 0x7fffffff, 0x6f, 0x103, 0x4, 0xffa, 0x4, 0x0, 0x81, 0x2, 0x81f, 0x75ad, 0x4, 0x1873, 0x72e, 0x1, 0xd1, 0x6, 0x0, 0x83, 0x9, 0xc5e, 0x10000, 0x0, 0x1, 0x6, 0x9de, 0x3ff, 0x7f, 0x7, 0x8000, 0xf4c, 0x0, 0x8, 0x3f, 0x1, 0x80000001, 0xffffffff, 0xfffffffb, 0x6, 0x4d1, 0x6, 0x4, 0x5, 0xff, 0x1, 0x9, 0x6, 0x3, 0xffffffff, 0x3], [0xcd, 0x3, 0xf, 0x80000000, 0x5, 0x7, 0x1, 0x7, 0x80000000, 0x0, 0x4, 0x4, 0x7, 0x1, 0x1, 0x0, 0x8, 0x1, 0x855, 0x5, 0x75ae, 0x4411, 0x8, 0xffff, 0x200, 0x7, 0xc4, 0x11fedc7, 0xffff, 0x101, 0xffffffff, 0x7fff, 0x0, 0xffffffff, 0xf30, 0x7, 0x6, 0x2, 0x3f, 0x40000000, 0x23, 0x0, 0x21, 0x1, 0x5, 0x6, 0x401, 0x53f, 0x1, 0x10000, 0x800, 0x2, 0x0, 0x800, 0x7, 0x0, 0x7, 0x1, 0x3, 0x50000000, 0x10000, 0xffffffff, 0x2, 0x3], [0x4, 0x0, 0xffff, 0xc82d, 0xe02, 0x80000000, 0x2, 0xff, 0x5, 0x4, 0x5a, 0x80000000, 0x1ff, 0x4, 0x2, 0x89, 0x5, 0x4, 0x81, 0x5, 0xfffffeff, 0x9, 0x0, 0xb8e, 0x79ed, 0x4, 0x4, 0x1ff, 0x0, 0xde, 0x80, 0x3, 0x4, 0x5, 0x10001, 0x3f, 0x8001, 0x2, 0xdf56, 0xffff, 0x4, 0x52, 0x6, 0x7ff, 0x80000001, 0x4, 0x5, 0x8, 0x1, 0x31f24a7, 0x5, 0x1ff, 0x4f, 0x3, 0x100, 0x80000001, 0xfff, 0xd9f, 0x6f, 0x7, 0x1, 0x1, 0x9, 0x227d]}, 0x45c) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT(0xffffffffffffffff, 0x28, 0x6, &(0x7f00000005c0)={0x77359400}, 0x10) capset(&(0x7f0000000600)={0xf1504}, &(0x7f0000000640)={0x0, 0x1, 0x20, 0x20, 0x3, 0xffffffff}) select(0x40, &(0x7f0000000680)={0x5, 0x9, 0xf84, 0xfffffffffffffffc, 0x1ff, 0xded, 0xb1, 0x2}, &(0x7f00000006c0)={0xe0000000000000, 0x4, 0x3, 0x7, 0x49b5, 0x7, 0xffffffff00000000, 0x6}, &(0x7f0000000700)={0xfffffffffffffffd, 0x100000001, 0x5, 0xcdb, 0x3ff, 0x81, 0x81, 0x7c0}, &(0x7f0000000740)={0x0, 0xea60}) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000780), 0x802, 0x0) write$uinput_user_dev(r1, &(0x7f00000007c0)={'syz1\x00', {0x2, 0x9a, 0x9, 0x8}, 0x14, [0x8000, 0x52, 0x8, 0x8, 0x7, 0xfff, 0x1, 0x7fffffff, 0x10001, 0x10001, 0x4, 0x2, 0x10000, 0x1000, 0x8, 0x0, 0x1, 0x4, 0x10000, 0x6, 0x8e, 0xffffffff, 0x7, 0xd23, 0xfd67, 0x20000000, 0x800, 0x7, 0x10001, 0x8, 0x0, 0x2, 0x6, 0xfffffffa, 0x3f, 0x4, 0xfffffff8, 0x1f, 0x3, 0x418, 0x8, 0x1f, 0x101, 0x2a, 0x1f, 0x4, 0x80000000, 0x9, 0x2, 0x7, 0x0, 0x10000, 0x5, 0x8000, 0x3, 0x4, 0x63b, 0x0, 0x7fff, 0xdb33, 0xe6f4, 0x5, 0x7, 0x1000], [0x1, 0x40000000, 0x800, 0xfa9c, 0x3f6, 0xffffff35, 0x9, 0x7f, 0x6, 0x42, 0x6, 0x3, 0x8, 0xde, 0x0, 0x5, 0x7, 0x9, 0x4, 0x8, 0x80000001, 0x3, 0x1, 0x7, 0x3, 0x1, 0x64a4a95f, 0x7, 0x1000, 0x4, 0x101, 0x5, 0x80, 0x7fff, 0x7, 0x14, 0x1ff, 0xee, 0x0, 0x3, 0xffffffe1, 0x81, 0x7fff, 0x9, 0x6, 0x0, 0x401, 0x7, 0x3f, 0x9, 0x7fffffff, 0x1f, 0x3, 0x7, 0x9, 0x40, 0x30000, 0x4, 0x401, 0x8, 0x0, 0x7fff, 0x1ff, 0x20], [0x1f, 0x5, 0x7, 0x4036, 0x2, 0xfffffff9, 0x7, 0x45, 0x7fffffff, 0x6, 0x9, 0x8, 0x1, 0x7ff, 0x8, 0xfffffff8, 0x2ffac02c, 0x80, 0x100, 0xff, 0x800, 0x3, 0x9, 0x3, 0xffffffff, 0x2, 0x3, 0x0, 0x2ff, 0x5, 0x7f, 0x20, 0x3, 0x2, 0x6, 0xbd3b, 0x2, 0xfffffffb, 0x7f, 0x7, 0x8000, 0x5, 0xfffffffe, 0x8000, 0x3, 0x8, 0x5c, 0x40, 0x8, 0x200, 0x8, 0x8000, 0xe7b, 0x80000000, 0x9, 0x7ff, 0xfffffffa, 0x1, 0xf418, 0x100, 0x2722, 0x3, 0x7ff, 0xff], [0x1d47a776, 0x2, 0x6, 0x8, 0x7f, 0x3, 0x9, 0x1000, 0x40, 0x1ff, 0xfffffff7, 0x0, 0x6, 0x80, 0x90000, 0x11, 0x3, 0x3, 0x5, 0x1, 0x3ff, 0x100, 0x450, 0xffff8001, 0x400, 0x7, 0x8, 0x7, 0x2, 0x2, 0x20, 0x0, 0x9, 0x4, 0x800, 0xd7, 0x10001, 0x8, 0xfff, 0x1, 0x3, 0x7f, 0xd76b, 0xee, 0x5, 0x4, 0x2, 0x9, 0x8, 0x8, 0x2, 0x0, 0x9fc9, 0x9, 0x8, 0x2, 0x0, 0x0, 0xffff, 0x9, 0x95e1, 0x0, 0x0, 0x101]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x7) ioctl$UI_DEV_CREATE(r0, 0x5501) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000c40), 0x802, 0x0) ioctl$UI_GET_SYSNAME(r2, 0x8040552c, &(0x7f0000000c80)) futex(&(0x7f0000000cc0)=0x1, 0x0, 0x0, &(0x7f0000000d00), &(0x7f0000000d40)=0x2, 0x0) r3 = syz_open_dev$vcsa(&(0x7f0000000d80), 0x0, 0x10000) write$P9_RXATTRWALK(r3, &(0x7f0000000dc0)={0xf, 0x1f, 0x2, 0x8}, 0xf) [ 24.324527][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.332667][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.341279][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.347951][ T347] input: syz1 as /devices/virtual/input/input16 14:38:00 executing program 0: clock_getres(0x4, &(0x7f0000000000)) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$UI_SET_SWBIT(r0, 0x4004556d, 0x0) clock_gettime(0x4, &(0x7f0000000080)) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) setsockopt$bt_hci_HCI_DATA_DIR(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000000c0)=0x81, 0x4) clock_getres(0x6, &(0x7f0000000100)) write$uinput_user_dev(r0, &(0x7f0000000140)={'syz1\x00', {0x800, 0x19, 0x100, 0x6}, 0xf, [0x5, 0xfffff800, 0xe, 0x8, 0x9, 0x1, 0x40, 0xff, 0x0, 0x1, 0xa87, 0xfffffffb, 0x8, 0x9, 0x7, 0x1, 0x1, 0x80000000, 0xfffffffe, 0x4, 0x3b, 0x7ff, 0x1, 0x5, 0xffffffff, 0x0, 0x7, 0x4, 0x7d0, 0x3b, 0x1ff, 0xffff, 0x5f0b, 0x7, 0xfffff000, 0x1, 0xa5, 0x6, 0x6, 0x10001, 0x2, 0xffffffff, 0xfc91, 0x0, 0x6, 0xfffffff8, 0xdca7, 0x2, 0xc0d, 0x80000000, 0x6, 0xffffffff, 0x0, 0x401, 0x3, 0x7, 0x2, 0x0, 0xfffffffc, 0x7ff, 0x7, 0x6, 0xf0a5, 0x81], [0x1c, 0x4, 0x1, 0xa86e, 0x8001, 0x100, 0x3, 0x5, 0x1, 0x6, 0x3568, 0x0, 0x9, 0x6, 0x7fffffff, 0x6f, 0x103, 0x4, 0xffa, 0x4, 0x0, 0x81, 0x2, 0x81f, 0x75ad, 0x4, 0x1873, 0x72e, 0x1, 0xd1, 0x6, 0x0, 0x83, 0x9, 0xc5e, 0x10000, 0x0, 0x1, 0x6, 0x9de, 0x3ff, 0x7f, 0x7, 0x8000, 0xf4c, 0x0, 0x8, 0x3f, 0x1, 0x80000001, 0xffffffff, 0xfffffffb, 0x6, 0x4d1, 0x6, 0x4, 0x5, 0xff, 0x1, 0x9, 0x6, 0x3, 0xffffffff, 0x3], [0xcd, 0x3, 0xf, 0x80000000, 0x5, 0x7, 0x1, 0x7, 0x80000000, 0x0, 0x4, 0x4, 0x7, 0x1, 0x1, 0x0, 0x8, 0x1, 0x855, 0x5, 0x75ae, 0x4411, 0x8, 0xffff, 0x200, 0x7, 0xc4, 0x11fedc7, 0xffff, 0x101, 0xffffffff, 0x7fff, 0x0, 0xffffffff, 0xf30, 0x7, 0x6, 0x2, 0x3f, 0x40000000, 0x23, 0x0, 0x21, 0x1, 0x5, 0x6, 0x401, 0x53f, 0x1, 0x10000, 0x800, 0x2, 0x0, 0x800, 0x7, 0x0, 0x7, 0x1, 0x3, 0x50000000, 0x10000, 0xffffffff, 0x2, 0x3], [0x4, 0x0, 0xffff, 0xc82d, 0xe02, 0x80000000, 0x2, 0xff, 0x5, 0x4, 0x5a, 0x80000000, 0x1ff, 0x4, 0x2, 0x89, 0x5, 0x4, 0x81, 0x5, 0xfffffeff, 0x9, 0x0, 0xb8e, 0x79ed, 0x4, 0x4, 0x1ff, 0x0, 0xde, 0x80, 0x3, 0x4, 0x5, 0x10001, 0x3f, 0x8001, 0x2, 0xdf56, 0xffff, 0x4, 0x52, 0x6, 0x7ff, 0x80000001, 0x4, 0x5, 0x8, 0x1, 0x31f24a7, 0x5, 0x1ff, 0x4f, 0x3, 0x100, 0x80000001, 0xfff, 0xd9f, 0x6f, 0x7, 0x1, 0x1, 0x9, 0x227d]}, 0x45c) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT(0xffffffffffffffff, 0x28, 0x6, &(0x7f00000005c0)={0x77359400}, 0x10) capset(&(0x7f0000000600)={0xf1504}, &(0x7f0000000640)={0x0, 0x1, 0x20, 0x20, 0x3, 0xffffffff}) select(0x40, &(0x7f0000000680)={0x5, 0x9, 0xf84, 0xfffffffffffffffc, 0x1ff, 0xded, 0xb1, 0x2}, &(0x7f00000006c0)={0xe0000000000000, 0x4, 0x3, 0x7, 0x49b5, 0x7, 0xffffffff00000000, 0x6}, &(0x7f0000000700)={0xfffffffffffffffd, 0x100000001, 0x5, 0xcdb, 0x3ff, 0x81, 0x81, 0x7c0}, &(0x7f0000000740)={0x0, 0xea60}) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000780), 0x802, 0x0) write$uinput_user_dev(r1, &(0x7f00000007c0)={'syz1\x00', {0x2, 0x9a, 0x9, 0x8}, 0x14, [0x8000, 0x52, 0x8, 0x8, 0x7, 0xfff, 0x1, 0x7fffffff, 0x10001, 0x10001, 0x4, 0x2, 0x10000, 0x1000, 0x8, 0x0, 0x1, 0x4, 0x10000, 0x6, 0x8e, 0xffffffff, 0x7, 0xd23, 0xfd67, 0x20000000, 0x800, 0x7, 0x10001, 0x8, 0x0, 0x2, 0x6, 0xfffffffa, 0x3f, 0x4, 0xfffffff8, 0x1f, 0x3, 0x418, 0x8, 0x1f, 0x101, 0x2a, 0x1f, 0x4, 0x80000000, 0x9, 0x2, 0x7, 0x0, 0x10000, 0x5, 0x8000, 0x3, 0x4, 0x63b, 0x0, 0x7fff, 0xdb33, 0xe6f4, 0x5, 0x7, 0x1000], [0x1, 0x40000000, 0x800, 0xfa9c, 0x3f6, 0xffffff35, 0x9, 0x7f, 0x6, 0x42, 0x6, 0x3, 0x8, 0xde, 0x0, 0x5, 0x7, 0x9, 0x4, 0x8, 0x80000001, 0x3, 0x1, 0x7, 0x3, 0x1, 0x64a4a95f, 0x7, 0x1000, 0x4, 0x101, 0x5, 0x80, 0x7fff, 0x7, 0x14, 0x1ff, 0xee, 0x0, 0x3, 0xffffffe1, 0x81, 0x7fff, 0x9, 0x6, 0x0, 0x401, 0x7, 0x3f, 0x9, 0x7fffffff, 0x1f, 0x3, 0x7, 0x9, 0x40, 0x30000, 0x4, 0x401, 0x8, 0x0, 0x7fff, 0x1ff, 0x20], [0x1f, 0x5, 0x7, 0x4036, 0x2, 0xfffffff9, 0x7, 0x45, 0x7fffffff, 0x6, 0x9, 0x8, 0x1, 0x7ff, 0x8, 0xfffffff8, 0x2ffac02c, 0x80, 0x100, 0xff, 0x800, 0x3, 0x9, 0x3, 0xffffffff, 0x2, 0x3, 0x0, 0x2ff, 0x5, 0x7f, 0x20, 0x3, 0x2, 0x6, 0xbd3b, 0x2, 0xfffffffb, 0x7f, 0x7, 0x8000, 0x5, 0xfffffffe, 0x8000, 0x3, 0x8, 0x5c, 0x40, 0x8, 0x200, 0x8, 0x8000, 0xe7b, 0x80000000, 0x9, 0x7ff, 0xfffffffa, 0x1, 0xf418, 0x100, 0x2722, 0x3, 0x7ff, 0xff], [0x1d47a776, 0x2, 0x6, 0x8, 0x7f, 0x3, 0x9, 0x1000, 0x40, 0x1ff, 0xfffffff7, 0x0, 0x6, 0x80, 0x90000, 0x11, 0x3, 0x3, 0x5, 0x1, 0x3ff, 0x100, 0x450, 0xffff8001, 0x400, 0x7, 0x8, 0x7, 0x2, 0x2, 0x20, 0x0, 0x9, 0x4, 0x800, 0xd7, 0x10001, 0x8, 0xfff, 0x1, 0x3, 0x7f, 0xd76b, 0xee, 0x5, 0x4, 0x2, 0x9, 0x8, 0x8, 0x2, 0x0, 0x9fc9, 0x9, 0x8, 0x2, 0x0, 0x0, 0xffff, 0x9, 0x95e1, 0x0, 0x0, 0x101]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x7) ioctl$UI_DEV_CREATE(r0, 0x5501) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000c40), 0x802, 0x0) ioctl$UI_GET_SYSNAME(r2, 0x8040552c, &(0x7f0000000c80)) futex(&(0x7f0000000cc0)=0x1, 0x0, 0x0, &(0x7f0000000d00), &(0x7f0000000d40)=0x2, 0x0) write$P9_RXATTRWALK(0xffffffffffffffff, &(0x7f0000000dc0)={0xf, 0x1f, 0x2, 0x8}, 0xf) 14:38:00 executing program 0: clock_getres(0x4, &(0x7f0000000000)) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$UI_SET_SWBIT(r0, 0x4004556d, 0x0) clock_gettime(0x4, &(0x7f0000000080)) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) setsockopt$bt_hci_HCI_DATA_DIR(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000000c0)=0x81, 0x4) clock_getres(0x6, &(0x7f0000000100)) write$uinput_user_dev(r0, &(0x7f0000000140)={'syz1\x00', {0x800, 0x19, 0x100, 0x6}, 0xf, [0x5, 0xfffff800, 0xe, 0x8, 0x9, 0x1, 0x40, 0xff, 0x0, 0x1, 0xa87, 0xfffffffb, 0x8, 0x9, 0x7, 0x1, 0x1, 0x80000000, 0xfffffffe, 0x4, 0x3b, 0x7ff, 0x1, 0x5, 0xffffffff, 0x0, 0x7, 0x4, 0x7d0, 0x3b, 0x1ff, 0xffff, 0x5f0b, 0x7, 0xfffff000, 0x1, 0xa5, 0x6, 0x6, 0x10001, 0x2, 0xffffffff, 0xfc91, 0x0, 0x6, 0xfffffff8, 0xdca7, 0x2, 0xc0d, 0x80000000, 0x6, 0xffffffff, 0x0, 0x401, 0x3, 0x7, 0x2, 0x0, 0xfffffffc, 0x7ff, 0x7, 0x6, 0xf0a5, 0x81], [0x1c, 0x4, 0x1, 0xa86e, 0x8001, 0x100, 0x3, 0x5, 0x1, 0x6, 0x3568, 0x0, 0x9, 0x6, 0x7fffffff, 0x6f, 0x103, 0x4, 0xffa, 0x4, 0x0, 0x81, 0x2, 0x81f, 0x75ad, 0x4, 0x1873, 0x72e, 0x1, 0xd1, 0x6, 0x0, 0x83, 0x9, 0xc5e, 0x10000, 0x0, 0x1, 0x6, 0x9de, 0x3ff, 0x7f, 0x7, 0x8000, 0xf4c, 0x0, 0x8, 0x3f, 0x1, 0x80000001, 0xffffffff, 0xfffffffb, 0x6, 0x4d1, 0x6, 0x4, 0x5, 0xff, 0x1, 0x9, 0x6, 0x3, 0xffffffff, 0x3], [0xcd, 0x3, 0xf, 0x80000000, 0x5, 0x7, 0x1, 0x7, 0x80000000, 0x0, 0x4, 0x4, 0x7, 0x1, 0x1, 0x0, 0x8, 0x1, 0x855, 0x5, 0x75ae, 0x4411, 0x8, 0xffff, 0x200, 0x7, 0xc4, 0x11fedc7, 0xffff, 0x101, 0xffffffff, 0x7fff, 0x0, 0xffffffff, 0xf30, 0x7, 0x6, 0x2, 0x3f, 0x40000000, 0x23, 0x0, 0x21, 0x1, 0x5, 0x6, 0x401, 0x53f, 0x1, 0x10000, 0x800, 0x2, 0x0, 0x800, 0x7, 0x0, 0x7, 0x1, 0x3, 0x50000000, 0x10000, 0xffffffff, 0x2, 0x3], [0x4, 0x0, 0xffff, 0xc82d, 0xe02, 0x80000000, 0x2, 0xff, 0x5, 0x4, 0x5a, 0x80000000, 0x1ff, 0x4, 0x2, 0x89, 0x5, 0x4, 0x81, 0x5, 0xfffffeff, 0x9, 0x0, 0xb8e, 0x79ed, 0x4, 0x4, 0x1ff, 0x0, 0xde, 0x80, 0x3, 0x4, 0x5, 0x10001, 0x3f, 0x8001, 0x2, 0xdf56, 0xffff, 0x4, 0x52, 0x6, 0x7ff, 0x80000001, 0x4, 0x5, 0x8, 0x1, 0x31f24a7, 0x5, 0x1ff, 0x4f, 0x3, 0x100, 0x80000001, 0xfff, 0xd9f, 0x6f, 0x7, 0x1, 0x1, 0x9, 0x227d]}, 0x45c) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT(0xffffffffffffffff, 0x28, 0x6, &(0x7f00000005c0)={0x77359400}, 0x10) capset(&(0x7f0000000600)={0xf1504}, &(0x7f0000000640)={0x0, 0x1, 0x20, 0x20, 0x3, 0xffffffff}) select(0x40, &(0x7f0000000680)={0x5, 0x9, 0xf84, 0xfffffffffffffffc, 0x1ff, 0xded, 0xb1, 0x2}, &(0x7f00000006c0)={0xe0000000000000, 0x4, 0x3, 0x7, 0x49b5, 0x7, 0xffffffff00000000, 0x6}, &(0x7f0000000700)={0xfffffffffffffffd, 0x100000001, 0x5, 0xcdb, 0x3ff, 0x81, 0x81, 0x7c0}, &(0x7f0000000740)={0x0, 0xea60}) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000780), 0x802, 0x0) write$uinput_user_dev(r1, &(0x7f00000007c0)={'syz1\x00', {0x2, 0x9a, 0x9, 0x8}, 0x14, [0x8000, 0x52, 0x8, 0x8, 0x7, 0xfff, 0x1, 0x7fffffff, 0x10001, 0x10001, 0x4, 0x2, 0x10000, 0x1000, 0x8, 0x0, 0x1, 0x4, 0x10000, 0x6, 0x8e, 0xffffffff, 0x7, 0xd23, 0xfd67, 0x20000000, 0x800, 0x7, 0x10001, 0x8, 0x0, 0x2, 0x6, 0xfffffffa, 0x3f, 0x4, 0xfffffff8, 0x1f, 0x3, 0x418, 0x8, 0x1f, 0x101, 0x2a, 0x1f, 0x4, 0x80000000, 0x9, 0x2, 0x7, 0x0, 0x10000, 0x5, 0x8000, 0x3, 0x4, 0x63b, 0x0, 0x7fff, 0xdb33, 0xe6f4, 0x5, 0x7, 0x1000], [0x1, 0x40000000, 0x800, 0xfa9c, 0x3f6, 0xffffff35, 0x9, 0x7f, 0x6, 0x42, 0x6, 0x3, 0x8, 0xde, 0x0, 0x5, 0x7, 0x9, 0x4, 0x8, 0x80000001, 0x3, 0x1, 0x7, 0x3, 0x1, 0x64a4a95f, 0x7, 0x1000, 0x4, 0x101, 0x5, 0x80, 0x7fff, 0x7, 0x14, 0x1ff, 0xee, 0x0, 0x3, 0xffffffe1, 0x81, 0x7fff, 0x9, 0x6, 0x0, 0x401, 0x7, 0x3f, 0x9, 0x7fffffff, 0x1f, 0x3, 0x7, 0x9, 0x40, 0x30000, 0x4, 0x401, 0x8, 0x0, 0x7fff, 0x1ff, 0x20], [0x1f, 0x5, 0x7, 0x4036, 0x2, 0xfffffff9, 0x7, 0x45, 0x7fffffff, 0x6, 0x9, 0x8, 0x1, 0x7ff, 0x8, 0xfffffff8, 0x2ffac02c, 0x80, 0x100, 0xff, 0x800, 0x3, 0x9, 0x3, 0xffffffff, 0x2, 0x3, 0x0, 0x2ff, 0x5, 0x7f, 0x20, 0x3, 0x2, 0x6, 0xbd3b, 0x2, 0xfffffffb, 0x7f, 0x7, 0x8000, 0x5, 0xfffffffe, 0x8000, 0x3, 0x8, 0x5c, 0x40, 0x8, 0x200, 0x8, 0x8000, 0xe7b, 0x80000000, 0x9, 0x7ff, 0xfffffffa, 0x1, 0xf418, 0x100, 0x2722, 0x3, 0x7ff, 0xff], [0x1d47a776, 0x2, 0x6, 0x8, 0x7f, 0x3, 0x9, 0x1000, 0x40, 0x1ff, 0xfffffff7, 0x0, 0x6, 0x80, 0x90000, 0x11, 0x3, 0x3, 0x5, 0x1, 0x3ff, 0x100, 0x450, 0xffff8001, 0x400, 0x7, 0x8, 0x7, 0x2, 0x2, 0x20, 0x0, 0x9, 0x4, 0x800, 0xd7, 0x10001, 0x8, 0xfff, 0x1, 0x3, 0x7f, 0xd76b, 0xee, 0x5, 0x4, 0x2, 0x9, 0x8, 0x8, 0x2, 0x0, 0x9fc9, 0x9, 0x8, 0x2, 0x0, 0x0, 0xffff, 0x9, 0x95e1, 0x0, 0x0, 0x101]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x7) ioctl$UI_DEV_CREATE(r0, 0x5501) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000c40), 0x802, 0x0) ioctl$UI_GET_SYSNAME(r2, 0x8040552c, &(0x7f0000000c80)) write$P9_RXATTRWALK(0xffffffffffffffff, &(0x7f0000000dc0)={0xf, 0x1f, 0x2, 0x8}, 0xf) [ 24.384341][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.396599][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.403663][ T351] input: syz1 as /devices/virtual/input/input19 [ 24.411406][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.421519][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready 14:38:01 executing program 0: clock_getres(0x4, &(0x7f0000000000)) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$UI_SET_SWBIT(r0, 0x4004556d, 0x0) clock_gettime(0x4, &(0x7f0000000080)) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) setsockopt$bt_hci_HCI_DATA_DIR(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000000c0)=0x81, 0x4) clock_getres(0x6, &(0x7f0000000100)) write$uinput_user_dev(r0, &(0x7f0000000140)={'syz1\x00', {0x800, 0x19, 0x100, 0x6}, 0xf, [0x5, 0xfffff800, 0xe, 0x8, 0x9, 0x1, 0x40, 0xff, 0x0, 0x1, 0xa87, 0xfffffffb, 0x8, 0x9, 0x7, 0x1, 0x1, 0x80000000, 0xfffffffe, 0x4, 0x3b, 0x7ff, 0x1, 0x5, 0xffffffff, 0x0, 0x7, 0x4, 0x7d0, 0x3b, 0x1ff, 0xffff, 0x5f0b, 0x7, 0xfffff000, 0x1, 0xa5, 0x6, 0x6, 0x10001, 0x2, 0xffffffff, 0xfc91, 0x0, 0x6, 0xfffffff8, 0xdca7, 0x2, 0xc0d, 0x80000000, 0x6, 0xffffffff, 0x0, 0x401, 0x3, 0x7, 0x2, 0x0, 0xfffffffc, 0x7ff, 0x7, 0x6, 0xf0a5, 0x81], [0x1c, 0x4, 0x1, 0xa86e, 0x8001, 0x100, 0x3, 0x5, 0x1, 0x6, 0x3568, 0x0, 0x9, 0x6, 0x7fffffff, 0x6f, 0x103, 0x4, 0xffa, 0x4, 0x0, 0x81, 0x2, 0x81f, 0x75ad, 0x4, 0x1873, 0x72e, 0x1, 0xd1, 0x6, 0x0, 0x83, 0x9, 0xc5e, 0x10000, 0x0, 0x1, 0x6, 0x9de, 0x3ff, 0x7f, 0x7, 0x8000, 0xf4c, 0x0, 0x8, 0x3f, 0x1, 0x80000001, 0xffffffff, 0xfffffffb, 0x6, 0x4d1, 0x6, 0x4, 0x5, 0xff, 0x1, 0x9, 0x6, 0x3, 0xffffffff, 0x3], [0xcd, 0x3, 0xf, 0x80000000, 0x5, 0x7, 0x1, 0x7, 0x80000000, 0x0, 0x4, 0x4, 0x7, 0x1, 0x1, 0x0, 0x8, 0x1, 0x855, 0x5, 0x75ae, 0x4411, 0x8, 0xffff, 0x200, 0x7, 0xc4, 0x11fedc7, 0xffff, 0x101, 0xffffffff, 0x7fff, 0x0, 0xffffffff, 0xf30, 0x7, 0x6, 0x2, 0x3f, 0x40000000, 0x23, 0x0, 0x21, 0x1, 0x5, 0x6, 0x401, 0x53f, 0x1, 0x10000, 0x800, 0x2, 0x0, 0x800, 0x7, 0x0, 0x7, 0x1, 0x3, 0x50000000, 0x10000, 0xffffffff, 0x2, 0x3], [0x4, 0x0, 0xffff, 0xc82d, 0xe02, 0x80000000, 0x2, 0xff, 0x5, 0x4, 0x5a, 0x80000000, 0x1ff, 0x4, 0x2, 0x89, 0x5, 0x4, 0x81, 0x5, 0xfffffeff, 0x9, 0x0, 0xb8e, 0x79ed, 0x4, 0x4, 0x1ff, 0x0, 0xde, 0x80, 0x3, 0x4, 0x5, 0x10001, 0x3f, 0x8001, 0x2, 0xdf56, 0xffff, 0x4, 0x52, 0x6, 0x7ff, 0x80000001, 0x4, 0x5, 0x8, 0x1, 0x31f24a7, 0x5, 0x1ff, 0x4f, 0x3, 0x100, 0x80000001, 0xfff, 0xd9f, 0x6f, 0x7, 0x1, 0x1, 0x9, 0x227d]}, 0x45c) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT(0xffffffffffffffff, 0x28, 0x6, &(0x7f00000005c0)={0x77359400}, 0x10) capset(&(0x7f0000000600)={0xf1504}, &(0x7f0000000640)={0x0, 0x1, 0x20, 0x20, 0x3, 0xffffffff}) select(0x40, &(0x7f0000000680)={0x5, 0x9, 0xf84, 0xfffffffffffffffc, 0x1ff, 0xded, 0xb1, 0x2}, &(0x7f00000006c0)={0xe0000000000000, 0x4, 0x3, 0x7, 0x49b5, 0x7, 0xffffffff00000000, 0x6}, &(0x7f0000000700)={0xfffffffffffffffd, 0x100000001, 0x5, 0xcdb, 0x3ff, 0x81, 0x81, 0x7c0}, &(0x7f0000000740)={0x0, 0xea60}) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000780), 0x802, 0x0) write$uinput_user_dev(r1, &(0x7f00000007c0)={'syz1\x00', {0x2, 0x9a, 0x9, 0x8}, 0x14, [0x8000, 0x52, 0x8, 0x8, 0x7, 0xfff, 0x1, 0x7fffffff, 0x10001, 0x10001, 0x4, 0x2, 0x10000, 0x1000, 0x8, 0x0, 0x1, 0x4, 0x10000, 0x6, 0x8e, 0xffffffff, 0x7, 0xd23, 0xfd67, 0x20000000, 0x800, 0x7, 0x10001, 0x8, 0x0, 0x2, 0x6, 0xfffffffa, 0x3f, 0x4, 0xfffffff8, 0x1f, 0x3, 0x418, 0x8, 0x1f, 0x101, 0x2a, 0x1f, 0x4, 0x80000000, 0x9, 0x2, 0x7, 0x0, 0x10000, 0x5, 0x8000, 0x3, 0x4, 0x63b, 0x0, 0x7fff, 0xdb33, 0xe6f4, 0x5, 0x7, 0x1000], [0x1, 0x40000000, 0x800, 0xfa9c, 0x3f6, 0xffffff35, 0x9, 0x7f, 0x6, 0x42, 0x6, 0x3, 0x8, 0xde, 0x0, 0x5, 0x7, 0x9, 0x4, 0x8, 0x80000001, 0x3, 0x1, 0x7, 0x3, 0x1, 0x64a4a95f, 0x7, 0x1000, 0x4, 0x101, 0x5, 0x80, 0x7fff, 0x7, 0x14, 0x1ff, 0xee, 0x0, 0x3, 0xffffffe1, 0x81, 0x7fff, 0x9, 0x6, 0x0, 0x401, 0x7, 0x3f, 0x9, 0x7fffffff, 0x1f, 0x3, 0x7, 0x9, 0x40, 0x30000, 0x4, 0x401, 0x8, 0x0, 0x7fff, 0x1ff, 0x20], [0x1f, 0x5, 0x7, 0x4036, 0x2, 0xfffffff9, 0x7, 0x45, 0x7fffffff, 0x6, 0x9, 0x8, 0x1, 0x7ff, 0x8, 0xfffffff8, 0x2ffac02c, 0x80, 0x100, 0xff, 0x800, 0x3, 0x9, 0x3, 0xffffffff, 0x2, 0x3, 0x0, 0x2ff, 0x5, 0x7f, 0x20, 0x3, 0x2, 0x6, 0xbd3b, 0x2, 0xfffffffb, 0x7f, 0x7, 0x8000, 0x5, 0xfffffffe, 0x8000, 0x3, 0x8, 0x5c, 0x40, 0x8, 0x200, 0x8, 0x8000, 0xe7b, 0x80000000, 0x9, 0x7ff, 0xfffffffa, 0x1, 0xf418, 0x100, 0x2722, 0x3, 0x7ff, 0xff], [0x1d47a776, 0x2, 0x6, 0x8, 0x7f, 0x3, 0x9, 0x1000, 0x40, 0x1ff, 0xfffffff7, 0x0, 0x6, 0x80, 0x90000, 0x11, 0x3, 0x3, 0x5, 0x1, 0x3ff, 0x100, 0x450, 0xffff8001, 0x400, 0x7, 0x8, 0x7, 0x2, 0x2, 0x20, 0x0, 0x9, 0x4, 0x800, 0xd7, 0x10001, 0x8, 0xfff, 0x1, 0x3, 0x7f, 0xd76b, 0xee, 0x5, 0x4, 0x2, 0x9, 0x8, 0x8, 0x2, 0x0, 0x9fc9, 0x9, 0x8, 0x2, 0x0, 0x0, 0xffff, 0x9, 0x95e1, 0x0, 0x0, 0x101]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x7) ioctl$UI_DEV_CREATE(r0, 0x5501) openat$uinput(0xffffffffffffff9c, &(0x7f0000000c40), 0x802, 0x0) write$P9_RXATTRWALK(0xffffffffffffffff, &(0x7f0000000dc0)={0xf, 0x1f, 0x2, 0x8}, 0xf) [ 24.436875][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.441800][ T356] input: syz1 as /devices/virtual/input/input26 [ 24.445438][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.459539][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.468044][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 14:38:01 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) ioctl$UI_SET_KEYBIT(r0, 0x40045565, 0x54) prctl$PR_SET_SECUREBITS(0x1c, 0x8) sendmsg$NL80211_CMD_SET_PMKSA(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x4000015) prctl$PR_SET_SECUREBITS(0x1c, 0x20) r1 = syz_open_dev$vcsa(&(0x7f0000000100), 0x920, 0x240) ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1d6) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000140), 0x802, 0x0) ioctl$UI_SET_EVBIT(r2, 0x40045564, 0x1d) ioctl$UI_BEGIN_FF_UPLOAD(r2, 0xc06855c8, &(0x7f00000001c0)={0x5, 0x9, {0x54, 0xfff8, 0x62, {0x100, 0x9d2}, {0x7ff, 0x101}, @period={0x59, 0x2, 0x3, 0x5, 0x8, {0x4, 0x3f7, 0x9, 0x3d9b}, 0x8, &(0x7f0000000180)=[0xfbe0, 0x31a7, 0x6, 0x3, 0xa9c, 0x1, 0x6145, 0x7]}}, {0x54, 0x20, 0x6, {0x8000, 0x401}, {0x3, 0x3ff}, @ramp={0x2, 0x3e5c, {0x1, 0x4, 0x3, 0x1000}}}}) r3 = syz_open_dev$vcsa(&(0x7f0000000240), 0x6, 0x111000) ioctl$UI_SET_PHYS(r3, 0x4008556c, &(0x7f0000000280)='syz1\x00') r4 = openat$uinput(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) clock_gettime(0x0, &(0x7f0000000300)={0x0, 0x0}) write$input_event(r4, &(0x7f0000000340)={{r5, r6/1000+10000}, 0x1, 0xfff7}, 0x18) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r1) ioctl$UI_END_FF_ERASE(r4, 0x400c55cb, &(0x7f00000003c0)={0x5, 0x4, 0x1}) r7 = syz_open_pts(r1, 0x218040) ioctl$TIOCSETD(r7, 0x5423, &(0x7f0000000400)=0x16) ioctl$TIOCCBRK(0xffffffffffffffff, 0x5428) [ 24.490458][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.494568][ T359] input: syz1 as /devices/virtual/input/input30 [ 24.525198][ T337] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.555287][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.564328][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.577099][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.585840][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.594434][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.613657][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.621911][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.630164][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.638852][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.647275][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.655480][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.663712][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.671928][ T118] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 14:38:02 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$fou(&(0x7f0000000000), r0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, 0xffffffffffffffff) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) sendmsg$NL80211_CMD_DISASSOCIATE(r0, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)={0x164, r1, 0x400, 0x70bd2c, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_IE={0x14d, 0x2a, [@link_id={0x65, 0x12, {@from_mac, @device_a, @broadcast}}, @ssid={0x0, 0x6, @default_ibss_ssid}, @supported_rates={0x1, 0x6, [{0x29}, {0x30, 0x1}, {0x5}, {0x1}, {0x4}, {0x4, 0x1}]}, @tim={0x5, 0xc0, {0x7, 0x68, 0x80, "61657e60f0801a300509aab918ab1971761a963dd21eb9e9c9024899cca7173fff84acb5125eef28533baeb1d9fda0d6669cc46ce466affeb608cbf1fe42d44a07d717b07203f58dc1c6f7355c1fc80ce920418fdcaadfb61589d8fc9f9bffa45113d826d1b5f403b18c2b55a83a0ab727c4d8f3ba995882944dfd7e7b71a7d6b910b06173fca2d1c86a9adec4a962145f1bb9a95e974795a6ac80352c76d60f8de261d13a3cc1414b28ce86f725c97c5c24154048d4dab242e3e8fa86"}}, @link_id={0x65, 0x12, {@random="ae81ff7d5170", @broadcast}}, @ibss={0x6, 0x2, 0xc81c}, @random={0x1, 0x3c, "7045311358996128f2395883547f6b80b2fd27a9f69591031ecd896f20eeb76ad877ab6038afa87a277368ce754cf5ed8866f880e8a8be8ff4db00ef"}, @gcr_ga={0xbd, 0x6, @device_b}, @channel_switch={0x25, 0x3, {0x1, 0x8c, 0xa2}}]}]}, 0x164}, 0x1, 0x0, 0x0, 0xc814}, 0xc040) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TDLS_CHANNEL_SWITCH(r0, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x58, r1, 0x2, 0x70bd27, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x400, 0x3b}}}}, [@NL80211_ATTR_OPER_CLASS={0x5, 0xd6, 0x3}, @chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0xb}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x3c7}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x1}], @NL80211_ATTR_OPER_CLASS={0x5, 0xd6, 0x34}]}, 0x58}}, 0x10000080) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000480), r2) sendmsg$NL80211_CMD_TDLS_CHANNEL_SWITCH(r2, &(0x7f0000000580)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000540)={&(0x7f00000004c0)={0x64, r4, 0x300, 0x70bd27, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x80, 0x53}}}}, [@NL80211_ATTR_OPER_CLASS={0x5, 0xd6, 0x1}, @NL80211_ATTR_OPER_CLASS={0x5}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_OPER_CLASS={0x5, 0xd6, 0x1}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x64}, 0x1, 0x0, 0x0, 0x2000000}, 0x40000) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_RELOAD_REGDB(r5, &(0x7f0000000680)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x400802}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x14, r1, 0x4, 0x70bd28, 0x25dfdbff, {}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x840) r6 = syz_open_dev$vcsa(&(0x7f00000006c0), 0xfffffffffffeffff, 0x20103) sendmsg$NL80211_CMD_DEL_STATION(r6, &(0x7f0000000800)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000740)={0x6c, r4, 0x8, 0x70bd2c, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_STA_WME={0x2c, 0x81, [@NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0x6}, @NL80211_STA_WME_MAX_SP={0x5}, @NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0x2}, @NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0x9}, @NL80211_STA_WME_MAX_SP={0x5, 0x2, 0x3}]}, @NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x723}, @NL80211_ATTR_AIRTIME_WEIGHT={0x6, 0x112, 0x1}, @NL80211_ATTR_STA_WME={0x14, 0x81, [@NL80211_STA_WME_MAX_SP={0x5, 0x2, 0x7e}, @NL80211_STA_WME_MAX_SP={0x5, 0x2, 0x3}]}, @NL80211_ATTR_LOCAL_MESH_POWER_MODE={0x8, 0xa4, 0x2}]}, 0x6c}, 0x1, 0x0, 0x0, 0x8040}, 0x8000) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NET_DM_CMD_STOP(r7, &(0x7f0000000900)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000880)={0x14, 0x0, 0x10, 0x70bd2c, 0x25dfdbfb, {}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) getpgrp(0xffffffffffffffff) sendmsg$NL80211_CMD_START_P2P_DEVICE(r5, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x28, r4, 0x100, 0x70bd26, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x0, 0xe}}}}, ["", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x810}, 0x400c014) prctl$PR_SCHED_CORE(0x3e, 0x1, 0xffffffffffffffff, 0x0, &(0x7f0000000a40)) sendmsg$NL80211_CMD_RELOAD_REGDB(r5, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14, r4, 0x1, 0x70bd28, 0x25dfdbfe, {}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4040881}, 0x0) 14:38:02 executing program 0: clock_getres(0x4, &(0x7f0000000000)) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$UI_SET_SWBIT(r0, 0x4004556d, 0x0) clock_gettime(0x4, &(0x7f0000000080)) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) setsockopt$bt_hci_HCI_DATA_DIR(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000000c0)=0x81, 0x4) clock_getres(0x6, &(0x7f0000000100)) write$uinput_user_dev(r0, &(0x7f0000000140)={'syz1\x00', {0x800, 0x19, 0x100, 0x6}, 0xf, [0x5, 0xfffff800, 0xe, 0x8, 0x9, 0x1, 0x40, 0xff, 0x0, 0x1, 0xa87, 0xfffffffb, 0x8, 0x9, 0x7, 0x1, 0x1, 0x80000000, 0xfffffffe, 0x4, 0x3b, 0x7ff, 0x1, 0x5, 0xffffffff, 0x0, 0x7, 0x4, 0x7d0, 0x3b, 0x1ff, 0xffff, 0x5f0b, 0x7, 0xfffff000, 0x1, 0xa5, 0x6, 0x6, 0x10001, 0x2, 0xffffffff, 0xfc91, 0x0, 0x6, 0xfffffff8, 0xdca7, 0x2, 0xc0d, 0x80000000, 0x6, 0xffffffff, 0x0, 0x401, 0x3, 0x7, 0x2, 0x0, 0xfffffffc, 0x7ff, 0x7, 0x6, 0xf0a5, 0x81], [0x1c, 0x4, 0x1, 0xa86e, 0x8001, 0x100, 0x3, 0x5, 0x1, 0x6, 0x3568, 0x0, 0x9, 0x6, 0x7fffffff, 0x6f, 0x103, 0x4, 0xffa, 0x4, 0x0, 0x81, 0x2, 0x81f, 0x75ad, 0x4, 0x1873, 0x72e, 0x1, 0xd1, 0x6, 0x0, 0x83, 0x9, 0xc5e, 0x10000, 0x0, 0x1, 0x6, 0x9de, 0x3ff, 0x7f, 0x7, 0x8000, 0xf4c, 0x0, 0x8, 0x3f, 0x1, 0x80000001, 0xffffffff, 0xfffffffb, 0x6, 0x4d1, 0x6, 0x4, 0x5, 0xff, 0x1, 0x9, 0x6, 0x3, 0xffffffff, 0x3], [0xcd, 0x3, 0xf, 0x80000000, 0x5, 0x7, 0x1, 0x7, 0x80000000, 0x0, 0x4, 0x4, 0x7, 0x1, 0x1, 0x0, 0x8, 0x1, 0x855, 0x5, 0x75ae, 0x4411, 0x8, 0xffff, 0x200, 0x7, 0xc4, 0x11fedc7, 0xffff, 0x101, 0xffffffff, 0x7fff, 0x0, 0xffffffff, 0xf30, 0x7, 0x6, 0x2, 0x3f, 0x40000000, 0x23, 0x0, 0x21, 0x1, 0x5, 0x6, 0x401, 0x53f, 0x1, 0x10000, 0x800, 0x2, 0x0, 0x800, 0x7, 0x0, 0x7, 0x1, 0x3, 0x50000000, 0x10000, 0xffffffff, 0x2, 0x3], [0x4, 0x0, 0xffff, 0xc82d, 0xe02, 0x80000000, 0x2, 0xff, 0x5, 0x4, 0x5a, 0x80000000, 0x1ff, 0x4, 0x2, 0x89, 0x5, 0x4, 0x81, 0x5, 0xfffffeff, 0x9, 0x0, 0xb8e, 0x79ed, 0x4, 0x4, 0x1ff, 0x0, 0xde, 0x80, 0x3, 0x4, 0x5, 0x10001, 0x3f, 0x8001, 0x2, 0xdf56, 0xffff, 0x4, 0x52, 0x6, 0x7ff, 0x80000001, 0x4, 0x5, 0x8, 0x1, 0x31f24a7, 0x5, 0x1ff, 0x4f, 0x3, 0x100, 0x80000001, 0xfff, 0xd9f, 0x6f, 0x7, 0x1, 0x1, 0x9, 0x227d]}, 0x45c) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT(0xffffffffffffffff, 0x28, 0x6, &(0x7f00000005c0)={0x77359400}, 0x10) capset(&(0x7f0000000600)={0xf1504}, &(0x7f0000000640)={0x0, 0x1, 0x20, 0x20, 0x3, 0xffffffff}) select(0x40, &(0x7f0000000680)={0x5, 0x9, 0xf84, 0xfffffffffffffffc, 0x1ff, 0xded, 0xb1, 0x2}, &(0x7f00000006c0)={0xe0000000000000, 0x4, 0x3, 0x7, 0x49b5, 0x7, 0xffffffff00000000, 0x6}, &(0x7f0000000700)={0xfffffffffffffffd, 0x100000001, 0x5, 0xcdb, 0x3ff, 0x81, 0x81, 0x7c0}, &(0x7f0000000740)={0x0, 0xea60}) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000780), 0x802, 0x0) write$uinput_user_dev(r1, &(0x7f00000007c0)={'syz1\x00', {0x2, 0x9a, 0x9, 0x8}, 0x14, [0x8000, 0x52, 0x8, 0x8, 0x7, 0xfff, 0x1, 0x7fffffff, 0x10001, 0x10001, 0x4, 0x2, 0x10000, 0x1000, 0x8, 0x0, 0x1, 0x4, 0x10000, 0x6, 0x8e, 0xffffffff, 0x7, 0xd23, 0xfd67, 0x20000000, 0x800, 0x7, 0x10001, 0x8, 0x0, 0x2, 0x6, 0xfffffffa, 0x3f, 0x4, 0xfffffff8, 0x1f, 0x3, 0x418, 0x8, 0x1f, 0x101, 0x2a, 0x1f, 0x4, 0x80000000, 0x9, 0x2, 0x7, 0x0, 0x10000, 0x5, 0x8000, 0x3, 0x4, 0x63b, 0x0, 0x7fff, 0xdb33, 0xe6f4, 0x5, 0x7, 0x1000], [0x1, 0x40000000, 0x800, 0xfa9c, 0x3f6, 0xffffff35, 0x9, 0x7f, 0x6, 0x42, 0x6, 0x3, 0x8, 0xde, 0x0, 0x5, 0x7, 0x9, 0x4, 0x8, 0x80000001, 0x3, 0x1, 0x7, 0x3, 0x1, 0x64a4a95f, 0x7, 0x1000, 0x4, 0x101, 0x5, 0x80, 0x7fff, 0x7, 0x14, 0x1ff, 0xee, 0x0, 0x3, 0xffffffe1, 0x81, 0x7fff, 0x9, 0x6, 0x0, 0x401, 0x7, 0x3f, 0x9, 0x7fffffff, 0x1f, 0x3, 0x7, 0x9, 0x40, 0x30000, 0x4, 0x401, 0x8, 0x0, 0x7fff, 0x1ff, 0x20], [0x1f, 0x5, 0x7, 0x4036, 0x2, 0xfffffff9, 0x7, 0x45, 0x7fffffff, 0x6, 0x9, 0x8, 0x1, 0x7ff, 0x8, 0xfffffff8, 0x2ffac02c, 0x80, 0x100, 0xff, 0x800, 0x3, 0x9, 0x3, 0xffffffff, 0x2, 0x3, 0x0, 0x2ff, 0x5, 0x7f, 0x20, 0x3, 0x2, 0x6, 0xbd3b, 0x2, 0xfffffffb, 0x7f, 0x7, 0x8000, 0x5, 0xfffffffe, 0x8000, 0x3, 0x8, 0x5c, 0x40, 0x8, 0x200, 0x8, 0x8000, 0xe7b, 0x80000000, 0x9, 0x7ff, 0xfffffffa, 0x1, 0xf418, 0x100, 0x2722, 0x3, 0x7ff, 0xff], [0x1d47a776, 0x2, 0x6, 0x8, 0x7f, 0x3, 0x9, 0x1000, 0x40, 0x1ff, 0xfffffff7, 0x0, 0x6, 0x80, 0x90000, 0x11, 0x3, 0x3, 0x5, 0x1, 0x3ff, 0x100, 0x450, 0xffff8001, 0x400, 0x7, 0x8, 0x7, 0x2, 0x2, 0x20, 0x0, 0x9, 0x4, 0x800, 0xd7, 0x10001, 0x8, 0xfff, 0x1, 0x3, 0x7f, 0xd76b, 0xee, 0x5, 0x4, 0x2, 0x9, 0x8, 0x8, 0x2, 0x0, 0x9fc9, 0x9, 0x8, 0x2, 0x0, 0x0, 0xffff, 0x9, 0x95e1, 0x0, 0x0, 0x101]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x7) ioctl$UI_DEV_CREATE(r0, 0x5501) write$P9_RXATTRWALK(0xffffffffffffffff, &(0x7f0000000dc0)={0xf, 0x1f, 0x2, 0x8}, 0xf) 14:38:02 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) ioctl$UI_SET_KEYBIT(r0, 0x40045565, 0x54) prctl$PR_SET_SECUREBITS(0x1c, 0x8) sendmsg$NL80211_CMD_SET_PMKSA(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x4000015) prctl$PR_SET_SECUREBITS(0x1c, 0x20) r1 = syz_open_dev$vcsa(&(0x7f0000000100), 0x920, 0x240) ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1d6) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000140), 0x802, 0x0) ioctl$UI_SET_EVBIT(r2, 0x40045564, 0x1d) ioctl$UI_BEGIN_FF_UPLOAD(r2, 0xc06855c8, &(0x7f00000001c0)={0x5, 0x9, {0x54, 0xfff8, 0x62, {0x100, 0x9d2}, {0x7ff, 0x101}, @period={0x59, 0x2, 0x3, 0x5, 0x8, {0x4, 0x3f7, 0x9, 0x3d9b}, 0x8, &(0x7f0000000180)=[0xfbe0, 0x31a7, 0x6, 0x3, 0xa9c, 0x1, 0x6145, 0x7]}}, {0x54, 0x20, 0x6, {0x8000, 0x401}, {0x3, 0x3ff}, @ramp={0x2, 0x3e5c, {0x1, 0x4, 0x3, 0x1000}}}}) r3 = syz_open_dev$vcsa(&(0x7f0000000240), 0x6, 0x111000) ioctl$UI_SET_PHYS(r3, 0x4008556c, &(0x7f0000000280)='syz1\x00') r4 = openat$uinput(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) clock_gettime(0x0, &(0x7f0000000300)={0x0, 0x0}) write$input_event(r4, &(0x7f0000000340)={{r5, r6/1000+10000}, 0x1, 0xfff7}, 0x18) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r1) ioctl$UI_END_FF_ERASE(r4, 0x400c55cb, &(0x7f00000003c0)={0x5, 0x4, 0x1}) r7 = syz_open_pts(r1, 0x218040) ioctl$TIOCSETD(r7, 0x5423, &(0x7f0000000400)=0x16) ioctl$TIOCCBRK(0xffffffffffffffff, 0x5428) 14:38:02 executing program 4: r0 = socket(0x0, 0x1, 0x2) sendmsg$NL80211_CMD_GET_KEY(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x7c, 0x0, 0xc30, 0x70bd28, 0x25dfdbfb, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac05}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "b98e1c15b9504b03c1de98fdff"}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "a448a9969794224f53b27f76e3"}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac01}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "0c2e0e097645692b3641dbc8ff"}]}, 0x7c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10000) io_uring_setup(0x3d2a, &(0x7f0000000140)={0x0, 0xee28, 0x2, 0x2, 0xf5}) r1 = syz_open_dev$vcsa(&(0x7f00000001c0), 0x8, 0x402082) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEL_STATION(r1, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x54, 0x0, 0x800, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_STA_TX_POWER_SETTING={0x5, 0x113, 0x1}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x9d}, @NL80211_ATTR_STA_FLAGS2={0xc, 0x43, {0x7}}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_AIRTIME_WEIGHT={0x6, 0x112, 0x6}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x7012}]}, 0x54}, 0x1, 0x0, 0x0, 0x20000000}, 0x4040004) sendmsg$NL80211_CMD_GET_MPP(r1, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x44, 0x0, 0x2, 0x70bd25, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}]}, 0x44}, 0x1, 0x0, 0x0, 0x804}, 0x81) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r1, 0x40082102, &(0x7f00000004c0)) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000580)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_MCAST_RATE(r1, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x40, r3, 0x300, 0x70bd2d, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0x8, 0x61}}}}, [@NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x21c}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0xf0}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x78}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000010}, 0x1010) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f00000007c0)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000780)={&(0x7f00000006c0)={0xac, r3, 0x10, 0x70bd2a, 0x25dfdbfe, {{}, {@void, @void, @val={0xc, 0x99, {0x8000, 0x1a}}}}, [@NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @mon_options=[@NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "694edb82987efca9726b73dbad87aee9c82f5881a01e260e"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "3a6891e4f568a688f298dd323c27c3d5337f12d8da63e512"}, @NL80211_ATTR_MNTR_FLAGS={0x14, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}]}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "b402286e97edaf79b6a5ca4ad38ae0d1859405033784ba8b"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "d11a0cbf38e9334c37895f93e68d51c754bb1b6faa3e765f"}]]}, 0xac}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000000900)={0x3, 0x9, 0x1, 0x4195, 0xdd, 0x8, &(0x7f0000000800)="63f58ea60fe7dd9b64b9d78660f645dfa5779ae6a8b497cfb0441078497694e79203c3a069573f0c7b12c0d93febab8b1ba2ca2d951e0b9d8182d058ee8f22353bfecf2e666011b3851e9f916949e18a292547d2cca0da41625139c16d7c060634113556136ff3f94e70dde9f920a1a5b79567f27850358e5a704e657e7505912a6b687db7380cc01c4bda0e7303a5dfa4bc8abdfadcefbcd2ae5c09943c382692f48f967d7ceb6306166902ecbcabb032e0bed88c6b2f700aa406ec1f8175d6d80d0a1bac05373ced80901199b41b51aad80839106297d33b37df84b5"}) r5 = syz_open_dev$vcsa(&(0x7f0000000940), 0x10001, 0x880) sendmsg$NL80211_CMD_SET_REG(r5, &(0x7f0000000a40)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000a00)={&(0x7f00000009c0)={0x24, r3, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8, 0x1, 0x26}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x50}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x20008000) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a80), r0) r7 = syz_open_dev$usbfs(&(0x7f0000000ac0), 0x10000, 0x84000) ioctl$USBDEVFS_CONTROL(r7, 0xc0185500, &(0x7f0000000c00)={0x20, 0x15, 0x400, 0x8c, 0xcb, 0x3, &(0x7f0000000b00)="bb9f37e5f888ed7c5bf4bae605138e599a478480df77808c2c6b73862935705cf1d56bc20ba7a3c6ebcfc9fe0f61e1ccac9e5c9bcaeee7d7f6b5f1579f430ad4f0b632d92fcc3fc71110e0bba4a8b012d132b77360f379455122038ba8cc67f62f0e3e9656eb99b6f79ccc860088b670787669edbc0f4322ae1da014a737b224300f03272c230885ad11d2066a8418773d82c481dcca7c876c8bd177b06772978372fa95f02f2386b63e129010b4c945eb2c159084202ad1f67d49be3c72e91fc56d1e30a717e902cd42ba"}) sendmsg$NL80211_CMD_SET_PMKSA(r0, &(0x7f0000000d00)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r6, 0x4, 0x70bd26, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x2, 0x2d}}}}, [@NL80211_ATTR_PMK_LIFETIME={0x8, 0x11f, 0x7}, @NL80211_ATTR_PMK_REAUTH_THRESHOLD={0x5, 0x120, 0x50}]}, 0x30}, 0x1, 0x0, 0x0, 0x4010}, 0x20000800) sendmsg$NL80211_CMD_NEW_INTERFACE(r5, &(0x7f0000000ec0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000e80)={&(0x7f0000000d80)={0xc8, r3, 0x10, 0x70bd2b, 0x25dfdbfd, {{}, {@void, @void, @val={0xc, 0x99, {0x7fffffff, 0x5e}}}}, [@NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'caif0\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}, @NL80211_ATTR_MESH_ID={0xa}, @mon_options=[@NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MNTR_FLAGS={0x14, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}]}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "001ced75eb761e7c39dce96d8b6485ea2569a829bac7ed06"}, @NL80211_ATTR_MNTR_FLAGS={0x20, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}]}]]}, 0xc8}, 0x1, 0x0, 0x0, 0x4000080}, 0x10) 14:38:02 executing program 3: pselect6(0x40, &(0x7f0000000000)={0xe1, 0x1000, 0x5, 0x5, 0x400, 0xfffffffffffffffa, 0xffffffffffff0001, 0x8}, &(0x7f0000000040)={0x8, 0x100000001, 0x6ed0, 0x82, 0x401, 0x8, 0x3, 0x2}, &(0x7f0000000080)={0x1, 0x8000, 0x1, 0xffff, 0x6, 0x7fffffff, 0x4, 0xfffffffeffffffff}, &(0x7f00000000c0)={0x77359400}, &(0x7f0000000140)={&(0x7f0000000100)={[0x5]}, 0x8}) futex(&(0x7f0000000180)=0x1, 0x0, 0x2, &(0x7f00000001c0)={0x0, 0x989680}, &(0x7f0000000200)=0x1, 0x1) clock_getres(0x0, &(0x7f0000000240)) clock_gettime(0x0, &(0x7f0000000340)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000280)={0xffffffffffff8001, 0x8, 0x3, 0x8001, 0x1d, 0x5, 0x100000000, 0x6}, &(0x7f00000002c0)={0x10000, 0xf5, 0x9, 0x3, 0x3f, 0x10000, 0xafaa, 0xf0}, &(0x7f0000000300)={0x3f, 0x100000000, 0x9, 0xd7d9, 0xcffb, 0x854, 0x9, 0xffffffffffffffe0}, &(0x7f0000000380)={r0, r1+60000000}, &(0x7f0000000400)={&(0x7f00000003c0)={[0x80000000]}, 0x8}) clock_settime(0x4, &(0x7f0000000440)={0x77359400}) prctl$PR_SET_THP_DISABLE(0x29, 0x1) clock_getres(0x6, &(0x7f0000000480)) clock_gettime(0x3, &(0x7f00000004c0)) clock_settime(0x5, &(0x7f0000000500)={0x77359400}) pselect6(0x40, &(0x7f0000000540)={0x9, 0x9, 0x4, 0x3, 0xbc88, 0x3, 0x2, 0x2}, &(0x7f0000000580)={0x1f, 0x6, 0x26ba, 0x8, 0x1, 0x8000, 0x1, 0x8}, 0x0, &(0x7f00000005c0)={0x0, 0x3938700}, &(0x7f0000000640)={&(0x7f0000000600)={[0x10001]}, 0x8}) accept4$vsock_stream(0xffffffffffffffff, &(0x7f0000000680)={0x28, 0x0, 0x0, @local}, 0x10, 0x80800) pselect6(0x40, &(0x7f00000006c0)={0x1, 0x1, 0x89e, 0x4, 0xffffffffffffff16, 0x400, 0x1, 0x9}, &(0x7f0000000700)={0x9, 0x5, 0xc56, 0xf732, 0x1, 0x1, 0x20, 0x101}, &(0x7f0000000740)={0x1df0a00000, 0x9, 0x7, 0x8001, 0x2, 0x80000000, 0xfffffffffffff801}, &(0x7f0000000780)={0x0, 0x3938700}, &(0x7f0000000800)={&(0x7f00000007c0)={[0x6]}, 0x8}) sendmsg$IEEE802154_ASSOCIATE_RESP(0xffffffffffffffff, &(0x7f0000000900)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000880)={0x40, 0x0, 0x20, 0x70bd29, 0x25dfdbfc, {}, [@IEEE802154_ATTR_STATUS={0x5, 0x3, 0x6}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x5}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x1}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa0}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4008000}, 0x4000000) prctl$PR_SET_THP_DISABLE(0x29, 0x1) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, &(0x7f0000000b40)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000980)={0x150, 0x0, 0x8, 0x70bd27, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_TESTDATA={0x72, 0x45, "d97d387e742764bac778bb3cf8eddb74f6a0a2f307b791b5e8b34f0ade3bdf9e54c3eceaea6cb6df5b0c18b5592815a59ff23c80d0dac40899af314b43f1d59c398a3ddbb01337581bb654d085d00128fffcb5c19245582a2c27b84e7ec713533232ad3ab44266f3ab3c6b36eff1"}, @NL80211_ATTR_TESTDATA={0x3a, 0x45, "c42820db057701f4a5e00d1e4afa5f62b894abca71006d976fe37af6d520a2624f98dea90fb1c69ee242d278373e963d021b8326d139"}, @NL80211_ATTR_TESTDATA={0x8a, 0x45, "a8a46af0c5e6cab9624ddfafbdfbf1b1391ffee937b7efc28b8ebd4c2cdb69000fccee43bfeb334e39495770f937e53da7eee55ae11dd18453dc85d6a4ac88846238770ab62907521962e3bdd5d1c811b3d6d1ab00c3a4ca316c41716e8d60c7a27e8922eef2c5baa3214c5fce29d2ab15cfbf5edcb76d1221921d1bf0ccb0c4be515cbefe15"}]}, 0x150}, 0x1, 0x0, 0x0, 0x10}, 0x8) futex(&(0x7f0000000b80), 0x3, 0x2, &(0x7f0000000bc0)={0x77359400}, &(0x7f0000000c00)=0x1, 0x1) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000c80), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_MPATH(0xffffffffffffffff, &(0x7f0000000d80)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000cc0)={0x4c, r2, 0x100, 0x70bd29, 0x25dfdbfd, {{}, {@val={0x8}, @val={0xc, 0x99, {0x9, 0x2b}}}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}]}, 0x4c}}, 0x0) pselect6(0x40, &(0x7f0000000dc0)={0x1, 0x81, 0x0, 0x9c31, 0x502, 0xe101, 0x0, 0x4}, &(0x7f0000000e00)={0x2, 0x2e4b, 0xa6, 0x200, 0x2, 0x0, 0x8, 0x7ff}, &(0x7f0000000e40)={0x95, 0x3, 0xff, 0xffffffffffffb022, 0x96f7, 0x7fff, 0x9, 0x9}, &(0x7f0000000e80), &(0x7f0000000f00)={&(0x7f0000000ec0)={[0x2]}, 0x8}) 14:38:02 executing program 1: clock_getres(0x7, &(0x7f0000000000)) pselect6(0x40, &(0x7f0000000040)={0x5, 0x7fffffff, 0x5, 0xb1, 0x10000, 0x7, 0x7, 0xe4ee}, &(0x7f0000000080)={0x1, 0x5, 0x283, 0x7e, 0x57dc, 0xffff, 0x363b2f21, 0x9}, &(0x7f00000000c0)={0x6, 0x8, 0x101, 0x1, 0x1f, 0xe68, 0x5, 0x9}, &(0x7f0000000100)={0x0, 0x989680}, &(0x7f0000000180)={&(0x7f0000000140)={[0x800]}, 0x8}) clock_gettime(0x0, &(0x7f0000000200)={0x0, 0x0}) futex(&(0x7f00000001c0), 0x4, 0x1, &(0x7f0000000240)={r0, r1+10000000}, &(0x7f0000000280)=0x2, 0x2) prctl$PR_GET_PDEATHSIG(0x2, &(0x7f00000002c0)) pselect6(0x40, &(0x7f0000000300)={0x7, 0x3, 0x2, 0x800, 0x4f7, 0x3, 0x3, 0x10001}, &(0x7f0000000340)={0x5, 0x2, 0x7ff, 0x40, 0xff, 0x2, 0x5, 0x4}, &(0x7f0000000380)={0x7, 0x0, 0x101, 0x662, 0x0, 0x5, 0x2, 0x7b4}, &(0x7f00000003c0)={0x0, 0x989680}, &(0x7f0000000440)={&(0x7f0000000400), 0x8}) ioctl$UI_SET_PROPBIT(0xffffffffffffffff, 0x4004556e, 0x15) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, &(0x7f0000000480)='syz1\x00') ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x6) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f00000004c0), 0x802, 0x0) ioctl$UI_SET_RELBIT(r2, 0x40045566, 0x7) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000500), 0x802, 0x0) ioctl$UI_SET_KEYBIT(r3, 0x40045565, 0x6c) ioctl$UI_SET_RELBIT(r2, 0x40045566, 0xa) sendmsg$NL80211_CMD_START_P2P_DEVICE(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x1c, 0x0, 0x20, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x8}, @void}}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4049000}, 0x20000000) r4 = syz_open_dev$vcsa(&(0x7f0000000640), 0x3, 0x400000) ioctl$UI_SET_ABSBIT(r4, 0x40045567, 0x5) clock_gettime(0x6, &(0x7f0000000680)) ioctl$UI_END_FF_UPLOAD(r4, 0x406855c9, &(0x7f0000000700)={0xd, 0x7, {0x54, 0x7ff, 0x1f, {0x80, 0x7}, {0x3, 0x7}, @cond=[{0x27ed, 0x401, 0x7, 0x2, 0x1000, 0x228}, {0x878c, 0xffe0, 0x9, 0xdc6a, 0x6, 0xff}]}, {0x53, 0xd3b, 0x800, {0xf7, 0x71a6}, {0x6, 0xf}, @period={0x5a, 0x1000, 0x5c, 0x5, 0x4d48, {0x3, 0x4, 0x8001, 0x1ff}, 0x9, &(0x7f00000006c0)=[0xfbff, 0x9, 0xbb0, 0xfff9, 0xe1a, 0x6509, 0x2e8f, 0xb01b, 0x6a0]}}}) ioctl$USBDEVFS_RESETEP(0xffffffffffffffff, 0x80045503, &(0x7f00000007c0)={0xf}) [ 25.563862][ T12] cfg80211: failed to load regulatory.db 14:38:02 executing program 1: clock_getres(0x7, &(0x7f0000000000)) pselect6(0x40, &(0x7f0000000040)={0x5, 0x7fffffff, 0x5, 0xb1, 0x10000, 0x7, 0x7, 0xe4ee}, &(0x7f0000000080)={0x1, 0x5, 0x283, 0x7e, 0x57dc, 0xffff, 0x363b2f21, 0x9}, &(0x7f00000000c0)={0x6, 0x8, 0x101, 0x1, 0x1f, 0xe68, 0x5, 0x9}, &(0x7f0000000100)={0x0, 0x989680}, &(0x7f0000000180)={&(0x7f0000000140)={[0x800]}, 0x8}) clock_gettime(0x0, &(0x7f0000000200)={0x0, 0x0}) futex(&(0x7f00000001c0), 0x4, 0x1, &(0x7f0000000240)={r0, r1+10000000}, &(0x7f0000000280)=0x2, 0x2) prctl$PR_GET_PDEATHSIG(0x2, &(0x7f00000002c0)) pselect6(0x40, &(0x7f0000000300)={0x7, 0x3, 0x2, 0x800, 0x4f7, 0x3, 0x3, 0x10001}, &(0x7f0000000340)={0x5, 0x2, 0x7ff, 0x40, 0xff, 0x2, 0x5, 0x4}, &(0x7f0000000380)={0x7, 0x0, 0x101, 0x662, 0x0, 0x5, 0x2, 0x7b4}, &(0x7f00000003c0)={0x0, 0x989680}, &(0x7f0000000440)={&(0x7f0000000400), 0x8}) ioctl$UI_SET_PROPBIT(0xffffffffffffffff, 0x4004556e, 0x15) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, &(0x7f0000000480)='syz1\x00') ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x6) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f00000004c0), 0x802, 0x0) ioctl$UI_SET_RELBIT(r2, 0x40045566, 0x7) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000500), 0x802, 0x0) ioctl$UI_SET_KEYBIT(r3, 0x40045565, 0x6c) ioctl$UI_SET_RELBIT(r2, 0x40045566, 0xa) sendmsg$NL80211_CMD_START_P2P_DEVICE(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x1c, 0x0, 0x20, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x8}, @void}}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4049000}, 0x20000000) r4 = syz_open_dev$vcsa(&(0x7f0000000640), 0x3, 0x400000) ioctl$UI_SET_ABSBIT(r4, 0x40045567, 0x5) clock_gettime(0x6, &(0x7f0000000680)) ioctl$UI_END_FF_UPLOAD(r4, 0x406855c9, &(0x7f0000000700)={0xd, 0x7, {0x54, 0x7ff, 0x1f, {0x80, 0x7}, {0x3, 0x7}, @cond=[{0x27ed, 0x401, 0x7, 0x2, 0x1000, 0x228}, {0x878c, 0xffe0, 0x9, 0xdc6a, 0x6, 0xff}]}, {0x53, 0xd3b, 0x800, {0xf7, 0x71a6}, {0x6, 0xf}, @period={0x5a, 0x1000, 0x5c, 0x5, 0x4d48, {0x3, 0x4, 0x8001, 0x1ff}, 0x9, &(0x7f00000006c0)=[0xfbff, 0x9, 0xbb0, 0xfff9, 0xe1a, 0x6509, 0x2e8f, 0xb01b, 0x6a0]}}}) ioctl$USBDEVFS_RESETEP(0xffffffffffffffff, 0x80045503, &(0x7f00000007c0)={0xf}) 14:38:02 executing program 3: pselect6(0x40, &(0x7f0000000000)={0xe1, 0x1000, 0x5, 0x5, 0x400, 0xfffffffffffffffa, 0xffffffffffff0001, 0x8}, &(0x7f0000000040)={0x8, 0x100000001, 0x6ed0, 0x82, 0x401, 0x8, 0x3, 0x2}, &(0x7f0000000080)={0x1, 0x8000, 0x1, 0xffff, 0x6, 0x7fffffff, 0x4, 0xfffffffeffffffff}, &(0x7f00000000c0)={0x77359400}, &(0x7f0000000140)={&(0x7f0000000100)={[0x5]}, 0x8}) futex(&(0x7f0000000180)=0x1, 0x0, 0x2, &(0x7f00000001c0)={0x0, 0x989680}, &(0x7f0000000200)=0x1, 0x1) clock_getres(0x0, &(0x7f0000000240)) clock_gettime(0x0, &(0x7f0000000340)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000280)={0xffffffffffff8001, 0x8, 0x3, 0x8001, 0x1d, 0x5, 0x100000000, 0x6}, &(0x7f00000002c0)={0x10000, 0xf5, 0x9, 0x3, 0x3f, 0x10000, 0xafaa, 0xf0}, &(0x7f0000000300)={0x3f, 0x100000000, 0x9, 0xd7d9, 0xcffb, 0x854, 0x9, 0xffffffffffffffe0}, &(0x7f0000000380)={r0, r1+60000000}, &(0x7f0000000400)={&(0x7f00000003c0)={[0x80000000]}, 0x8}) clock_settime(0x4, &(0x7f0000000440)={0x77359400}) prctl$PR_SET_THP_DISABLE(0x29, 0x1) clock_getres(0x6, &(0x7f0000000480)) clock_gettime(0x3, &(0x7f00000004c0)) clock_settime(0x5, &(0x7f0000000500)={0x77359400}) pselect6(0x40, &(0x7f0000000540)={0x9, 0x9, 0x4, 0x3, 0xbc88, 0x3, 0x2, 0x2}, &(0x7f0000000580)={0x1f, 0x6, 0x26ba, 0x8, 0x1, 0x8000, 0x1, 0x8}, 0x0, &(0x7f00000005c0)={0x0, 0x3938700}, &(0x7f0000000640)={&(0x7f0000000600)={[0x10001]}, 0x8}) accept4$vsock_stream(0xffffffffffffffff, &(0x7f0000000680)={0x28, 0x0, 0x0, @local}, 0x10, 0x80800) pselect6(0x40, &(0x7f00000006c0)={0x1, 0x1, 0x89e, 0x4, 0xffffffffffffff16, 0x400, 0x1, 0x9}, &(0x7f0000000700)={0x9, 0x5, 0xc56, 0xf732, 0x1, 0x1, 0x20, 0x101}, &(0x7f0000000740)={0x1df0a00000, 0x9, 0x7, 0x8001, 0x2, 0x80000000, 0xfffffffffffff801}, &(0x7f0000000780)={0x0, 0x3938700}, &(0x7f0000000800)={&(0x7f00000007c0)={[0x6]}, 0x8}) sendmsg$IEEE802154_ASSOCIATE_RESP(0xffffffffffffffff, &(0x7f0000000900)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000880)={0x40, 0x0, 0x20, 0x70bd29, 0x25dfdbfc, {}, [@IEEE802154_ATTR_STATUS={0x5, 0x3, 0x6}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x5}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x1}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa0}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4008000}, 0x4000000) prctl$PR_SET_THP_DISABLE(0x29, 0x1) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, &(0x7f0000000b40)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000980)={0x150, 0x0, 0x8, 0x70bd27, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_TESTDATA={0x72, 0x45, "d97d387e742764bac778bb3cf8eddb74f6a0a2f307b791b5e8b34f0ade3bdf9e54c3eceaea6cb6df5b0c18b5592815a59ff23c80d0dac40899af314b43f1d59c398a3ddbb01337581bb654d085d00128fffcb5c19245582a2c27b84e7ec713533232ad3ab44266f3ab3c6b36eff1"}, @NL80211_ATTR_TESTDATA={0x3a, 0x45, "c42820db057701f4a5e00d1e4afa5f62b894abca71006d976fe37af6d520a2624f98dea90fb1c69ee242d278373e963d021b8326d139"}, @NL80211_ATTR_TESTDATA={0x8a, 0x45, "a8a46af0c5e6cab9624ddfafbdfbf1b1391ffee937b7efc28b8ebd4c2cdb69000fccee43bfeb334e39495770f937e53da7eee55ae11dd18453dc85d6a4ac88846238770ab62907521962e3bdd5d1c811b3d6d1ab00c3a4ca316c41716e8d60c7a27e8922eef2c5baa3214c5fce29d2ab15cfbf5edcb76d1221921d1bf0ccb0c4be515cbefe15"}]}, 0x150}, 0x1, 0x0, 0x0, 0x10}, 0x8) futex(&(0x7f0000000b80), 0x3, 0x2, &(0x7f0000000bc0)={0x77359400}, &(0x7f0000000c00)=0x1, 0x1) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000c80), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_MPATH(0xffffffffffffffff, &(0x7f0000000d80)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000cc0)={0x4c, r2, 0x100, 0x70bd29, 0x25dfdbfd, {{}, {@val={0x8}, @val={0xc, 0x99, {0x9, 0x2b}}}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}]}, 0x4c}}, 0x0) pselect6(0x40, &(0x7f0000000dc0)={0x1, 0x81, 0x0, 0x9c31, 0x502, 0xe101, 0x0, 0x4}, &(0x7f0000000e00)={0x2, 0x2e4b, 0xa6, 0x200, 0x2, 0x0, 0x8, 0x7ff}, &(0x7f0000000e40)={0x95, 0x3, 0xff, 0xffffffffffffb022, 0x96f7, 0x7fff, 0x9, 0x9}, &(0x7f0000000e80), &(0x7f0000000f00)={&(0x7f0000000ec0)={[0x2]}, 0x8}) 14:38:02 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) ioctl$UI_SET_KEYBIT(r0, 0x40045565, 0x54) prctl$PR_SET_SECUREBITS(0x1c, 0x8) sendmsg$NL80211_CMD_SET_PMKSA(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x4000015) prctl$PR_SET_SECUREBITS(0x1c, 0x20) r1 = syz_open_dev$vcsa(&(0x7f0000000100), 0x920, 0x240) ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1d6) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000140), 0x802, 0x0) ioctl$UI_SET_EVBIT(r2, 0x40045564, 0x1d) ioctl$UI_BEGIN_FF_UPLOAD(r2, 0xc06855c8, &(0x7f00000001c0)={0x5, 0x9, {0x54, 0xfff8, 0x62, {0x100, 0x9d2}, {0x7ff, 0x101}, @period={0x59, 0x2, 0x3, 0x5, 0x8, {0x4, 0x3f7, 0x9, 0x3d9b}, 0x8, &(0x7f0000000180)=[0xfbe0, 0x31a7, 0x6, 0x3, 0xa9c, 0x1, 0x6145, 0x7]}}, {0x54, 0x20, 0x6, {0x8000, 0x401}, {0x3, 0x3ff}, @ramp={0x2, 0x3e5c, {0x1, 0x4, 0x3, 0x1000}}}}) r3 = syz_open_dev$vcsa(&(0x7f0000000240), 0x6, 0x111000) ioctl$UI_SET_PHYS(r3, 0x4008556c, &(0x7f0000000280)='syz1\x00') r4 = openat$uinput(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) clock_gettime(0x0, &(0x7f0000000300)={0x0, 0x0}) write$input_event(r4, &(0x7f0000000340)={{r5, r6/1000+10000}, 0x1, 0xfff7}, 0x18) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r1) ioctl$UI_END_FF_ERASE(r4, 0x400c55cb, &(0x7f00000003c0)={0x5, 0x4, 0x1}) r7 = syz_open_pts(r1, 0x218040) ioctl$TIOCSETD(r7, 0x5423, &(0x7f0000000400)=0x16) ioctl$TIOCCBRK(0xffffffffffffffff, 0x5428) 14:38:02 executing program 4: r0 = socket(0x0, 0x1, 0x2) sendmsg$NL80211_CMD_GET_KEY(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x7c, 0x0, 0xc30, 0x70bd28, 0x25dfdbfb, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac05}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "b98e1c15b9504b03c1de98fdff"}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "a448a9969794224f53b27f76e3"}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac01}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "0c2e0e097645692b3641dbc8ff"}]}, 0x7c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10000) io_uring_setup(0x3d2a, &(0x7f0000000140)={0x0, 0xee28, 0x2, 0x2, 0xf5}) r1 = syz_open_dev$vcsa(&(0x7f00000001c0), 0x8, 0x402082) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEL_STATION(r1, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x54, 0x0, 0x800, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_STA_TX_POWER_SETTING={0x5, 0x113, 0x1}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x9d}, @NL80211_ATTR_STA_FLAGS2={0xc, 0x43, {0x7}}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_AIRTIME_WEIGHT={0x6, 0x112, 0x6}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x7012}]}, 0x54}, 0x1, 0x0, 0x0, 0x20000000}, 0x4040004) sendmsg$NL80211_CMD_GET_MPP(r1, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x44, 0x0, 0x2, 0x70bd25, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}]}, 0x44}, 0x1, 0x0, 0x0, 0x804}, 0x81) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r1, 0x40082102, &(0x7f00000004c0)) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000580)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_MCAST_RATE(r1, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x40, r3, 0x300, 0x70bd2d, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0x8, 0x61}}}}, [@NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x21c}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0xf0}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x78}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000010}, 0x1010) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f00000007c0)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000780)={&(0x7f00000006c0)={0xac, r3, 0x10, 0x70bd2a, 0x25dfdbfe, {{}, {@void, @void, @val={0xc, 0x99, {0x8000, 0x1a}}}}, [@NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @mon_options=[@NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "694edb82987efca9726b73dbad87aee9c82f5881a01e260e"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "3a6891e4f568a688f298dd323c27c3d5337f12d8da63e512"}, @NL80211_ATTR_MNTR_FLAGS={0x14, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}]}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "b402286e97edaf79b6a5ca4ad38ae0d1859405033784ba8b"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "d11a0cbf38e9334c37895f93e68d51c754bb1b6faa3e765f"}]]}, 0xac}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000000900)={0x3, 0x9, 0x1, 0x4195, 0xdd, 0x8, &(0x7f0000000800)="63f58ea60fe7dd9b64b9d78660f645dfa5779ae6a8b497cfb0441078497694e79203c3a069573f0c7b12c0d93febab8b1ba2ca2d951e0b9d8182d058ee8f22353bfecf2e666011b3851e9f916949e18a292547d2cca0da41625139c16d7c060634113556136ff3f94e70dde9f920a1a5b79567f27850358e5a704e657e7505912a6b687db7380cc01c4bda0e7303a5dfa4bc8abdfadcefbcd2ae5c09943c382692f48f967d7ceb6306166902ecbcabb032e0bed88c6b2f700aa406ec1f8175d6d80d0a1bac05373ced80901199b41b51aad80839106297d33b37df84b5"}) r5 = syz_open_dev$vcsa(&(0x7f0000000940), 0x10001, 0x880) sendmsg$NL80211_CMD_SET_REG(r5, &(0x7f0000000a40)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000a00)={&(0x7f00000009c0)={0x24, r3, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8, 0x1, 0x26}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x50}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x20008000) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a80), r0) r7 = syz_open_dev$usbfs(&(0x7f0000000ac0), 0x10000, 0x84000) ioctl$USBDEVFS_CONTROL(r7, 0xc0185500, &(0x7f0000000c00)={0x20, 0x15, 0x400, 0x8c, 0xcb, 0x3, &(0x7f0000000b00)="bb9f37e5f888ed7c5bf4bae605138e599a478480df77808c2c6b73862935705cf1d56bc20ba7a3c6ebcfc9fe0f61e1ccac9e5c9bcaeee7d7f6b5f1579f430ad4f0b632d92fcc3fc71110e0bba4a8b012d132b77360f379455122038ba8cc67f62f0e3e9656eb99b6f79ccc860088b670787669edbc0f4322ae1da014a737b224300f03272c230885ad11d2066a8418773d82c481dcca7c876c8bd177b06772978372fa95f02f2386b63e129010b4c945eb2c159084202ad1f67d49be3c72e91fc56d1e30a717e902cd42ba"}) sendmsg$NL80211_CMD_SET_PMKSA(r0, &(0x7f0000000d00)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r6, 0x4, 0x70bd26, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x2, 0x2d}}}}, [@NL80211_ATTR_PMK_LIFETIME={0x8, 0x11f, 0x7}, @NL80211_ATTR_PMK_REAUTH_THRESHOLD={0x5, 0x120, 0x50}]}, 0x30}, 0x1, 0x0, 0x0, 0x4010}, 0x20000800) sendmsg$NL80211_CMD_NEW_INTERFACE(r5, &(0x7f0000000ec0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000e80)={&(0x7f0000000d80)={0xc8, r3, 0x10, 0x70bd2b, 0x25dfdbfd, {{}, {@void, @void, @val={0xc, 0x99, {0x7fffffff, 0x5e}}}}, [@NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'caif0\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}, @NL80211_ATTR_MESH_ID={0xa}, @mon_options=[@NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MNTR_FLAGS={0x14, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}]}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "001ced75eb761e7c39dce96d8b6485ea2569a829bac7ed06"}, @NL80211_ATTR_MNTR_FLAGS={0x20, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}]}]]}, 0xc8}, 0x1, 0x0, 0x0, 0x4000080}, 0x10) [ 25.609716][ T385] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2 [ 25.626141][ T382] input: syz1 as /devices/virtual/input/input39 [ 25.640799][ T385] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db [ 25.649946][ T385] ================================================================== 14:38:02 executing program 4: r0 = socket(0x0, 0x1, 0x2) sendmsg$NL80211_CMD_GET_KEY(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x7c, 0x0, 0xc30, 0x70bd28, 0x25dfdbfb, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac05}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "b98e1c15b9504b03c1de98fdff"}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "a448a9969794224f53b27f76e3"}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac01}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "0c2e0e097645692b3641dbc8ff"}]}, 0x7c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10000) io_uring_setup(0x3d2a, &(0x7f0000000140)={0x0, 0xee28, 0x2, 0x2, 0xf5}) r1 = syz_open_dev$vcsa(&(0x7f00000001c0), 0x8, 0x402082) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEL_STATION(r1, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x54, 0x0, 0x800, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_STA_TX_POWER_SETTING={0x5, 0x113, 0x1}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x9d}, @NL80211_ATTR_STA_FLAGS2={0xc, 0x43, {0x7}}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_AIRTIME_WEIGHT={0x6, 0x112, 0x6}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x7012}]}, 0x54}, 0x1, 0x0, 0x0, 0x20000000}, 0x4040004) sendmsg$NL80211_CMD_GET_MPP(r1, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x44, 0x0, 0x2, 0x70bd25, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}]}, 0x44}, 0x1, 0x0, 0x0, 0x804}, 0x81) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r1, 0x40082102, &(0x7f00000004c0)) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000580)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_MCAST_RATE(r1, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x40, r3, 0x300, 0x70bd2d, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0x8, 0x61}}}}, [@NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x21c}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0xf0}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x78}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000010}, 0x1010) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f00000007c0)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000780)={&(0x7f00000006c0)={0xac, r3, 0x10, 0x70bd2a, 0x25dfdbfe, {{}, {@void, @void, @val={0xc, 0x99, {0x8000, 0x1a}}}}, [@NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @mon_options=[@NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "694edb82987efca9726b73dbad87aee9c82f5881a01e260e"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "3a6891e4f568a688f298dd323c27c3d5337f12d8da63e512"}, @NL80211_ATTR_MNTR_FLAGS={0x14, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}]}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "b402286e97edaf79b6a5ca4ad38ae0d1859405033784ba8b"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "d11a0cbf38e9334c37895f93e68d51c754bb1b6faa3e765f"}]]}, 0xac}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000000900)={0x3, 0x9, 0x1, 0x4195, 0xdd, 0x8, &(0x7f0000000800)="63f58ea60fe7dd9b64b9d78660f645dfa5779ae6a8b497cfb0441078497694e79203c3a069573f0c7b12c0d93febab8b1ba2ca2d951e0b9d8182d058ee8f22353bfecf2e666011b3851e9f916949e18a292547d2cca0da41625139c16d7c060634113556136ff3f94e70dde9f920a1a5b79567f27850358e5a704e657e7505912a6b687db7380cc01c4bda0e7303a5dfa4bc8abdfadcefbcd2ae5c09943c382692f48f967d7ceb6306166902ecbcabb032e0bed88c6b2f700aa406ec1f8175d6d80d0a1bac05373ced80901199b41b51aad80839106297d33b37df84b5"}) r5 = syz_open_dev$vcsa(&(0x7f0000000940), 0x10001, 0x880) sendmsg$NL80211_CMD_SET_REG(r5, &(0x7f0000000a40)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000a00)={&(0x7f00000009c0)={0x24, r3, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8, 0x1, 0x26}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x50}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x20008000) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a80), r0) r7 = syz_open_dev$usbfs(&(0x7f0000000ac0), 0x10000, 0x84000) ioctl$USBDEVFS_CONTROL(r7, 0xc0185500, &(0x7f0000000c00)={0x20, 0x15, 0x400, 0x8c, 0xcb, 0x3, &(0x7f0000000b00)="bb9f37e5f888ed7c5bf4bae605138e599a478480df77808c2c6b73862935705cf1d56bc20ba7a3c6ebcfc9fe0f61e1ccac9e5c9bcaeee7d7f6b5f1579f430ad4f0b632d92fcc3fc71110e0bba4a8b012d132b77360f379455122038ba8cc67f62f0e3e9656eb99b6f79ccc860088b670787669edbc0f4322ae1da014a737b224300f03272c230885ad11d2066a8418773d82c481dcca7c876c8bd177b06772978372fa95f02f2386b63e129010b4c945eb2c159084202ad1f67d49be3c72e91fc56d1e30a717e902cd42ba"}) sendmsg$NL80211_CMD_SET_PMKSA(r0, &(0x7f0000000d00)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r6, 0x4, 0x70bd26, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x2, 0x2d}}}}, [@NL80211_ATTR_PMK_LIFETIME={0x8, 0x11f, 0x7}, @NL80211_ATTR_PMK_REAUTH_THRESHOLD={0x5, 0x120, 0x50}]}, 0x30}, 0x1, 0x0, 0x0, 0x4010}, 0x20000800) sendmsg$NL80211_CMD_NEW_INTERFACE(r5, &(0x7f0000000ec0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000e80)={&(0x7f0000000d80)={0xc8, r3, 0x10, 0x70bd2b, 0x25dfdbfd, {{}, {@void, @void, @val={0xc, 0x99, {0x7fffffff, 0x5e}}}}, [@NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'caif0\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}, @NL80211_ATTR_MESH_ID={0xa}, @mon_options=[@NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MNTR_FLAGS={0x14, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}]}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "001ced75eb761e7c39dce96d8b6485ea2569a829bac7ed06"}, @NL80211_ATTR_MNTR_FLAGS={0x20, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}]}]]}, 0xc8}, 0x1, 0x0, 0x0, 0x4000080}, 0x10) [ 25.658020][ T385] BUG: KASAN: use-after-free in __list_add_valid+0x36/0xc0 [ 25.665217][ T385] Read of size 8 at addr ffff8881eeef0388 by task syz-executor.2/385 [ 25.673269][ T385] [ 25.675590][ T385] CPU: 0 PID: 385 Comm: syz-executor.2 Not tainted 5.4.125-syzkaller-00029-g5970ec26e0c8 #0 [ 25.685627][ T385] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 25.695663][ T385] Call Trace: [ 25.698949][ T385] dump_stack+0x1d8/0x24e [ 25.703282][ T385] ? show_regs_print_info+0x12/0x12 14:38:02 executing program 3: pselect6(0x40, &(0x7f0000000000)={0xe1, 0x1000, 0x5, 0x5, 0x400, 0xfffffffffffffffa, 0xffffffffffff0001, 0x8}, &(0x7f0000000040)={0x8, 0x100000001, 0x6ed0, 0x82, 0x401, 0x8, 0x3, 0x2}, &(0x7f0000000080)={0x1, 0x8000, 0x1, 0xffff, 0x6, 0x7fffffff, 0x4, 0xfffffffeffffffff}, &(0x7f00000000c0)={0x77359400}, &(0x7f0000000140)={&(0x7f0000000100)={[0x5]}, 0x8}) futex(&(0x7f0000000180)=0x1, 0x0, 0x2, &(0x7f00000001c0)={0x0, 0x989680}, &(0x7f0000000200)=0x1, 0x1) clock_getres(0x0, &(0x7f0000000240)) clock_gettime(0x0, &(0x7f0000000340)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000280)={0xffffffffffff8001, 0x8, 0x3, 0x8001, 0x1d, 0x5, 0x100000000, 0x6}, &(0x7f00000002c0)={0x10000, 0xf5, 0x9, 0x3, 0x3f, 0x10000, 0xafaa, 0xf0}, &(0x7f0000000300)={0x3f, 0x100000000, 0x9, 0xd7d9, 0xcffb, 0x854, 0x9, 0xffffffffffffffe0}, &(0x7f0000000380)={r0, r1+60000000}, &(0x7f0000000400)={&(0x7f00000003c0)={[0x80000000]}, 0x8}) clock_settime(0x4, &(0x7f0000000440)={0x77359400}) prctl$PR_SET_THP_DISABLE(0x29, 0x1) clock_getres(0x6, &(0x7f0000000480)) clock_gettime(0x3, &(0x7f00000004c0)) clock_settime(0x5, &(0x7f0000000500)={0x77359400}) pselect6(0x40, &(0x7f0000000540)={0x9, 0x9, 0x4, 0x3, 0xbc88, 0x3, 0x2, 0x2}, &(0x7f0000000580)={0x1f, 0x6, 0x26ba, 0x8, 0x1, 0x8000, 0x1, 0x8}, 0x0, &(0x7f00000005c0)={0x0, 0x3938700}, &(0x7f0000000640)={&(0x7f0000000600)={[0x10001]}, 0x8}) accept4$vsock_stream(0xffffffffffffffff, &(0x7f0000000680)={0x28, 0x0, 0x0, @local}, 0x10, 0x80800) pselect6(0x40, &(0x7f00000006c0)={0x1, 0x1, 0x89e, 0x4, 0xffffffffffffff16, 0x400, 0x1, 0x9}, &(0x7f0000000700)={0x9, 0x5, 0xc56, 0xf732, 0x1, 0x1, 0x20, 0x101}, &(0x7f0000000740)={0x1df0a00000, 0x9, 0x7, 0x8001, 0x2, 0x80000000, 0xfffffffffffff801}, &(0x7f0000000780)={0x0, 0x3938700}, &(0x7f0000000800)={&(0x7f00000007c0)={[0x6]}, 0x8}) sendmsg$IEEE802154_ASSOCIATE_RESP(0xffffffffffffffff, &(0x7f0000000900)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000880)={0x40, 0x0, 0x20, 0x70bd29, 0x25dfdbfc, {}, [@IEEE802154_ATTR_STATUS={0x5, 0x3, 0x6}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x5}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x1}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa0}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4008000}, 0x4000000) prctl$PR_SET_THP_DISABLE(0x29, 0x1) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, &(0x7f0000000b40)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000980)={0x150, 0x0, 0x8, 0x70bd27, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_TESTDATA={0x72, 0x45, "d97d387e742764bac778bb3cf8eddb74f6a0a2f307b791b5e8b34f0ade3bdf9e54c3eceaea6cb6df5b0c18b5592815a59ff23c80d0dac40899af314b43f1d59c398a3ddbb01337581bb654d085d00128fffcb5c19245582a2c27b84e7ec713533232ad3ab44266f3ab3c6b36eff1"}, @NL80211_ATTR_TESTDATA={0x3a, 0x45, "c42820db057701f4a5e00d1e4afa5f62b894abca71006d976fe37af6d520a2624f98dea90fb1c69ee242d278373e963d021b8326d139"}, @NL80211_ATTR_TESTDATA={0x8a, 0x45, "a8a46af0c5e6cab9624ddfafbdfbf1b1391ffee937b7efc28b8ebd4c2cdb69000fccee43bfeb334e39495770f937e53da7eee55ae11dd18453dc85d6a4ac88846238770ab62907521962e3bdd5d1c811b3d6d1ab00c3a4ca316c41716e8d60c7a27e8922eef2c5baa3214c5fce29d2ab15cfbf5edcb76d1221921d1bf0ccb0c4be515cbefe15"}]}, 0x150}, 0x1, 0x0, 0x0, 0x10}, 0x8) futex(&(0x7f0000000b80), 0x3, 0x2, &(0x7f0000000bc0)={0x77359400}, &(0x7f0000000c00)=0x1, 0x1) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000c80), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_MPATH(0xffffffffffffffff, &(0x7f0000000d80)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000cc0)={0x4c, r2, 0x100, 0x70bd29, 0x25dfdbfd, {{}, {@val={0x8}, @val={0xc, 0x99, {0x9, 0x2b}}}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}]}, 0x4c}}, 0x0) pselect6(0x40, &(0x7f0000000dc0)={0x1, 0x81, 0x0, 0x9c31, 0x502, 0xe101, 0x0, 0x4}, &(0x7f0000000e00)={0x2, 0x2e4b, 0xa6, 0x200, 0x2, 0x0, 0x8, 0x7ff}, &(0x7f0000000e40)={0x95, 0x3, 0xff, 0xffffffffffffb022, 0x96f7, 0x7fff, 0x9, 0x9}, &(0x7f0000000e80), &(0x7f0000000f00)={&(0x7f0000000ec0)={[0x2]}, 0x8}) [ 25.708474][ T385] ? printk+0xcf/0x114 [ 25.712536][ T385] print_address_description+0x9b/0x650 [ 25.718073][ T385] ? devkmsg_release+0x11c/0x11c [ 25.723000][ T385] ? device_add+0x5d8/0x18a0 [ 25.727580][ T385] __kasan_report+0x182/0x260 [ 25.732244][ T385] ? __list_add_valid+0x36/0xc0 [ 25.737171][ T385] kasan_report+0x30/0x60 [ 25.741490][ T385] __list_add_valid+0x36/0xc0 [ 25.746152][ T385] firmware_fallback_sysfs+0x480/0xb20 [ 25.751599][ T385] _request_firmware+0x1287/0x1770 [ 25.756704][ T385] ? request_firmware+0x50/0x50 [ 25.761542][ T385] ? __nla_validate+0x50/0x50 [ 25.766202][ T385] request_firmware+0x33/0x50 [ 25.770854][ T385] reg_reload_regdb+0xa0/0x220 [ 25.775589][ T385] ? reg_query_regdb_wmm+0x510/0x510 [ 25.780846][ T385] ? nl80211_pre_doit+0x156/0x590 [ 25.785844][ T385] genl_rcv_msg+0xed8/0x13b0 [ 25.790417][ T385] ? genl_rcv+0x40/0x40 [ 25.794541][ T385] ? rhashtable_jhash2+0x1bf/0x2e0 [ 25.799622][ T385] ? jhash+0x740/0x740 [ 25.803661][ T385] ? rht_key_hashfn+0x112/0x1e0 [ 25.808478][ T385] ? rht_lock+0x100/0x100 [ 25.812778][ T385] ? _raw_spin_lock_irqsave+0xf8/0x210 [ 25.818204][ T385] ? rht_key_hashfn+0x1e0/0x1e0 [ 25.823023][ T385] ? netlink_hash+0xd0/0xd0 [ 25.827491][ T385] ? _raw_spin_lock+0x1b0/0x1b0 [ 25.832314][ T385] netlink_rcv_skb+0x200/0x480 [ 25.837069][ T385] ? genl_rcv+0x40/0x40 [ 25.841200][ T385] ? netlink_ack+0xab0/0xab0 [ 25.845776][ T385] ? __down_read+0xf1/0x210 [ 25.850269][ T385] ? __init_rwsem+0x200/0x200 [ 25.854912][ T385] ? __rcu_read_lock+0x50/0x50 [ 25.859641][ T385] ? selinux_vm_enough_memory+0x170/0x170 [ 25.865339][ T385] genl_rcv+0x24/0x40 [ 25.869294][ T385] netlink_unicast+0x865/0x9f0 [ 25.874031][ T385] ? netlink_detachskb+0x40/0x40 [ 25.878936][ T385] ? _copy_from_iter_full+0x29e/0x830 [ 25.884274][ T385] netlink_sendmsg+0x9ab/0xd40 [ 25.889007][ T385] ? netlink_getsockopt+0x8e0/0x8e0 [ 25.894178][ T385] ? import_iovec+0x1bc/0x380 [ 25.898828][ T385] ? security_socket_sendmsg+0x9d/0xb0 [ 25.904257][ T385] ? netlink_getsockopt+0x8e0/0x8e0 [ 25.909424][ T385] ____sys_sendmsg+0x583/0x8c0 [ 25.914158][ T385] ? __sys_sendmsg_sock+0x2b0/0x2b0 [ 25.919340][ T385] __sys_sendmsg+0x2c4/0x3b0 [ 25.923905][ T385] ? ____sys_sendmsg+0x8c0/0x8c0 [ 25.928818][ T385] do_syscall_64+0xcb/0x1e0 [ 25.933291][ T385] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 25.939164][ T385] RIP: 0033:0x7fc08bed8a39 [ 25.943547][ T385] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 25.963142][ T385] RSP: 002b:00007fc089c4f188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 25.971548][ T385] RAX: ffffffffffffffda RBX: 00007fc08bfdbf60 RCX: 00007fc08bed8a39 [ 25.979537][ T385] RDX: 0000000000000000 RSI: 0000000020000b40 RDI: 0000000000000005 [ 25.987485][ T385] RBP: 00007fc08bf32c5f R08: 0000000000000000 R09: 0000000000000000 [ 25.995427][ T385] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 26.003376][ T385] R13: 00007ffce9d7043f R14: 00007fc089c4f300 R15: 0000000000022000 [ 26.011332][ T385] [ 26.013629][ T385] Allocated by task 12: [ 26.017811][ T385] __kasan_kmalloc+0x137/0x1e0 [ 26.022549][ T385] kmem_cache_alloc_trace+0x139/0x2b0 [ 26.027899][ T385] _request_firmware+0x524/0x1770 [ 26.032892][ T385] request_firmware_work_func+0x121/0x260 [ 26.038580][ T385] process_one_work+0x679/0x1030 [ 26.043524][ T385] worker_thread+0xa6f/0x1400 [ 26.048167][ T385] kthread+0x30f/0x330 [ 26.052202][ T385] ret_from_fork+0x1f/0x30 [ 26.056582][ T385] [ 26.058885][ T385] Freed by task 12: [ 26.062659][ T385] __kasan_slab_free+0x18a/0x240 [ 26.067565][ T385] slab_free_freelist_hook+0x7b/0x150 [ 26.072910][ T385] kfree+0xe0/0x660 [ 26.076771][ T385] release_firmware+0x47f/0x4d0 [ 26.081588][ T385] _request_firmware+0x145a/0x1770 [ 26.086753][ T385] request_firmware_work_func+0x121/0x260 [ 26.092436][ T385] process_one_work+0x679/0x1030 [ 26.097459][ T385] worker_thread+0xa6f/0x1400 [ 26.102114][ T385] kthread+0x30f/0x330 [ 26.106153][ T385] ret_from_fork+0x1f/0x30 [ 26.110529][ T385] [ 26.112827][ T385] The buggy address belongs to the object at ffff8881eeef0300 [ 26.112827][ T385] which belongs to the cache kmalloc-192 of size 192 [ 26.126845][ T385] The buggy address is located 136 bytes inside of [ 26.126845][ T385] 192-byte region [ffff8881eeef0300, ffff8881eeef03c0) [ 26.140078][ T385] The buggy address belongs to the page: [ 26.145677][ T385] page:ffffea0007bbbc00 refcount:1 mapcount:0 mapping:ffff8881f5c02a00 index:0x0 [ 26.154747][ T385] flags: 0x8000000000000200(slab) [ 26.159757][ T385] raw: 8000000000000200 ffffea0007b70bc0 0000000300000003 ffff8881f5c02a00 [ 26.168305][ T385] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 26.176851][ T385] page dumped because: kasan: bad access detected [ 26.183227][ T385] page_owner tracks the page as allocated [ 26.188917][ T385] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12c00(GFP_NOIO|__GFP_NOWARN|__GFP_NORETRY) [ 26.200773][ T385] prep_new_page+0x19a/0x380 [ 26.205328][ T385] get_page_from_freelist+0x550/0x8b0 [ 26.210671][ T385] __alloc_pages_nodemask+0x3a2/0x880 [ 26.216008][ T385] alloc_slab_page+0x39/0x3e0 [ 26.220662][ T385] new_slab+0x97/0x460 [ 26.224707][ T385] ___slab_alloc+0x330/0x4c0 [ 26.229270][ T385] __kmalloc+0x1ee/0x2f0 [ 26.233489][ T385] bio_alloc_bioset+0x15d/0x640 [ 26.238309][ T385] bio_map_kern+0xd5/0x3b0 [ 26.242696][ T385] blk_rq_map_kern+0x25a/0x4a0 [ 26.247427][ T385] __scsi_execute+0xe1/0x5c0 [ 26.251986][ T385] scsi_report_opcode+0x266/0x590 [ 26.256976][ T385] sd_revalidate_disk+0x52ba/0x7db0 [ 26.262141][ T385] sd_probe+0xa8d/0xf90 [ 26.266265][ T385] really_probe+0x74c/0x1100 [ 26.270820][ T385] driver_probe_device+0xe3/0x240 [ 26.275808][ T385] page last free stack trace: [ 26.280461][ T385] free_pcp_prepare+0x1a9/0x270 [ 26.285282][ T385] __free_pages+0x9c/0x250 [ 26.289677][ T385] __vunmap+0x7b6/0x8f0 [ 26.293800][ T385] free_partitions+0x32/0x40 [ 26.298357][ T385] rescan_partitions+0xcfd/0xd70 [ 26.303263][ T385] __blkdev_get+0x1008/0x1bb0 [ 26.307906][ T385] blkdev_get+0xa1/0x390 [ 26.312141][ T385] __device_add_disk+0xbc4/0x1200 [ 26.317134][ T385] sd_probe+0xa85/0xf90 [ 26.321267][ T385] really_probe+0x74c/0x1100 [ 26.325840][ T385] driver_probe_device+0xe3/0x240 [ 26.330838][ T385] __driver_attach_async_helper+0x196/0x290 [ 26.336697][ T385] async_run_entry_fn+0xea/0x3c0 [ 26.341601][ T385] process_one_work+0x679/0x1030 [ 26.346505][ T385] worker_thread+0xa6f/0x1400 [ 26.351148][ T385] kthread+0x30f/0x330 [ 26.355181][ T385] [ 26.357498][ T385] Memory state around the buggy address: [ 26.363101][ T385] ffff8881eeef0280: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.371127][ T385] ffff8881eeef0300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.379152][ T385] >ffff8881eeef0380: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 26.387179][ T385] ^ [ 26.391485][ T385] ffff8881eeef0400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.399606][ T385] ffff8881eeef0480: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc 14:38:02 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$fou(&(0x7f0000000000), r0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, 0xffffffffffffffff) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) sendmsg$NL80211_CMD_DISASSOCIATE(r0, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)={0x164, r1, 0x400, 0x70bd2c, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_IE={0x14d, 0x2a, [@link_id={0x65, 0x12, {@from_mac, @device_a, @broadcast}}, @ssid={0x0, 0x6, @default_ibss_ssid}, @supported_rates={0x1, 0x6, [{0x29}, {0x30, 0x1}, {0x5}, {0x1}, {0x4}, {0x4, 0x1}]}, @tim={0x5, 0xc0, {0x7, 0x68, 0x80, "61657e60f0801a300509aab918ab1971761a963dd21eb9e9c9024899cca7173fff84acb5125eef28533baeb1d9fda0d6669cc46ce466affeb608cbf1fe42d44a07d717b07203f58dc1c6f7355c1fc80ce920418fdcaadfb61589d8fc9f9bffa45113d826d1b5f403b18c2b55a83a0ab727c4d8f3ba995882944dfd7e7b71a7d6b910b06173fca2d1c86a9adec4a962145f1bb9a95e974795a6ac80352c76d60f8de261d13a3cc1414b28ce86f725c97c5c24154048d4dab242e3e8fa86"}}, @link_id={0x65, 0x12, {@random="ae81ff7d5170", @broadcast}}, @ibss={0x6, 0x2, 0xc81c}, @random={0x1, 0x3c, "7045311358996128f2395883547f6b80b2fd27a9f69591031ecd896f20eeb76ad877ab6038afa87a277368ce754cf5ed8866f880e8a8be8ff4db00ef"}, @gcr_ga={0xbd, 0x6, @device_b}, @channel_switch={0x25, 0x3, {0x1, 0x8c, 0xa2}}]}]}, 0x164}, 0x1, 0x0, 0x0, 0xc814}, 0xc040) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TDLS_CHANNEL_SWITCH(r0, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x58, r1, 0x2, 0x70bd27, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x400, 0x3b}}}}, [@NL80211_ATTR_OPER_CLASS={0x5, 0xd6, 0x3}, @chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0xb}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x3c7}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x1}], @NL80211_ATTR_OPER_CLASS={0x5, 0xd6, 0x34}]}, 0x58}}, 0x10000080) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000480), r2) sendmsg$NL80211_CMD_TDLS_CHANNEL_SWITCH(r2, &(0x7f0000000580)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000540)={&(0x7f00000004c0)={0x64, r4, 0x300, 0x70bd27, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x80, 0x53}}}}, [@NL80211_ATTR_OPER_CLASS={0x5, 0xd6, 0x1}, @NL80211_ATTR_OPER_CLASS={0x5}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_OPER_CLASS={0x5, 0xd6, 0x1}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x64}, 0x1, 0x0, 0x0, 0x2000000}, 0x40000) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_RELOAD_REGDB(r5, &(0x7f0000000680)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x400802}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x14, r1, 0x4, 0x70bd28, 0x25dfdbff, {}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x840) r6 = syz_open_dev$vcsa(&(0x7f00000006c0), 0xfffffffffffeffff, 0x20103) sendmsg$NL80211_CMD_DEL_STATION(r6, &(0x7f0000000800)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000740)={0x6c, r4, 0x8, 0x70bd2c, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_STA_WME={0x2c, 0x81, [@NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0x6}, @NL80211_STA_WME_MAX_SP={0x5}, @NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0x2}, @NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0x9}, @NL80211_STA_WME_MAX_SP={0x5, 0x2, 0x3}]}, @NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x723}, @NL80211_ATTR_AIRTIME_WEIGHT={0x6, 0x112, 0x1}, @NL80211_ATTR_STA_WME={0x14, 0x81, [@NL80211_STA_WME_MAX_SP={0x5, 0x2, 0x7e}, @NL80211_STA_WME_MAX_SP={0x5, 0x2, 0x3}]}, @NL80211_ATTR_LOCAL_MESH_POWER_MODE={0x8, 0xa4, 0x2}]}, 0x6c}, 0x1, 0x0, 0x0, 0x8040}, 0x8000) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NET_DM_CMD_STOP(r7, &(0x7f0000000900)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000880)={0x14, 0x0, 0x10, 0x70bd2c, 0x25dfdbfb, {}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) getpgrp(0xffffffffffffffff) sendmsg$NL80211_CMD_START_P2P_DEVICE(r5, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x28, r4, 0x100, 0x70bd26, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x0, 0xe}}}}, ["", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x810}, 0x400c014) prctl$PR_SCHED_CORE(0x3e, 0x1, 0xffffffffffffffff, 0x0, &(0x7f0000000a40)) sendmsg$NL80211_CMD_RELOAD_REGDB(r5, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14, r4, 0x1, 0x70bd28, 0x25dfdbfe, {}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4040881}, 0x0) 14:38:02 executing program 4: r0 = socket(0x0, 0x1, 0x2) sendmsg$NL80211_CMD_GET_KEY(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x7c, 0x0, 0xc30, 0x70bd28, 0x25dfdbfb, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac05}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "b98e1c15b9504b03c1de98fdff"}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "a448a9969794224f53b27f76e3"}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac01}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "0c2e0e097645692b3641dbc8ff"}]}, 0x7c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10000) io_uring_setup(0x3d2a, &(0x7f0000000140)={0x0, 0xee28, 0x2, 0x2, 0xf5}) r1 = syz_open_dev$vcsa(&(0x7f00000001c0), 0x8, 0x402082) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEL_STATION(r1, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x54, 0x0, 0x800, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_STA_TX_POWER_SETTING={0x5, 0x113, 0x1}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x9d}, @NL80211_ATTR_STA_FLAGS2={0xc, 0x43, {0x7}}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_AIRTIME_WEIGHT={0x6, 0x112, 0x6}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x7012}]}, 0x54}, 0x1, 0x0, 0x0, 0x20000000}, 0x4040004) sendmsg$NL80211_CMD_GET_MPP(r1, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x44, 0x0, 0x2, 0x70bd25, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}]}, 0x44}, 0x1, 0x0, 0x0, 0x804}, 0x81) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r1, 0x40082102, &(0x7f00000004c0)) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000580)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_MCAST_RATE(r1, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x40, r3, 0x300, 0x70bd2d, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0x8, 0x61}}}}, [@NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x21c}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0xf0}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x78}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000010}, 0x1010) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f00000007c0)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000780)={&(0x7f00000006c0)={0xac, r3, 0x10, 0x70bd2a, 0x25dfdbfe, {{}, {@void, @void, @val={0xc, 0x99, {0x8000, 0x1a}}}}, [@NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @mon_options=[@NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "694edb82987efca9726b73dbad87aee9c82f5881a01e260e"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "3a6891e4f568a688f298dd323c27c3d5337f12d8da63e512"}, @NL80211_ATTR_MNTR_FLAGS={0x14, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}]}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "b402286e97edaf79b6a5ca4ad38ae0d1859405033784ba8b"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "d11a0cbf38e9334c37895f93e68d51c754bb1b6faa3e765f"}]]}, 0xac}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000000900)={0x3, 0x9, 0x1, 0x4195, 0xdd, 0x8, &(0x7f0000000800)="63f58ea60fe7dd9b64b9d78660f645dfa5779ae6a8b497cfb0441078497694e79203c3a069573f0c7b12c0d93febab8b1ba2ca2d951e0b9d8182d058ee8f22353bfecf2e666011b3851e9f916949e18a292547d2cca0da41625139c16d7c060634113556136ff3f94e70dde9f920a1a5b79567f27850358e5a704e657e7505912a6b687db7380cc01c4bda0e7303a5dfa4bc8abdfadcefbcd2ae5c09943c382692f48f967d7ceb6306166902ecbcabb032e0bed88c6b2f700aa406ec1f8175d6d80d0a1bac05373ced80901199b41b51aad80839106297d33b37df84b5"}) r5 = syz_open_dev$vcsa(&(0x7f0000000940), 0x10001, 0x880) sendmsg$NL80211_CMD_SET_REG(r5, &(0x7f0000000a40)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000a00)={&(0x7f00000009c0)={0x24, r3, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8, 0x1, 0x26}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x50}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x20008000) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a80), r0) r7 = syz_open_dev$usbfs(&(0x7f0000000ac0), 0x10000, 0x84000) ioctl$USBDEVFS_CONTROL(r7, 0xc0185500, &(0x7f0000000c00)={0x20, 0x15, 0x400, 0x8c, 0xcb, 0x3, &(0x7f0000000b00)="bb9f37e5f888ed7c5bf4bae605138e599a478480df77808c2c6b73862935705cf1d56bc20ba7a3c6ebcfc9fe0f61e1ccac9e5c9bcaeee7d7f6b5f1579f430ad4f0b632d92fcc3fc71110e0bba4a8b012d132b77360f379455122038ba8cc67f62f0e3e9656eb99b6f79ccc860088b670787669edbc0f4322ae1da014a737b224300f03272c230885ad11d2066a8418773d82c481dcca7c876c8bd177b06772978372fa95f02f2386b63e129010b4c945eb2c159084202ad1f67d49be3c72e91fc56d1e30a717e902cd42ba"}) sendmsg$NL80211_CMD_SET_PMKSA(r0, &(0x7f0000000d00)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r6, 0x4, 0x70bd26, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x2, 0x2d}}}}, [@NL80211_ATTR_PMK_LIFETIME={0x8, 0x11f, 0x7}, @NL80211_ATTR_PMK_REAUTH_THRESHOLD={0x5, 0x120, 0x50}]}, 0x30}, 0x1, 0x0, 0x0, 0x4010}, 0x20000800) 14:38:02 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) ioctl$UI_SET_KEYBIT(r0, 0x40045565, 0x54) prctl$PR_SET_SECUREBITS(0x1c, 0x8) sendmsg$NL80211_CMD_SET_PMKSA(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x4000015) prctl$PR_SET_SECUREBITS(0x1c, 0x20) r1 = syz_open_dev$vcsa(&(0x7f0000000100), 0x920, 0x240) ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1d6) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000140), 0x802, 0x0) ioctl$UI_SET_EVBIT(r2, 0x40045564, 0x1d) ioctl$UI_BEGIN_FF_UPLOAD(r2, 0xc06855c8, &(0x7f00000001c0)={0x5, 0x9, {0x54, 0xfff8, 0x62, {0x100, 0x9d2}, {0x7ff, 0x101}, @period={0x59, 0x2, 0x3, 0x5, 0x8, {0x4, 0x3f7, 0x9, 0x3d9b}, 0x8, &(0x7f0000000180)=[0xfbe0, 0x31a7, 0x6, 0x3, 0xa9c, 0x1, 0x6145, 0x7]}}, {0x54, 0x20, 0x6, {0x8000, 0x401}, {0x3, 0x3ff}, @ramp={0x2, 0x3e5c, {0x1, 0x4, 0x3, 0x1000}}}}) r3 = syz_open_dev$vcsa(&(0x7f0000000240), 0x6, 0x111000) ioctl$UI_SET_PHYS(r3, 0x4008556c, &(0x7f0000000280)='syz1\x00') r4 = openat$uinput(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) clock_gettime(0x0, &(0x7f0000000300)={0x0, 0x0}) write$input_event(r4, &(0x7f0000000340)={{r5, r6/1000+10000}, 0x1, 0xfff7}, 0x18) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r1) ioctl$UI_END_FF_ERASE(r4, 0x400c55cb, &(0x7f00000003c0)={0x5, 0x4, 0x1}) r7 = syz_open_pts(r1, 0x218040) ioctl$TIOCSETD(r7, 0x5423, &(0x7f0000000400)=0x16) 14:38:02 executing program 3: pselect6(0x40, &(0x7f0000000000)={0xe1, 0x1000, 0x5, 0x5, 0x400, 0xfffffffffffffffa, 0xffffffffffff0001, 0x8}, &(0x7f0000000040)={0x8, 0x100000001, 0x6ed0, 0x82, 0x401, 0x8, 0x3, 0x2}, &(0x7f0000000080)={0x1, 0x8000, 0x1, 0xffff, 0x6, 0x7fffffff, 0x4, 0xfffffffeffffffff}, &(0x7f00000000c0)={0x77359400}, &(0x7f0000000140)={&(0x7f0000000100)={[0x5]}, 0x8}) futex(&(0x7f0000000180)=0x1, 0x0, 0x2, &(0x7f00000001c0)={0x0, 0x989680}, &(0x7f0000000200)=0x1, 0x1) clock_getres(0x0, &(0x7f0000000240)) clock_gettime(0x0, &(0x7f0000000340)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000280)={0xffffffffffff8001, 0x8, 0x3, 0x8001, 0x1d, 0x5, 0x100000000, 0x6}, &(0x7f00000002c0)={0x10000, 0xf5, 0x9, 0x3, 0x3f, 0x10000, 0xafaa, 0xf0}, &(0x7f0000000300)={0x3f, 0x100000000, 0x9, 0xd7d9, 0xcffb, 0x854, 0x9, 0xffffffffffffffe0}, &(0x7f0000000380)={r0, r1+60000000}, &(0x7f0000000400)={&(0x7f00000003c0)={[0x80000000]}, 0x8}) clock_settime(0x4, &(0x7f0000000440)={0x77359400}) prctl$PR_SET_THP_DISABLE(0x29, 0x1) clock_getres(0x6, &(0x7f0000000480)) clock_gettime(0x3, &(0x7f00000004c0)) clock_settime(0x5, &(0x7f0000000500)={0x77359400}) pselect6(0x40, &(0x7f0000000540)={0x9, 0x9, 0x4, 0x3, 0xbc88, 0x3, 0x2, 0x2}, &(0x7f0000000580)={0x1f, 0x6, 0x26ba, 0x8, 0x1, 0x8000, 0x1, 0x8}, 0x0, &(0x7f00000005c0)={0x0, 0x3938700}, &(0x7f0000000640)={&(0x7f0000000600)={[0x10001]}, 0x8}) accept4$vsock_stream(0xffffffffffffffff, &(0x7f0000000680)={0x28, 0x0, 0x0, @local}, 0x10, 0x80800) pselect6(0x40, &(0x7f00000006c0)={0x1, 0x1, 0x89e, 0x4, 0xffffffffffffff16, 0x400, 0x1, 0x9}, &(0x7f0000000700)={0x9, 0x5, 0xc56, 0xf732, 0x1, 0x1, 0x20, 0x101}, &(0x7f0000000740)={0x1df0a00000, 0x9, 0x7, 0x8001, 0x2, 0x80000000, 0xfffffffffffff801}, &(0x7f0000000780)={0x0, 0x3938700}, &(0x7f0000000800)={&(0x7f00000007c0)={[0x6]}, 0x8}) sendmsg$IEEE802154_ASSOCIATE_RESP(0xffffffffffffffff, &(0x7f0000000900)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000880)={0x40, 0x0, 0x20, 0x70bd29, 0x25dfdbfc, {}, [@IEEE802154_ATTR_STATUS={0x5, 0x3, 0x6}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x5}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x1}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa0}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4008000}, 0x4000000) prctl$PR_SET_THP_DISABLE(0x29, 0x1) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, &(0x7f0000000b40)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000980)={0x150, 0x0, 0x8, 0x70bd27, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_TESTDATA={0x72, 0x45, "d97d387e742764bac778bb3cf8eddb74f6a0a2f307b791b5e8b34f0ade3bdf9e54c3eceaea6cb6df5b0c18b5592815a59ff23c80d0dac40899af314b43f1d59c398a3ddbb01337581bb654d085d00128fffcb5c19245582a2c27b84e7ec713533232ad3ab44266f3ab3c6b36eff1"}, @NL80211_ATTR_TESTDATA={0x3a, 0x45, "c42820db057701f4a5e00d1e4afa5f62b894abca71006d976fe37af6d520a2624f98dea90fb1c69ee242d278373e963d021b8326d139"}, @NL80211_ATTR_TESTDATA={0x8a, 0x45, "a8a46af0c5e6cab9624ddfafbdfbf1b1391ffee937b7efc28b8ebd4c2cdb69000fccee43bfeb334e39495770f937e53da7eee55ae11dd18453dc85d6a4ac88846238770ab62907521962e3bdd5d1c811b3d6d1ab00c3a4ca316c41716e8d60c7a27e8922eef2c5baa3214c5fce29d2ab15cfbf5edcb76d1221921d1bf0ccb0c4be515cbefe15"}]}, 0x150}, 0x1, 0x0, 0x0, 0x10}, 0x8) futex(&(0x7f0000000b80), 0x3, 0x2, &(0x7f0000000bc0)={0x77359400}, &(0x7f0000000c00)=0x1, 0x1) syz_genetlink_get_family_id$nl80211(&(0x7f0000000c80), 0xffffffffffffffff) pselect6(0x40, &(0x7f0000000dc0)={0x1, 0x81, 0x0, 0x9c31, 0x502, 0xe101, 0x0, 0x4}, &(0x7f0000000e00)={0x2, 0x2e4b, 0xa6, 0x200, 0x2, 0x0, 0x8, 0x7ff}, &(0x7f0000000e40)={0x95, 0x3, 0xff, 0xffffffffffffb022, 0x96f7, 0x7fff, 0x9, 0x9}, &(0x7f0000000e80), &(0x7f0000000f00)={&(0x7f0000000ec0)={[0x2]}, 0x8}) 14:38:02 executing program 1: clock_getres(0x7, &(0x7f0000000000)) pselect6(0x40, &(0x7f0000000040)={0x5, 0x7fffffff, 0x5, 0xb1, 0x10000, 0x7, 0x7, 0xe4ee}, &(0x7f0000000080)={0x1, 0x5, 0x283, 0x7e, 0x57dc, 0xffff, 0x363b2f21, 0x9}, &(0x7f00000000c0)={0x6, 0x8, 0x101, 0x1, 0x1f, 0xe68, 0x5, 0x9}, &(0x7f0000000100)={0x0, 0x989680}, &(0x7f0000000180)={&(0x7f0000000140)={[0x800]}, 0x8}) clock_gettime(0x0, &(0x7f0000000200)={0x0, 0x0}) futex(&(0x7f00000001c0), 0x4, 0x1, &(0x7f0000000240)={r0, r1+10000000}, &(0x7f0000000280)=0x2, 0x2) prctl$PR_GET_PDEATHSIG(0x2, &(0x7f00000002c0)) pselect6(0x40, &(0x7f0000000300)={0x7, 0x3, 0x2, 0x800, 0x4f7, 0x3, 0x3, 0x10001}, &(0x7f0000000340)={0x5, 0x2, 0x7ff, 0x40, 0xff, 0x2, 0x5, 0x4}, &(0x7f0000000380)={0x7, 0x0, 0x101, 0x662, 0x0, 0x5, 0x2, 0x7b4}, &(0x7f00000003c0)={0x0, 0x989680}, &(0x7f0000000440)={&(0x7f0000000400), 0x8}) ioctl$UI_SET_PROPBIT(0xffffffffffffffff, 0x4004556e, 0x15) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, &(0x7f0000000480)='syz1\x00') ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x6) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f00000004c0), 0x802, 0x0) ioctl$UI_SET_RELBIT(r2, 0x40045566, 0x7) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000500), 0x802, 0x0) ioctl$UI_SET_KEYBIT(r3, 0x40045565, 0x6c) ioctl$UI_SET_RELBIT(r2, 0x40045566, 0xa) sendmsg$NL80211_CMD_START_P2P_DEVICE(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x1c, 0x0, 0x20, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x8}, @void}}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4049000}, 0x20000000) r4 = syz_open_dev$vcsa(&(0x7f0000000640), 0x3, 0x400000) ioctl$UI_SET_ABSBIT(r4, 0x40045567, 0x5) clock_gettime(0x6, &(0x7f0000000680)) ioctl$UI_END_FF_UPLOAD(r4, 0x406855c9, &(0x7f0000000700)={0xd, 0x7, {0x54, 0x7ff, 0x1f, {0x80, 0x7}, {0x3, 0x7}, @cond=[{0x27ed, 0x401, 0x7, 0x2, 0x1000, 0x228}, {0x878c, 0xffe0, 0x9, 0xdc6a, 0x6, 0xff}]}, {0x53, 0xd3b, 0x800, {0xf7, 0x71a6}, {0x6, 0xf}, @period={0x5a, 0x1000, 0x5c, 0x5, 0x4d48, {0x3, 0x4, 0x8001, 0x1ff}, 0x9, &(0x7f00000006c0)=[0xfbff, 0x9, 0xbb0, 0xfff9, 0xe1a, 0x6509, 0x2e8f, 0xb01b, 0x6a0]}}}) ioctl$USBDEVFS_RESETEP(0xffffffffffffffff, 0x80045503, &(0x7f00000007c0)={0xf}) [ 26.407634][ T385] ================================================================== [ 26.415713][ T385] Disabling lock debugging due to kernel taint [ 26.452921][ T385] syz-executor.2 (385) used greatest stack depth: 21840 bytes left 14:38:03 executing program 0: clock_getres(0x4, &(0x7f0000000000)) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$UI_SET_SWBIT(r0, 0x4004556d, 0x0) clock_gettime(0x4, &(0x7f0000000080)) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) setsockopt$bt_hci_HCI_DATA_DIR(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000000c0)=0x81, 0x4) clock_getres(0x6, &(0x7f0000000100)) write$uinput_user_dev(r0, &(0x7f0000000140)={'syz1\x00', {0x800, 0x19, 0x100, 0x6}, 0xf, [0x5, 0xfffff800, 0xe, 0x8, 0x9, 0x1, 0x40, 0xff, 0x0, 0x1, 0xa87, 0xfffffffb, 0x8, 0x9, 0x7, 0x1, 0x1, 0x80000000, 0xfffffffe, 0x4, 0x3b, 0x7ff, 0x1, 0x5, 0xffffffff, 0x0, 0x7, 0x4, 0x7d0, 0x3b, 0x1ff, 0xffff, 0x5f0b, 0x7, 0xfffff000, 0x1, 0xa5, 0x6, 0x6, 0x10001, 0x2, 0xffffffff, 0xfc91, 0x0, 0x6, 0xfffffff8, 0xdca7, 0x2, 0xc0d, 0x80000000, 0x6, 0xffffffff, 0x0, 0x401, 0x3, 0x7, 0x2, 0x0, 0xfffffffc, 0x7ff, 0x7, 0x6, 0xf0a5, 0x81], [0x1c, 0x4, 0x1, 0xa86e, 0x8001, 0x100, 0x3, 0x5, 0x1, 0x6, 0x3568, 0x0, 0x9, 0x6, 0x7fffffff, 0x6f, 0x103, 0x4, 0xffa, 0x4, 0x0, 0x81, 0x2, 0x81f, 0x75ad, 0x4, 0x1873, 0x72e, 0x1, 0xd1, 0x6, 0x0, 0x83, 0x9, 0xc5e, 0x10000, 0x0, 0x1, 0x6, 0x9de, 0x3ff, 0x7f, 0x7, 0x8000, 0xf4c, 0x0, 0x8, 0x3f, 0x1, 0x80000001, 0xffffffff, 0xfffffffb, 0x6, 0x4d1, 0x6, 0x4, 0x5, 0xff, 0x1, 0x9, 0x6, 0x3, 0xffffffff, 0x3], [0xcd, 0x3, 0xf, 0x80000000, 0x5, 0x7, 0x1, 0x7, 0x80000000, 0x0, 0x4, 0x4, 0x7, 0x1, 0x1, 0x0, 0x8, 0x1, 0x855, 0x5, 0x75ae, 0x4411, 0x8, 0xffff, 0x200, 0x7, 0xc4, 0x11fedc7, 0xffff, 0x101, 0xffffffff, 0x7fff, 0x0, 0xffffffff, 0xf30, 0x7, 0x6, 0x2, 0x3f, 0x40000000, 0x23, 0x0, 0x21, 0x1, 0x5, 0x6, 0x401, 0x53f, 0x1, 0x10000, 0x800, 0x2, 0x0, 0x800, 0x7, 0x0, 0x7, 0x1, 0x3, 0x50000000, 0x10000, 0xffffffff, 0x2, 0x3], [0x4, 0x0, 0xffff, 0xc82d, 0xe02, 0x80000000, 0x2, 0xff, 0x5, 0x4, 0x5a, 0x80000000, 0x1ff, 0x4, 0x2, 0x89, 0x5, 0x4, 0x81, 0x5, 0xfffffeff, 0x9, 0x0, 0xb8e, 0x79ed, 0x4, 0x4, 0x1ff, 0x0, 0xde, 0x80, 0x3, 0x4, 0x5, 0x10001, 0x3f, 0x8001, 0x2, 0xdf56, 0xffff, 0x4, 0x52, 0x6, 0x7ff, 0x80000001, 0x4, 0x5, 0x8, 0x1, 0x31f24a7, 0x5, 0x1ff, 0x4f, 0x3, 0x100, 0x80000001, 0xfff, 0xd9f, 0x6f, 0x7, 0x1, 0x1, 0x9, 0x227d]}, 0x45c) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT(0xffffffffffffffff, 0x28, 0x6, &(0x7f00000005c0)={0x77359400}, 0x10) capset(&(0x7f0000000600)={0xf1504}, &(0x7f0000000640)={0x0, 0x1, 0x20, 0x20, 0x3, 0xffffffff}) select(0x40, &(0x7f0000000680)={0x5, 0x9, 0xf84, 0xfffffffffffffffc, 0x1ff, 0xded, 0xb1, 0x2}, &(0x7f00000006c0)={0xe0000000000000, 0x4, 0x3, 0x7, 0x49b5, 0x7, 0xffffffff00000000, 0x6}, &(0x7f0000000700)={0xfffffffffffffffd, 0x100000001, 0x5, 0xcdb, 0x3ff, 0x81, 0x81, 0x7c0}, &(0x7f0000000740)={0x0, 0xea60}) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000780), 0x802, 0x0) write$uinput_user_dev(r1, &(0x7f00000007c0)={'syz1\x00', {0x2, 0x9a, 0x9, 0x8}, 0x14, [0x8000, 0x52, 0x8, 0x8, 0x7, 0xfff, 0x1, 0x7fffffff, 0x10001, 0x10001, 0x4, 0x2, 0x10000, 0x1000, 0x8, 0x0, 0x1, 0x4, 0x10000, 0x6, 0x8e, 0xffffffff, 0x7, 0xd23, 0xfd67, 0x20000000, 0x800, 0x7, 0x10001, 0x8, 0x0, 0x2, 0x6, 0xfffffffa, 0x3f, 0x4, 0xfffffff8, 0x1f, 0x3, 0x418, 0x8, 0x1f, 0x101, 0x2a, 0x1f, 0x4, 0x80000000, 0x9, 0x2, 0x7, 0x0, 0x10000, 0x5, 0x8000, 0x3, 0x4, 0x63b, 0x0, 0x7fff, 0xdb33, 0xe6f4, 0x5, 0x7, 0x1000], [0x1, 0x40000000, 0x800, 0xfa9c, 0x3f6, 0xffffff35, 0x9, 0x7f, 0x6, 0x42, 0x6, 0x3, 0x8, 0xde, 0x0, 0x5, 0x7, 0x9, 0x4, 0x8, 0x80000001, 0x3, 0x1, 0x7, 0x3, 0x1, 0x64a4a95f, 0x7, 0x1000, 0x4, 0x101, 0x5, 0x80, 0x7fff, 0x7, 0x14, 0x1ff, 0xee, 0x0, 0x3, 0xffffffe1, 0x81, 0x7fff, 0x9, 0x6, 0x0, 0x401, 0x7, 0x3f, 0x9, 0x7fffffff, 0x1f, 0x3, 0x7, 0x9, 0x40, 0x30000, 0x4, 0x401, 0x8, 0x0, 0x7fff, 0x1ff, 0x20], [0x1f, 0x5, 0x7, 0x4036, 0x2, 0xfffffff9, 0x7, 0x45, 0x7fffffff, 0x6, 0x9, 0x8, 0x1, 0x7ff, 0x8, 0xfffffff8, 0x2ffac02c, 0x80, 0x100, 0xff, 0x800, 0x3, 0x9, 0x3, 0xffffffff, 0x2, 0x3, 0x0, 0x2ff, 0x5, 0x7f, 0x20, 0x3, 0x2, 0x6, 0xbd3b, 0x2, 0xfffffffb, 0x7f, 0x7, 0x8000, 0x5, 0xfffffffe, 0x8000, 0x3, 0x8, 0x5c, 0x40, 0x8, 0x200, 0x8, 0x8000, 0xe7b, 0x80000000, 0x9, 0x7ff, 0xfffffffa, 0x1, 0xf418, 0x100, 0x2722, 0x3, 0x7ff, 0xff], [0x1d47a776, 0x2, 0x6, 0x8, 0x7f, 0x3, 0x9, 0x1000, 0x40, 0x1ff, 0xfffffff7, 0x0, 0x6, 0x80, 0x90000, 0x11, 0x3, 0x3, 0x5, 0x1, 0x3ff, 0x100, 0x450, 0xffff8001, 0x400, 0x7, 0x8, 0x7, 0x2, 0x2, 0x20, 0x0, 0x9, 0x4, 0x800, 0xd7, 0x10001, 0x8, 0xfff, 0x1, 0x3, 0x7f, 0xd76b, 0xee, 0x5, 0x4, 0x2, 0x9, 0x8, 0x8, 0x2, 0x0, 0x9fc9, 0x9, 0x8, 0x2, 0x0, 0x0, 0xffff, 0x9, 0x95e1, 0x0, 0x0, 0x101]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x7) write$P9_RXATTRWALK(0xffffffffffffffff, &(0x7f0000000dc0)={0xf, 0x1f, 0x2, 0x8}, 0xf) 14:38:03 executing program 4: r0 = socket(0x0, 0x1, 0x2) sendmsg$NL80211_CMD_GET_KEY(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x7c, 0x0, 0xc30, 0x70bd28, 0x25dfdbfb, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac05}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "b98e1c15b9504b03c1de98fdff"}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "a448a9969794224f53b27f76e3"}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac01}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "0c2e0e097645692b3641dbc8ff"}]}, 0x7c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10000) io_uring_setup(0x3d2a, &(0x7f0000000140)={0x0, 0xee28, 0x2, 0x2, 0xf5}) r1 = syz_open_dev$vcsa(&(0x7f00000001c0), 0x8, 0x402082) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEL_STATION(r1, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x54, 0x0, 0x800, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_STA_TX_POWER_SETTING={0x5, 0x113, 0x1}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x9d}, @NL80211_ATTR_STA_FLAGS2={0xc, 0x43, {0x7}}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_AIRTIME_WEIGHT={0x6, 0x112, 0x6}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x7012}]}, 0x54}, 0x1, 0x0, 0x0, 0x20000000}, 0x4040004) sendmsg$NL80211_CMD_GET_MPP(r1, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x44, 0x0, 0x2, 0x70bd25, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}]}, 0x44}, 0x1, 0x0, 0x0, 0x804}, 0x81) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r1, 0x40082102, &(0x7f00000004c0)) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000580)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_MCAST_RATE(r1, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x40, r3, 0x300, 0x70bd2d, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0x8, 0x61}}}}, [@NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x21c}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0xf0}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x78}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000010}, 0x1010) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f00000007c0)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000780)={&(0x7f00000006c0)={0xac, r3, 0x10, 0x70bd2a, 0x25dfdbfe, {{}, {@void, @void, @val={0xc, 0x99, {0x8000, 0x1a}}}}, [@NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @mon_options=[@NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "694edb82987efca9726b73dbad87aee9c82f5881a01e260e"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "3a6891e4f568a688f298dd323c27c3d5337f12d8da63e512"}, @NL80211_ATTR_MNTR_FLAGS={0x14, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}]}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "b402286e97edaf79b6a5ca4ad38ae0d1859405033784ba8b"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "d11a0cbf38e9334c37895f93e68d51c754bb1b6faa3e765f"}]]}, 0xac}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000000900)={0x3, 0x9, 0x1, 0x4195, 0xdd, 0x8, &(0x7f0000000800)="63f58ea60fe7dd9b64b9d78660f645dfa5779ae6a8b497cfb0441078497694e79203c3a069573f0c7b12c0d93febab8b1ba2ca2d951e0b9d8182d058ee8f22353bfecf2e666011b3851e9f916949e18a292547d2cca0da41625139c16d7c060634113556136ff3f94e70dde9f920a1a5b79567f27850358e5a704e657e7505912a6b687db7380cc01c4bda0e7303a5dfa4bc8abdfadcefbcd2ae5c09943c382692f48f967d7ceb6306166902ecbcabb032e0bed88c6b2f700aa406ec1f8175d6d80d0a1bac05373ced80901199b41b51aad80839106297d33b37df84b5"}) r5 = syz_open_dev$vcsa(&(0x7f0000000940), 0x10001, 0x880) sendmsg$NL80211_CMD_SET_REG(r5, &(0x7f0000000a40)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000a00)={&(0x7f00000009c0)={0x24, r3, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8, 0x1, 0x26}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x50}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x20008000) syz_genetlink_get_family_id$nl80211(&(0x7f0000000a80), r0) r6 = syz_open_dev$usbfs(&(0x7f0000000ac0), 0x10000, 0x84000) ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000c00)={0x20, 0x15, 0x400, 0x8c, 0xcb, 0x3, &(0x7f0000000b00)="bb9f37e5f888ed7c5bf4bae605138e599a478480df77808c2c6b73862935705cf1d56bc20ba7a3c6ebcfc9fe0f61e1ccac9e5c9bcaeee7d7f6b5f1579f430ad4f0b632d92fcc3fc71110e0bba4a8b012d132b77360f379455122038ba8cc67f62f0e3e9656eb99b6f79ccc860088b670787669edbc0f4322ae1da014a737b224300f03272c230885ad11d2066a8418773d82c481dcca7c876c8bd177b06772978372fa95f02f2386b63e129010b4c945eb2c159084202ad1f67d49be3c72e91fc56d1e30a717e902cd42ba"}) 14:38:03 executing program 3: pselect6(0x40, &(0x7f0000000000)={0xe1, 0x1000, 0x5, 0x5, 0x400, 0xfffffffffffffffa, 0xffffffffffff0001, 0x8}, &(0x7f0000000040)={0x8, 0x100000001, 0x6ed0, 0x82, 0x401, 0x8, 0x3, 0x2}, &(0x7f0000000080)={0x1, 0x8000, 0x1, 0xffff, 0x6, 0x7fffffff, 0x4, 0xfffffffeffffffff}, &(0x7f00000000c0)={0x77359400}, &(0x7f0000000140)={&(0x7f0000000100)={[0x5]}, 0x8}) futex(&(0x7f0000000180)=0x1, 0x0, 0x2, &(0x7f00000001c0)={0x0, 0x989680}, &(0x7f0000000200)=0x1, 0x1) clock_getres(0x0, &(0x7f0000000240)) clock_gettime(0x0, &(0x7f0000000340)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000280)={0xffffffffffff8001, 0x8, 0x3, 0x8001, 0x1d, 0x5, 0x100000000, 0x6}, &(0x7f00000002c0)={0x10000, 0xf5, 0x9, 0x3, 0x3f, 0x10000, 0xafaa, 0xf0}, &(0x7f0000000300)={0x3f, 0x100000000, 0x9, 0xd7d9, 0xcffb, 0x854, 0x9, 0xffffffffffffffe0}, &(0x7f0000000380)={r0, r1+60000000}, &(0x7f0000000400)={&(0x7f00000003c0)={[0x80000000]}, 0x8}) clock_settime(0x4, &(0x7f0000000440)={0x77359400}) prctl$PR_SET_THP_DISABLE(0x29, 0x1) clock_getres(0x6, &(0x7f0000000480)) clock_gettime(0x3, &(0x7f00000004c0)) clock_settime(0x5, &(0x7f0000000500)={0x77359400}) pselect6(0x40, &(0x7f0000000540)={0x9, 0x9, 0x4, 0x3, 0xbc88, 0x3, 0x2, 0x2}, &(0x7f0000000580)={0x1f, 0x6, 0x26ba, 0x8, 0x1, 0x8000, 0x1, 0x8}, 0x0, &(0x7f00000005c0)={0x0, 0x3938700}, &(0x7f0000000640)={&(0x7f0000000600)={[0x10001]}, 0x8}) accept4$vsock_stream(0xffffffffffffffff, &(0x7f0000000680)={0x28, 0x0, 0x0, @local}, 0x10, 0x80800) pselect6(0x40, &(0x7f00000006c0)={0x1, 0x1, 0x89e, 0x4, 0xffffffffffffff16, 0x400, 0x1, 0x9}, &(0x7f0000000700)={0x9, 0x5, 0xc56, 0xf732, 0x1, 0x1, 0x20, 0x101}, &(0x7f0000000740)={0x1df0a00000, 0x9, 0x7, 0x8001, 0x2, 0x80000000, 0xfffffffffffff801}, &(0x7f0000000780)={0x0, 0x3938700}, &(0x7f0000000800)={&(0x7f00000007c0)={[0x6]}, 0x8}) sendmsg$IEEE802154_ASSOCIATE_RESP(0xffffffffffffffff, &(0x7f0000000900)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000880)={0x40, 0x0, 0x20, 0x70bd29, 0x25dfdbfc, {}, [@IEEE802154_ATTR_STATUS={0x5, 0x3, 0x6}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x5}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x1}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa0}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4008000}, 0x4000000) prctl$PR_SET_THP_DISABLE(0x29, 0x1) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, &(0x7f0000000b40)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000980)={0x150, 0x0, 0x8, 0x70bd27, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_TESTDATA={0x72, 0x45, "d97d387e742764bac778bb3cf8eddb74f6a0a2f307b791b5e8b34f0ade3bdf9e54c3eceaea6cb6df5b0c18b5592815a59ff23c80d0dac40899af314b43f1d59c398a3ddbb01337581bb654d085d00128fffcb5c19245582a2c27b84e7ec713533232ad3ab44266f3ab3c6b36eff1"}, @NL80211_ATTR_TESTDATA={0x3a, 0x45, "c42820db057701f4a5e00d1e4afa5f62b894abca71006d976fe37af6d520a2624f98dea90fb1c69ee242d278373e963d021b8326d139"}, @NL80211_ATTR_TESTDATA={0x8a, 0x45, "a8a46af0c5e6cab9624ddfafbdfbf1b1391ffee937b7efc28b8ebd4c2cdb69000fccee43bfeb334e39495770f937e53da7eee55ae11dd18453dc85d6a4ac88846238770ab62907521962e3bdd5d1c811b3d6d1ab00c3a4ca316c41716e8d60c7a27e8922eef2c5baa3214c5fce29d2ab15cfbf5edcb76d1221921d1bf0ccb0c4be515cbefe15"}]}, 0x150}, 0x1, 0x0, 0x0, 0x10}, 0x8) futex(&(0x7f0000000b80), 0x3, 0x2, &(0x7f0000000bc0)={0x77359400}, &(0x7f0000000c00)=0x1, 0x1) pselect6(0x40, &(0x7f0000000dc0)={0x1, 0x81, 0x0, 0x9c31, 0x502, 0xe101, 0x0, 0x4}, &(0x7f0000000e00)={0x2, 0x2e4b, 0xa6, 0x200, 0x2, 0x0, 0x8, 0x7ff}, &(0x7f0000000e40)={0x95, 0x3, 0xff, 0xffffffffffffb022, 0x96f7, 0x7fff, 0x9, 0x9}, &(0x7f0000000e80), &(0x7f0000000f00)={&(0x7f0000000ec0)={[0x2]}, 0x8}) 14:38:03 executing program 1: clock_getres(0x7, &(0x7f0000000000)) pselect6(0x40, &(0x7f0000000040)={0x5, 0x7fffffff, 0x5, 0xb1, 0x10000, 0x7, 0x7, 0xe4ee}, &(0x7f0000000080)={0x1, 0x5, 0x283, 0x7e, 0x57dc, 0xffff, 0x363b2f21, 0x9}, &(0x7f00000000c0)={0x6, 0x8, 0x101, 0x1, 0x1f, 0xe68, 0x5, 0x9}, &(0x7f0000000100)={0x0, 0x989680}, &(0x7f0000000180)={&(0x7f0000000140)={[0x800]}, 0x8}) clock_gettime(0x0, &(0x7f0000000200)={0x0, 0x0}) futex(&(0x7f00000001c0), 0x4, 0x1, &(0x7f0000000240)={r0, r1+10000000}, &(0x7f0000000280)=0x2, 0x2) prctl$PR_GET_PDEATHSIG(0x2, &(0x7f00000002c0)) pselect6(0x40, &(0x7f0000000300)={0x7, 0x3, 0x2, 0x800, 0x4f7, 0x3, 0x3, 0x10001}, &(0x7f0000000340)={0x5, 0x2, 0x7ff, 0x40, 0xff, 0x2, 0x5, 0x4}, &(0x7f0000000380)={0x7, 0x0, 0x101, 0x662, 0x0, 0x5, 0x2, 0x7b4}, &(0x7f00000003c0)={0x0, 0x989680}, &(0x7f0000000440)={&(0x7f0000000400), 0x8}) ioctl$UI_SET_PROPBIT(0xffffffffffffffff, 0x4004556e, 0x15) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, &(0x7f0000000480)='syz1\x00') ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x6) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f00000004c0), 0x802, 0x0) ioctl$UI_SET_RELBIT(r2, 0x40045566, 0x7) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000500), 0x802, 0x0) ioctl$UI_SET_KEYBIT(r3, 0x40045565, 0x6c) ioctl$UI_SET_RELBIT(r2, 0x40045566, 0xa) sendmsg$NL80211_CMD_START_P2P_DEVICE(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x1c, 0x0, 0x20, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x8}, @void}}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4049000}, 0x20000000) r4 = syz_open_dev$vcsa(&(0x7f0000000640), 0x3, 0x400000) ioctl$UI_SET_ABSBIT(r4, 0x40045567, 0x5) clock_gettime(0x6, &(0x7f0000000680)) ioctl$UI_END_FF_UPLOAD(r4, 0x406855c9, &(0x7f0000000700)={0xd, 0x7, {0x54, 0x7ff, 0x1f, {0x80, 0x7}, {0x3, 0x7}, @cond=[{0x27ed, 0x401, 0x7, 0x2, 0x1000, 0x228}, {0x878c, 0xffe0, 0x9, 0xdc6a, 0x6, 0xff}]}, {0x53, 0xd3b, 0x800, {0xf7, 0x71a6}, {0x6, 0xf}, @period={0x5a, 0x1000, 0x5c, 0x5, 0x4d48, {0x3, 0x4, 0x8001, 0x1ff}, 0x9, &(0x7f00000006c0)=[0xfbff, 0x9, 0xbb0, 0xfff9, 0xe1a, 0x6509, 0x2e8f, 0xb01b, 0x6a0]}}}) 14:38:03 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) ioctl$UI_SET_KEYBIT(r0, 0x40045565, 0x54) prctl$PR_SET_SECUREBITS(0x1c, 0x8) sendmsg$NL80211_CMD_SET_PMKSA(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x4000015) prctl$PR_SET_SECUREBITS(0x1c, 0x20) r1 = syz_open_dev$vcsa(&(0x7f0000000100), 0x920, 0x240) ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1d6) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000140), 0x802, 0x0) ioctl$UI_SET_EVBIT(r2, 0x40045564, 0x1d) ioctl$UI_BEGIN_FF_UPLOAD(r2, 0xc06855c8, &(0x7f00000001c0)={0x5, 0x9, {0x54, 0xfff8, 0x62, {0x100, 0x9d2}, {0x7ff, 0x101}, @period={0x59, 0x2, 0x3, 0x5, 0x8, {0x4, 0x3f7, 0x9, 0x3d9b}, 0x8, &(0x7f0000000180)=[0xfbe0, 0x31a7, 0x6, 0x3, 0xa9c, 0x1, 0x6145, 0x7]}}, {0x54, 0x20, 0x6, {0x8000, 0x401}, {0x3, 0x3ff}, @ramp={0x2, 0x3e5c, {0x1, 0x4, 0x3, 0x1000}}}}) r3 = syz_open_dev$vcsa(&(0x7f0000000240), 0x6, 0x111000) ioctl$UI_SET_PHYS(r3, 0x4008556c, &(0x7f0000000280)='syz1\x00') r4 = openat$uinput(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) clock_gettime(0x0, &(0x7f0000000300)={0x0, 0x0}) write$input_event(r4, &(0x7f0000000340)={{r5, r6/1000+10000}, 0x1, 0xfff7}, 0x18) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r1) ioctl$UI_END_FF_ERASE(r4, 0x400c55cb, &(0x7f00000003c0)={0x5, 0x4, 0x1}) syz_open_pts(r1, 0x218040) 14:38:03 executing program 0: clock_getres(0x4, &(0x7f0000000000)) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$UI_SET_SWBIT(r0, 0x4004556d, 0x0) clock_gettime(0x4, &(0x7f0000000080)) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) setsockopt$bt_hci_HCI_DATA_DIR(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000000c0)=0x81, 0x4) clock_getres(0x6, &(0x7f0000000100)) write$uinput_user_dev(r0, &(0x7f0000000140)={'syz1\x00', {0x800, 0x19, 0x100, 0x6}, 0xf, [0x5, 0xfffff800, 0xe, 0x8, 0x9, 0x1, 0x40, 0xff, 0x0, 0x1, 0xa87, 0xfffffffb, 0x8, 0x9, 0x7, 0x1, 0x1, 0x80000000, 0xfffffffe, 0x4, 0x3b, 0x7ff, 0x1, 0x5, 0xffffffff, 0x0, 0x7, 0x4, 0x7d0, 0x3b, 0x1ff, 0xffff, 0x5f0b, 0x7, 0xfffff000, 0x1, 0xa5, 0x6, 0x6, 0x10001, 0x2, 0xffffffff, 0xfc91, 0x0, 0x6, 0xfffffff8, 0xdca7, 0x2, 0xc0d, 0x80000000, 0x6, 0xffffffff, 0x0, 0x401, 0x3, 0x7, 0x2, 0x0, 0xfffffffc, 0x7ff, 0x7, 0x6, 0xf0a5, 0x81], [0x1c, 0x4, 0x1, 0xa86e, 0x8001, 0x100, 0x3, 0x5, 0x1, 0x6, 0x3568, 0x0, 0x9, 0x6, 0x7fffffff, 0x6f, 0x103, 0x4, 0xffa, 0x4, 0x0, 0x81, 0x2, 0x81f, 0x75ad, 0x4, 0x1873, 0x72e, 0x1, 0xd1, 0x6, 0x0, 0x83, 0x9, 0xc5e, 0x10000, 0x0, 0x1, 0x6, 0x9de, 0x3ff, 0x7f, 0x7, 0x8000, 0xf4c, 0x0, 0x8, 0x3f, 0x1, 0x80000001, 0xffffffff, 0xfffffffb, 0x6, 0x4d1, 0x6, 0x4, 0x5, 0xff, 0x1, 0x9, 0x6, 0x3, 0xffffffff, 0x3], [0xcd, 0x3, 0xf, 0x80000000, 0x5, 0x7, 0x1, 0x7, 0x80000000, 0x0, 0x4, 0x4, 0x7, 0x1, 0x1, 0x0, 0x8, 0x1, 0x855, 0x5, 0x75ae, 0x4411, 0x8, 0xffff, 0x200, 0x7, 0xc4, 0x11fedc7, 0xffff, 0x101, 0xffffffff, 0x7fff, 0x0, 0xffffffff, 0xf30, 0x7, 0x6, 0x2, 0x3f, 0x40000000, 0x23, 0x0, 0x21, 0x1, 0x5, 0x6, 0x401, 0x53f, 0x1, 0x10000, 0x800, 0x2, 0x0, 0x800, 0x7, 0x0, 0x7, 0x1, 0x3, 0x50000000, 0x10000, 0xffffffff, 0x2, 0x3], [0x4, 0x0, 0xffff, 0xc82d, 0xe02, 0x80000000, 0x2, 0xff, 0x5, 0x4, 0x5a, 0x80000000, 0x1ff, 0x4, 0x2, 0x89, 0x5, 0x4, 0x81, 0x5, 0xfffffeff, 0x9, 0x0, 0xb8e, 0x79ed, 0x4, 0x4, 0x1ff, 0x0, 0xde, 0x80, 0x3, 0x4, 0x5, 0x10001, 0x3f, 0x8001, 0x2, 0xdf56, 0xffff, 0x4, 0x52, 0x6, 0x7ff, 0x80000001, 0x4, 0x5, 0x8, 0x1, 0x31f24a7, 0x5, 0x1ff, 0x4f, 0x3, 0x100, 0x80000001, 0xfff, 0xd9f, 0x6f, 0x7, 0x1, 0x1, 0x9, 0x227d]}, 0x45c) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT(0xffffffffffffffff, 0x28, 0x6, &(0x7f00000005c0)={0x77359400}, 0x10) capset(&(0x7f0000000600)={0xf1504}, &(0x7f0000000640)={0x0, 0x1, 0x20, 0x20, 0x3, 0xffffffff}) select(0x40, &(0x7f0000000680)={0x5, 0x9, 0xf84, 0xfffffffffffffffc, 0x1ff, 0xded, 0xb1, 0x2}, &(0x7f00000006c0)={0xe0000000000000, 0x4, 0x3, 0x7, 0x49b5, 0x7, 0xffffffff00000000, 0x6}, &(0x7f0000000700)={0xfffffffffffffffd, 0x100000001, 0x5, 0xcdb, 0x3ff, 0x81, 0x81, 0x7c0}, &(0x7f0000000740)={0x0, 0xea60}) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000780), 0x802, 0x0) write$uinput_user_dev(r1, &(0x7f00000007c0)={'syz1\x00', {0x2, 0x9a, 0x9, 0x8}, 0x14, [0x8000, 0x52, 0x8, 0x8, 0x7, 0xfff, 0x1, 0x7fffffff, 0x10001, 0x10001, 0x4, 0x2, 0x10000, 0x1000, 0x8, 0x0, 0x1, 0x4, 0x10000, 0x6, 0x8e, 0xffffffff, 0x7, 0xd23, 0xfd67, 0x20000000, 0x800, 0x7, 0x10001, 0x8, 0x0, 0x2, 0x6, 0xfffffffa, 0x3f, 0x4, 0xfffffff8, 0x1f, 0x3, 0x418, 0x8, 0x1f, 0x101, 0x2a, 0x1f, 0x4, 0x80000000, 0x9, 0x2, 0x7, 0x0, 0x10000, 0x5, 0x8000, 0x3, 0x4, 0x63b, 0x0, 0x7fff, 0xdb33, 0xe6f4, 0x5, 0x7, 0x1000], [0x1, 0x40000000, 0x800, 0xfa9c, 0x3f6, 0xffffff35, 0x9, 0x7f, 0x6, 0x42, 0x6, 0x3, 0x8, 0xde, 0x0, 0x5, 0x7, 0x9, 0x4, 0x8, 0x80000001, 0x3, 0x1, 0x7, 0x3, 0x1, 0x64a4a95f, 0x7, 0x1000, 0x4, 0x101, 0x5, 0x80, 0x7fff, 0x7, 0x14, 0x1ff, 0xee, 0x0, 0x3, 0xffffffe1, 0x81, 0x7fff, 0x9, 0x6, 0x0, 0x401, 0x7, 0x3f, 0x9, 0x7fffffff, 0x1f, 0x3, 0x7, 0x9, 0x40, 0x30000, 0x4, 0x401, 0x8, 0x0, 0x7fff, 0x1ff, 0x20], [0x1f, 0x5, 0x7, 0x4036, 0x2, 0xfffffff9, 0x7, 0x45, 0x7fffffff, 0x6, 0x9, 0x8, 0x1, 0x7ff, 0x8, 0xfffffff8, 0x2ffac02c, 0x80, 0x100, 0xff, 0x800, 0x3, 0x9, 0x3, 0xffffffff, 0x2, 0x3, 0x0, 0x2ff, 0x5, 0x7f, 0x20, 0x3, 0x2, 0x6, 0xbd3b, 0x2, 0xfffffffb, 0x7f, 0x7, 0x8000, 0x5, 0xfffffffe, 0x8000, 0x3, 0x8, 0x5c, 0x40, 0x8, 0x200, 0x8, 0x8000, 0xe7b, 0x80000000, 0x9, 0x7ff, 0xfffffffa, 0x1, 0xf418, 0x100, 0x2722, 0x3, 0x7ff, 0xff], [0x1d47a776, 0x2, 0x6, 0x8, 0x7f, 0x3, 0x9, 0x1000, 0x40, 0x1ff, 0xfffffff7, 0x0, 0x6, 0x80, 0x90000, 0x11, 0x3, 0x3, 0x5, 0x1, 0x3ff, 0x100, 0x450, 0xffff8001, 0x400, 0x7, 0x8, 0x7, 0x2, 0x2, 0x20, 0x0, 0x9, 0x4, 0x800, 0xd7, 0x10001, 0x8, 0xfff, 0x1, 0x3, 0x7f, 0xd76b, 0xee, 0x5, 0x4, 0x2, 0x9, 0x8, 0x8, 0x2, 0x0, 0x9fc9, 0x9, 0x8, 0x2, 0x0, 0x0, 0xffff, 0x9, 0x95e1, 0x0, 0x0, 0x101]}, 0x45c) write$P9_RXATTRWALK(0xffffffffffffffff, &(0x7f0000000dc0)={0xf, 0x1f, 0x2, 0x8}, 0xf) 14:38:03 executing program 1: clock_getres(0x7, &(0x7f0000000000)) pselect6(0x40, &(0x7f0000000040)={0x5, 0x7fffffff, 0x5, 0xb1, 0x10000, 0x7, 0x7, 0xe4ee}, &(0x7f0000000080)={0x1, 0x5, 0x283, 0x7e, 0x57dc, 0xffff, 0x363b2f21, 0x9}, &(0x7f00000000c0)={0x6, 0x8, 0x101, 0x1, 0x1f, 0xe68, 0x5, 0x9}, &(0x7f0000000100)={0x0, 0x989680}, &(0x7f0000000180)={&(0x7f0000000140)={[0x800]}, 0x8}) clock_gettime(0x0, &(0x7f0000000200)={0x0, 0x0}) futex(&(0x7f00000001c0), 0x4, 0x1, &(0x7f0000000240)={r0, r1+10000000}, &(0x7f0000000280)=0x2, 0x2) prctl$PR_GET_PDEATHSIG(0x2, &(0x7f00000002c0)) pselect6(0x40, &(0x7f0000000300)={0x7, 0x3, 0x2, 0x800, 0x4f7, 0x3, 0x3, 0x10001}, &(0x7f0000000340)={0x5, 0x2, 0x7ff, 0x40, 0xff, 0x2, 0x5, 0x4}, &(0x7f0000000380)={0x7, 0x0, 0x101, 0x662, 0x0, 0x5, 0x2, 0x7b4}, &(0x7f00000003c0)={0x0, 0x989680}, &(0x7f0000000440)={&(0x7f0000000400), 0x8}) ioctl$UI_SET_PROPBIT(0xffffffffffffffff, 0x4004556e, 0x15) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, &(0x7f0000000480)='syz1\x00') ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x6) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f00000004c0), 0x802, 0x0) ioctl$UI_SET_RELBIT(r2, 0x40045566, 0x7) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000500), 0x802, 0x0) ioctl$UI_SET_KEYBIT(r3, 0x40045565, 0x6c) ioctl$UI_SET_RELBIT(r2, 0x40045566, 0xa) sendmsg$NL80211_CMD_START_P2P_DEVICE(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x1c, 0x0, 0x20, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x8}, @void}}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4049000}, 0x20000000) r4 = syz_open_dev$vcsa(&(0x7f0000000640), 0x3, 0x400000) ioctl$UI_SET_ABSBIT(r4, 0x40045567, 0x5) clock_gettime(0x6, &(0x7f0000000680)) [ 26.477732][ T403] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2 [ 26.499140][ T403] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db 14:38:03 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$fou(&(0x7f0000000000), r0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, 0xffffffffffffffff) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) sendmsg$NL80211_CMD_DISASSOCIATE(r0, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)={0x164, r1, 0x400, 0x70bd2c, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_IE={0x14d, 0x2a, [@link_id={0x65, 0x12, {@from_mac, @device_a, @broadcast}}, @ssid={0x0, 0x6, @default_ibss_ssid}, @supported_rates={0x1, 0x6, [{0x29}, {0x30, 0x1}, {0x5}, {0x1}, {0x4}, {0x4, 0x1}]}, @tim={0x5, 0xc0, {0x7, 0x68, 0x80, "61657e60f0801a300509aab918ab1971761a963dd21eb9e9c9024899cca7173fff84acb5125eef28533baeb1d9fda0d6669cc46ce466affeb608cbf1fe42d44a07d717b07203f58dc1c6f7355c1fc80ce920418fdcaadfb61589d8fc9f9bffa45113d826d1b5f403b18c2b55a83a0ab727c4d8f3ba995882944dfd7e7b71a7d6b910b06173fca2d1c86a9adec4a962145f1bb9a95e974795a6ac80352c76d60f8de261d13a3cc1414b28ce86f725c97c5c24154048d4dab242e3e8fa86"}}, @link_id={0x65, 0x12, {@random="ae81ff7d5170", @broadcast}}, @ibss={0x6, 0x2, 0xc81c}, @random={0x1, 0x3c, "7045311358996128f2395883547f6b80b2fd27a9f69591031ecd896f20eeb76ad877ab6038afa87a277368ce754cf5ed8866f880e8a8be8ff4db00ef"}, @gcr_ga={0xbd, 0x6, @device_b}, @channel_switch={0x25, 0x3, {0x1, 0x8c, 0xa2}}]}]}, 0x164}, 0x1, 0x0, 0x0, 0xc814}, 0xc040) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TDLS_CHANNEL_SWITCH(r0, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x58, r1, 0x2, 0x70bd27, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x400, 0x3b}}}}, [@NL80211_ATTR_OPER_CLASS={0x5, 0xd6, 0x3}, @chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0xb}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x3c7}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x1}], @NL80211_ATTR_OPER_CLASS={0x5, 0xd6, 0x34}]}, 0x58}}, 0x10000080) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000480), r2) sendmsg$NL80211_CMD_TDLS_CHANNEL_SWITCH(r2, &(0x7f0000000580)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000540)={&(0x7f00000004c0)={0x64, r4, 0x300, 0x70bd27, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x80, 0x53}}}}, [@NL80211_ATTR_OPER_CLASS={0x5, 0xd6, 0x1}, @NL80211_ATTR_OPER_CLASS={0x5}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_OPER_CLASS={0x5, 0xd6, 0x1}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x64}, 0x1, 0x0, 0x0, 0x2000000}, 0x40000) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_RELOAD_REGDB(r5, &(0x7f0000000680)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x400802}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x14, r1, 0x4, 0x70bd28, 0x25dfdbff, {}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x840) r6 = syz_open_dev$vcsa(&(0x7f00000006c0), 0xfffffffffffeffff, 0x20103) sendmsg$NL80211_CMD_DEL_STATION(r6, &(0x7f0000000800)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000740)={0x6c, r4, 0x8, 0x70bd2c, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_STA_WME={0x2c, 0x81, [@NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0x6}, @NL80211_STA_WME_MAX_SP={0x5}, @NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0x2}, @NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0x9}, @NL80211_STA_WME_MAX_SP={0x5, 0x2, 0x3}]}, @NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x723}, @NL80211_ATTR_AIRTIME_WEIGHT={0x6, 0x112, 0x1}, @NL80211_ATTR_STA_WME={0x14, 0x81, [@NL80211_STA_WME_MAX_SP={0x5, 0x2, 0x7e}, @NL80211_STA_WME_MAX_SP={0x5, 0x2, 0x3}]}, @NL80211_ATTR_LOCAL_MESH_POWER_MODE={0x8, 0xa4, 0x2}]}, 0x6c}, 0x1, 0x0, 0x0, 0x8040}, 0x8000) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NET_DM_CMD_STOP(r7, &(0x7f0000000900)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000880)={0x14, 0x0, 0x10, 0x70bd2c, 0x25dfdbfb, {}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) getpgrp(0xffffffffffffffff) sendmsg$NL80211_CMD_START_P2P_DEVICE(r5, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x28, r4, 0x100, 0x70bd26, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x0, 0xe}}}}, ["", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x810}, 0x400c014) prctl$PR_SCHED_CORE(0x3e, 0x1, 0xffffffffffffffff, 0x0, &(0x7f0000000a40)) sendmsg$NL80211_CMD_RELOAD_REGDB(r5, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14, r4, 0x1, 0x70bd28, 0x25dfdbfe, {}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4040881}, 0x0) 14:38:03 executing program 0: clock_getres(0x4, &(0x7f0000000000)) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$UI_SET_SWBIT(r0, 0x4004556d, 0x0) clock_gettime(0x4, &(0x7f0000000080)) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) setsockopt$bt_hci_HCI_DATA_DIR(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000000c0)=0x81, 0x4) clock_getres(0x6, &(0x7f0000000100)) write$uinput_user_dev(r0, &(0x7f0000000140)={'syz1\x00', {0x800, 0x19, 0x100, 0x6}, 0xf, [0x5, 0xfffff800, 0xe, 0x8, 0x9, 0x1, 0x40, 0xff, 0x0, 0x1, 0xa87, 0xfffffffb, 0x8, 0x9, 0x7, 0x1, 0x1, 0x80000000, 0xfffffffe, 0x4, 0x3b, 0x7ff, 0x1, 0x5, 0xffffffff, 0x0, 0x7, 0x4, 0x7d0, 0x3b, 0x1ff, 0xffff, 0x5f0b, 0x7, 0xfffff000, 0x1, 0xa5, 0x6, 0x6, 0x10001, 0x2, 0xffffffff, 0xfc91, 0x0, 0x6, 0xfffffff8, 0xdca7, 0x2, 0xc0d, 0x80000000, 0x6, 0xffffffff, 0x0, 0x401, 0x3, 0x7, 0x2, 0x0, 0xfffffffc, 0x7ff, 0x7, 0x6, 0xf0a5, 0x81], [0x1c, 0x4, 0x1, 0xa86e, 0x8001, 0x100, 0x3, 0x5, 0x1, 0x6, 0x3568, 0x0, 0x9, 0x6, 0x7fffffff, 0x6f, 0x103, 0x4, 0xffa, 0x4, 0x0, 0x81, 0x2, 0x81f, 0x75ad, 0x4, 0x1873, 0x72e, 0x1, 0xd1, 0x6, 0x0, 0x83, 0x9, 0xc5e, 0x10000, 0x0, 0x1, 0x6, 0x9de, 0x3ff, 0x7f, 0x7, 0x8000, 0xf4c, 0x0, 0x8, 0x3f, 0x1, 0x80000001, 0xffffffff, 0xfffffffb, 0x6, 0x4d1, 0x6, 0x4, 0x5, 0xff, 0x1, 0x9, 0x6, 0x3, 0xffffffff, 0x3], [0xcd, 0x3, 0xf, 0x80000000, 0x5, 0x7, 0x1, 0x7, 0x80000000, 0x0, 0x4, 0x4, 0x7, 0x1, 0x1, 0x0, 0x8, 0x1, 0x855, 0x5, 0x75ae, 0x4411, 0x8, 0xffff, 0x200, 0x7, 0xc4, 0x11fedc7, 0xffff, 0x101, 0xffffffff, 0x7fff, 0x0, 0xffffffff, 0xf30, 0x7, 0x6, 0x2, 0x3f, 0x40000000, 0x23, 0x0, 0x21, 0x1, 0x5, 0x6, 0x401, 0x53f, 0x1, 0x10000, 0x800, 0x2, 0x0, 0x800, 0x7, 0x0, 0x7, 0x1, 0x3, 0x50000000, 0x10000, 0xffffffff, 0x2, 0x3], [0x4, 0x0, 0xffff, 0xc82d, 0xe02, 0x80000000, 0x2, 0xff, 0x5, 0x4, 0x5a, 0x80000000, 0x1ff, 0x4, 0x2, 0x89, 0x5, 0x4, 0x81, 0x5, 0xfffffeff, 0x9, 0x0, 0xb8e, 0x79ed, 0x4, 0x4, 0x1ff, 0x0, 0xde, 0x80, 0x3, 0x4, 0x5, 0x10001, 0x3f, 0x8001, 0x2, 0xdf56, 0xffff, 0x4, 0x52, 0x6, 0x7ff, 0x80000001, 0x4, 0x5, 0x8, 0x1, 0x31f24a7, 0x5, 0x1ff, 0x4f, 0x3, 0x100, 0x80000001, 0xfff, 0xd9f, 0x6f, 0x7, 0x1, 0x1, 0x9, 0x227d]}, 0x45c) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT(0xffffffffffffffff, 0x28, 0x6, &(0x7f00000005c0)={0x77359400}, 0x10) capset(&(0x7f0000000600)={0xf1504}, &(0x7f0000000640)={0x0, 0x1, 0x20, 0x20, 0x3, 0xffffffff}) select(0x40, &(0x7f0000000680)={0x5, 0x9, 0xf84, 0xfffffffffffffffc, 0x1ff, 0xded, 0xb1, 0x2}, &(0x7f00000006c0)={0xe0000000000000, 0x4, 0x3, 0x7, 0x49b5, 0x7, 0xffffffff00000000, 0x6}, &(0x7f0000000700)={0xfffffffffffffffd, 0x100000001, 0x5, 0xcdb, 0x3ff, 0x81, 0x81, 0x7c0}, &(0x7f0000000740)={0x0, 0xea60}) openat$uinput(0xffffffffffffff9c, &(0x7f0000000780), 0x802, 0x0) write$P9_RXATTRWALK(0xffffffffffffffff, &(0x7f0000000dc0)={0xf, 0x1f, 0x2, 0x8}, 0xf) 14:38:03 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) ioctl$UI_SET_KEYBIT(r0, 0x40045565, 0x54) prctl$PR_SET_SECUREBITS(0x1c, 0x8) sendmsg$NL80211_CMD_SET_PMKSA(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x4000015) prctl$PR_SET_SECUREBITS(0x1c, 0x20) r1 = syz_open_dev$vcsa(&(0x7f0000000100), 0x920, 0x240) ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1d6) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000140), 0x802, 0x0) ioctl$UI_SET_EVBIT(r2, 0x40045564, 0x1d) ioctl$UI_BEGIN_FF_UPLOAD(r2, 0xc06855c8, &(0x7f00000001c0)={0x5, 0x9, {0x54, 0xfff8, 0x62, {0x100, 0x9d2}, {0x7ff, 0x101}, @period={0x59, 0x2, 0x3, 0x5, 0x8, {0x4, 0x3f7, 0x9, 0x3d9b}, 0x8, &(0x7f0000000180)=[0xfbe0, 0x31a7, 0x6, 0x3, 0xa9c, 0x1, 0x6145, 0x7]}}, {0x54, 0x20, 0x6, {0x8000, 0x401}, {0x3, 0x3ff}, @ramp={0x2, 0x3e5c, {0x1, 0x4, 0x3, 0x1000}}}}) r3 = syz_open_dev$vcsa(&(0x7f0000000240), 0x6, 0x111000) ioctl$UI_SET_PHYS(r3, 0x4008556c, &(0x7f0000000280)='syz1\x00') r4 = openat$uinput(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) clock_gettime(0x0, &(0x7f0000000300)={0x0, 0x0}) write$input_event(r4, &(0x7f0000000340)={{r5, r6/1000+10000}, 0x1, 0xfff7}, 0x18) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r1) ioctl$UI_END_FF_ERASE(r4, 0x400c55cb, &(0x7f00000003c0)={0x5, 0x4, 0x1}) 14:38:03 executing program 3: pselect6(0x40, &(0x7f0000000000)={0xe1, 0x1000, 0x5, 0x5, 0x400, 0xfffffffffffffffa, 0xffffffffffff0001, 0x8}, &(0x7f0000000040)={0x8, 0x100000001, 0x6ed0, 0x82, 0x401, 0x8, 0x3, 0x2}, &(0x7f0000000080)={0x1, 0x8000, 0x1, 0xffff, 0x6, 0x7fffffff, 0x4, 0xfffffffeffffffff}, &(0x7f00000000c0)={0x77359400}, &(0x7f0000000140)={&(0x7f0000000100)={[0x5]}, 0x8}) futex(&(0x7f0000000180)=0x1, 0x0, 0x2, &(0x7f00000001c0)={0x0, 0x989680}, &(0x7f0000000200)=0x1, 0x1) clock_getres(0x0, &(0x7f0000000240)) clock_gettime(0x0, &(0x7f0000000340)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000280)={0xffffffffffff8001, 0x8, 0x3, 0x8001, 0x1d, 0x5, 0x100000000, 0x6}, &(0x7f00000002c0)={0x10000, 0xf5, 0x9, 0x3, 0x3f, 0x10000, 0xafaa, 0xf0}, &(0x7f0000000300)={0x3f, 0x100000000, 0x9, 0xd7d9, 0xcffb, 0x854, 0x9, 0xffffffffffffffe0}, &(0x7f0000000380)={r0, r1+60000000}, &(0x7f0000000400)={&(0x7f00000003c0)={[0x80000000]}, 0x8}) clock_settime(0x4, &(0x7f0000000440)={0x77359400}) prctl$PR_SET_THP_DISABLE(0x29, 0x1) clock_getres(0x6, &(0x7f0000000480)) clock_gettime(0x3, &(0x7f00000004c0)) clock_settime(0x5, &(0x7f0000000500)={0x77359400}) pselect6(0x40, &(0x7f0000000540)={0x9, 0x9, 0x4, 0x3, 0xbc88, 0x3, 0x2, 0x2}, &(0x7f0000000580)={0x1f, 0x6, 0x26ba, 0x8, 0x1, 0x8000, 0x1, 0x8}, 0x0, &(0x7f00000005c0)={0x0, 0x3938700}, &(0x7f0000000640)={&(0x7f0000000600)={[0x10001]}, 0x8}) accept4$vsock_stream(0xffffffffffffffff, &(0x7f0000000680)={0x28, 0x0, 0x0, @local}, 0x10, 0x80800) pselect6(0x40, &(0x7f00000006c0)={0x1, 0x1, 0x89e, 0x4, 0xffffffffffffff16, 0x400, 0x1, 0x9}, &(0x7f0000000700)={0x9, 0x5, 0xc56, 0xf732, 0x1, 0x1, 0x20, 0x101}, &(0x7f0000000740)={0x1df0a00000, 0x9, 0x7, 0x8001, 0x2, 0x80000000, 0xfffffffffffff801}, &(0x7f0000000780)={0x0, 0x3938700}, &(0x7f0000000800)={&(0x7f00000007c0)={[0x6]}, 0x8}) sendmsg$IEEE802154_ASSOCIATE_RESP(0xffffffffffffffff, &(0x7f0000000900)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000880)={0x40, 0x0, 0x20, 0x70bd29, 0x25dfdbfc, {}, [@IEEE802154_ATTR_STATUS={0x5, 0x3, 0x6}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x5}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x1}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa0}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4008000}, 0x4000000) prctl$PR_SET_THP_DISABLE(0x29, 0x1) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, &(0x7f0000000b40)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000980)={0x150, 0x0, 0x8, 0x70bd27, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_TESTDATA={0x72, 0x45, "d97d387e742764bac778bb3cf8eddb74f6a0a2f307b791b5e8b34f0ade3bdf9e54c3eceaea6cb6df5b0c18b5592815a59ff23c80d0dac40899af314b43f1d59c398a3ddbb01337581bb654d085d00128fffcb5c19245582a2c27b84e7ec713533232ad3ab44266f3ab3c6b36eff1"}, @NL80211_ATTR_TESTDATA={0x3a, 0x45, "c42820db057701f4a5e00d1e4afa5f62b894abca71006d976fe37af6d520a2624f98dea90fb1c69ee242d278373e963d021b8326d139"}, @NL80211_ATTR_TESTDATA={0x8a, 0x45, "a8a46af0c5e6cab9624ddfafbdfbf1b1391ffee937b7efc28b8ebd4c2cdb69000fccee43bfeb334e39495770f937e53da7eee55ae11dd18453dc85d6a4ac88846238770ab62907521962e3bdd5d1c811b3d6d1ab00c3a4ca316c41716e8d60c7a27e8922eef2c5baa3214c5fce29d2ab15cfbf5edcb76d1221921d1bf0ccb0c4be515cbefe15"}]}, 0x150}, 0x1, 0x0, 0x0, 0x10}, 0x8) pselect6(0x40, &(0x7f0000000dc0)={0x1, 0x81, 0x0, 0x9c31, 0x502, 0xe101, 0x0, 0x4}, &(0x7f0000000e00)={0x2, 0x2e4b, 0xa6, 0x200, 0x2, 0x0, 0x8, 0x7ff}, &(0x7f0000000e40)={0x95, 0x3, 0xff, 0xffffffffffffb022, 0x96f7, 0x7fff, 0x9, 0x9}, &(0x7f0000000e80), &(0x7f0000000f00)={&(0x7f0000000ec0)={[0x2]}, 0x8}) 14:38:03 executing program 4: r0 = socket(0x0, 0x1, 0x2) sendmsg$NL80211_CMD_GET_KEY(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x7c, 0x0, 0xc30, 0x70bd28, 0x25dfdbfb, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac05}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "b98e1c15b9504b03c1de98fdff"}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "a448a9969794224f53b27f76e3"}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac01}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "0c2e0e097645692b3641dbc8ff"}]}, 0x7c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10000) io_uring_setup(0x3d2a, &(0x7f0000000140)={0x0, 0xee28, 0x2, 0x2, 0xf5}) r1 = syz_open_dev$vcsa(&(0x7f00000001c0), 0x8, 0x402082) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEL_STATION(r1, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x54, 0x0, 0x800, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_STA_TX_POWER_SETTING={0x5, 0x113, 0x1}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x9d}, @NL80211_ATTR_STA_FLAGS2={0xc, 0x43, {0x7}}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_AIRTIME_WEIGHT={0x6, 0x112, 0x6}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x7012}]}, 0x54}, 0x1, 0x0, 0x0, 0x20000000}, 0x4040004) sendmsg$NL80211_CMD_GET_MPP(r1, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x44, 0x0, 0x2, 0x70bd25, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}]}, 0x44}, 0x1, 0x0, 0x0, 0x804}, 0x81) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r1, 0x40082102, &(0x7f00000004c0)) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000580)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_MCAST_RATE(r1, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x40, r3, 0x300, 0x70bd2d, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0x8, 0x61}}}}, [@NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x21c}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0xf0}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x78}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000010}, 0x1010) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f00000007c0)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000780)={&(0x7f00000006c0)={0xac, r3, 0x10, 0x70bd2a, 0x25dfdbfe, {{}, {@void, @void, @val={0xc, 0x99, {0x8000, 0x1a}}}}, [@NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @mon_options=[@NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "694edb82987efca9726b73dbad87aee9c82f5881a01e260e"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "3a6891e4f568a688f298dd323c27c3d5337f12d8da63e512"}, @NL80211_ATTR_MNTR_FLAGS={0x14, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}]}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "b402286e97edaf79b6a5ca4ad38ae0d1859405033784ba8b"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "d11a0cbf38e9334c37895f93e68d51c754bb1b6faa3e765f"}]]}, 0xac}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000000900)={0x3, 0x9, 0x1, 0x4195, 0xdd, 0x8, &(0x7f0000000800)="63f58ea60fe7dd9b64b9d78660f645dfa5779ae6a8b497cfb0441078497694e79203c3a069573f0c7b12c0d93febab8b1ba2ca2d951e0b9d8182d058ee8f22353bfecf2e666011b3851e9f916949e18a292547d2cca0da41625139c16d7c060634113556136ff3f94e70dde9f920a1a5b79567f27850358e5a704e657e7505912a6b687db7380cc01c4bda0e7303a5dfa4bc8abdfadcefbcd2ae5c09943c382692f48f967d7ceb6306166902ecbcabb032e0bed88c6b2f700aa406ec1f8175d6d80d0a1bac05373ced80901199b41b51aad80839106297d33b37df84b5"}) r5 = syz_open_dev$vcsa(&(0x7f0000000940), 0x10001, 0x880) sendmsg$NL80211_CMD_SET_REG(r5, &(0x7f0000000a40)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000a00)={&(0x7f00000009c0)={0x24, r3, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8, 0x1, 0x26}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x50}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x20008000) syz_genetlink_get_family_id$nl80211(&(0x7f0000000a80), r0) syz_open_dev$usbfs(&(0x7f0000000ac0), 0x10000, 0x84000) 14:38:03 executing program 1: clock_getres(0x7, &(0x7f0000000000)) pselect6(0x40, &(0x7f0000000040)={0x5, 0x7fffffff, 0x5, 0xb1, 0x10000, 0x7, 0x7, 0xe4ee}, &(0x7f0000000080)={0x1, 0x5, 0x283, 0x7e, 0x57dc, 0xffff, 0x363b2f21, 0x9}, &(0x7f00000000c0)={0x6, 0x8, 0x101, 0x1, 0x1f, 0xe68, 0x5, 0x9}, &(0x7f0000000100)={0x0, 0x989680}, &(0x7f0000000180)={&(0x7f0000000140)={[0x800]}, 0x8}) clock_gettime(0x0, &(0x7f0000000200)={0x0, 0x0}) futex(&(0x7f00000001c0), 0x4, 0x1, &(0x7f0000000240)={r0, r1+10000000}, &(0x7f0000000280)=0x2, 0x2) prctl$PR_GET_PDEATHSIG(0x2, &(0x7f00000002c0)) pselect6(0x40, &(0x7f0000000300)={0x7, 0x3, 0x2, 0x800, 0x4f7, 0x3, 0x3, 0x10001}, &(0x7f0000000340)={0x5, 0x2, 0x7ff, 0x40, 0xff, 0x2, 0x5, 0x4}, &(0x7f0000000380)={0x7, 0x0, 0x101, 0x662, 0x0, 0x5, 0x2, 0x7b4}, &(0x7f00000003c0)={0x0, 0x989680}, &(0x7f0000000440)={&(0x7f0000000400), 0x8}) ioctl$UI_SET_PROPBIT(0xffffffffffffffff, 0x4004556e, 0x15) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, &(0x7f0000000480)='syz1\x00') ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x6) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f00000004c0), 0x802, 0x0) ioctl$UI_SET_RELBIT(r2, 0x40045566, 0x7) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000500), 0x802, 0x0) ioctl$UI_SET_KEYBIT(r3, 0x40045565, 0x6c) ioctl$UI_SET_RELBIT(r2, 0x40045566, 0xa) sendmsg$NL80211_CMD_START_P2P_DEVICE(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x1c, 0x0, 0x20, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x8}, @void}}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4049000}, 0x20000000) syz_open_dev$vcsa(&(0x7f0000000640), 0x3, 0x400000) clock_gettime(0x6, &(0x7f0000000680)) 14:38:03 executing program 1: clock_getres(0x7, &(0x7f0000000000)) pselect6(0x40, &(0x7f0000000040)={0x5, 0x7fffffff, 0x5, 0xb1, 0x10000, 0x7, 0x7, 0xe4ee}, &(0x7f0000000080)={0x1, 0x5, 0x283, 0x7e, 0x57dc, 0xffff, 0x363b2f21, 0x9}, &(0x7f00000000c0)={0x6, 0x8, 0x101, 0x1, 0x1f, 0xe68, 0x5, 0x9}, &(0x7f0000000100)={0x0, 0x989680}, &(0x7f0000000180)={&(0x7f0000000140)={[0x800]}, 0x8}) clock_gettime(0x0, &(0x7f0000000200)={0x0, 0x0}) futex(&(0x7f00000001c0), 0x4, 0x1, &(0x7f0000000240)={r0, r1+10000000}, &(0x7f0000000280)=0x2, 0x2) prctl$PR_GET_PDEATHSIG(0x2, &(0x7f00000002c0)) pselect6(0x40, &(0x7f0000000300)={0x7, 0x3, 0x2, 0x800, 0x4f7, 0x3, 0x3, 0x10001}, &(0x7f0000000340)={0x5, 0x2, 0x7ff, 0x40, 0xff, 0x2, 0x5, 0x4}, &(0x7f0000000380)={0x7, 0x0, 0x101, 0x662, 0x0, 0x5, 0x2, 0x7b4}, &(0x7f00000003c0)={0x0, 0x989680}, &(0x7f0000000440)={&(0x7f0000000400), 0x8}) ioctl$UI_SET_PROPBIT(0xffffffffffffffff, 0x4004556e, 0x15) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, &(0x7f0000000480)='syz1\x00') ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x6) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f00000004c0), 0x802, 0x0) ioctl$UI_SET_RELBIT(r2, 0x40045566, 0x7) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000500), 0x802, 0x0) ioctl$UI_SET_KEYBIT(r3, 0x40045565, 0x6c) ioctl$UI_SET_RELBIT(r2, 0x40045566, 0xa) sendmsg$NL80211_CMD_START_P2P_DEVICE(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x1c, 0x0, 0x20, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x8}, @void}}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4049000}, 0x20000000) clock_gettime(0x6, &(0x7f0000000680)) 14:38:03 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) ioctl$UI_SET_KEYBIT(r0, 0x40045565, 0x54) prctl$PR_SET_SECUREBITS(0x1c, 0x8) sendmsg$NL80211_CMD_SET_PMKSA(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x4000015) prctl$PR_SET_SECUREBITS(0x1c, 0x20) r1 = syz_open_dev$vcsa(&(0x7f0000000100), 0x920, 0x240) ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1d6) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000140), 0x802, 0x0) ioctl$UI_SET_EVBIT(r2, 0x40045564, 0x1d) ioctl$UI_BEGIN_FF_UPLOAD(r2, 0xc06855c8, &(0x7f00000001c0)={0x5, 0x9, {0x54, 0xfff8, 0x62, {0x100, 0x9d2}, {0x7ff, 0x101}, @period={0x59, 0x2, 0x3, 0x5, 0x8, {0x4, 0x3f7, 0x9, 0x3d9b}, 0x8, &(0x7f0000000180)=[0xfbe0, 0x31a7, 0x6, 0x3, 0xa9c, 0x1, 0x6145, 0x7]}}, {0x54, 0x20, 0x6, {0x8000, 0x401}, {0x3, 0x3ff}, @ramp={0x2, 0x3e5c, {0x1, 0x4, 0x3, 0x1000}}}}) r3 = syz_open_dev$vcsa(&(0x7f0000000240), 0x6, 0x111000) ioctl$UI_SET_PHYS(r3, 0x4008556c, &(0x7f0000000280)='syz1\x00') r4 = openat$uinput(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) clock_gettime(0x0, &(0x7f0000000300)={0x0, 0x0}) write$input_event(r4, &(0x7f0000000340)={{r5, r6/1000+10000}, 0x1, 0xfff7}, 0x18) ioctl$UI_END_FF_ERASE(r4, 0x400c55cb, &(0x7f00000003c0)={0x5, 0x4, 0x1}) 14:38:03 executing program 3: pselect6(0x40, &(0x7f0000000000)={0xe1, 0x1000, 0x5, 0x5, 0x400, 0xfffffffffffffffa, 0xffffffffffff0001, 0x8}, &(0x7f0000000040)={0x8, 0x100000001, 0x6ed0, 0x82, 0x401, 0x8, 0x3, 0x2}, &(0x7f0000000080)={0x1, 0x8000, 0x1, 0xffff, 0x6, 0x7fffffff, 0x4, 0xfffffffeffffffff}, &(0x7f00000000c0)={0x77359400}, &(0x7f0000000140)={&(0x7f0000000100)={[0x5]}, 0x8}) futex(&(0x7f0000000180)=0x1, 0x0, 0x2, &(0x7f00000001c0)={0x0, 0x989680}, &(0x7f0000000200)=0x1, 0x1) clock_getres(0x0, &(0x7f0000000240)) clock_gettime(0x0, &(0x7f0000000340)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000280)={0xffffffffffff8001, 0x8, 0x3, 0x8001, 0x1d, 0x5, 0x100000000, 0x6}, &(0x7f00000002c0)={0x10000, 0xf5, 0x9, 0x3, 0x3f, 0x10000, 0xafaa, 0xf0}, &(0x7f0000000300)={0x3f, 0x100000000, 0x9, 0xd7d9, 0xcffb, 0x854, 0x9, 0xffffffffffffffe0}, &(0x7f0000000380)={r0, r1+60000000}, &(0x7f0000000400)={&(0x7f00000003c0)={[0x80000000]}, 0x8}) clock_settime(0x4, &(0x7f0000000440)={0x77359400}) prctl$PR_SET_THP_DISABLE(0x29, 0x1) clock_getres(0x6, &(0x7f0000000480)) clock_gettime(0x3, &(0x7f00000004c0)) clock_settime(0x5, &(0x7f0000000500)={0x77359400}) pselect6(0x40, &(0x7f0000000540)={0x9, 0x9, 0x4, 0x3, 0xbc88, 0x3, 0x2, 0x2}, &(0x7f0000000580)={0x1f, 0x6, 0x26ba, 0x8, 0x1, 0x8000, 0x1, 0x8}, 0x0, &(0x7f00000005c0)={0x0, 0x3938700}, &(0x7f0000000640)={&(0x7f0000000600)={[0x10001]}, 0x8}) accept4$vsock_stream(0xffffffffffffffff, &(0x7f0000000680)={0x28, 0x0, 0x0, @local}, 0x10, 0x80800) pselect6(0x40, &(0x7f00000006c0)={0x1, 0x1, 0x89e, 0x4, 0xffffffffffffff16, 0x400, 0x1, 0x9}, &(0x7f0000000700)={0x9, 0x5, 0xc56, 0xf732, 0x1, 0x1, 0x20, 0x101}, &(0x7f0000000740)={0x1df0a00000, 0x9, 0x7, 0x8001, 0x2, 0x80000000, 0xfffffffffffff801}, &(0x7f0000000780)={0x0, 0x3938700}, &(0x7f0000000800)={&(0x7f00000007c0)={[0x6]}, 0x8}) sendmsg$IEEE802154_ASSOCIATE_RESP(0xffffffffffffffff, &(0x7f0000000900)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000880)={0x40, 0x0, 0x20, 0x70bd29, 0x25dfdbfc, {}, [@IEEE802154_ATTR_STATUS={0x5, 0x3, 0x6}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x5}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x1}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa0}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4008000}, 0x4000000) prctl$PR_SET_THP_DISABLE(0x29, 0x1) pselect6(0x40, &(0x7f0000000dc0)={0x1, 0x81, 0x0, 0x9c31, 0x502, 0xe101, 0x0, 0x4}, &(0x7f0000000e00)={0x2, 0x2e4b, 0xa6, 0x200, 0x2, 0x0, 0x8, 0x7ff}, &(0x7f0000000e40)={0x95, 0x3, 0xff, 0xffffffffffffb022, 0x96f7, 0x7fff, 0x9, 0x9}, &(0x7f0000000e80), &(0x7f0000000f00)={&(0x7f0000000ec0)={[0x2]}, 0x8}) 14:38:03 executing program 1: clock_getres(0x7, &(0x7f0000000000)) pselect6(0x40, &(0x7f0000000040)={0x5, 0x7fffffff, 0x5, 0xb1, 0x10000, 0x7, 0x7, 0xe4ee}, &(0x7f0000000080)={0x1, 0x5, 0x283, 0x7e, 0x57dc, 0xffff, 0x363b2f21, 0x9}, &(0x7f00000000c0)={0x6, 0x8, 0x101, 0x1, 0x1f, 0xe68, 0x5, 0x9}, &(0x7f0000000100)={0x0, 0x989680}, &(0x7f0000000180)={&(0x7f0000000140)={[0x800]}, 0x8}) clock_gettime(0x0, &(0x7f0000000200)={0x0, 0x0}) futex(&(0x7f00000001c0), 0x4, 0x1, &(0x7f0000000240)={r0, r1+10000000}, &(0x7f0000000280)=0x2, 0x2) prctl$PR_GET_PDEATHSIG(0x2, &(0x7f00000002c0)) pselect6(0x40, &(0x7f0000000300)={0x7, 0x3, 0x2, 0x800, 0x4f7, 0x3, 0x3, 0x10001}, &(0x7f0000000340)={0x5, 0x2, 0x7ff, 0x40, 0xff, 0x2, 0x5, 0x4}, &(0x7f0000000380)={0x7, 0x0, 0x101, 0x662, 0x0, 0x5, 0x2, 0x7b4}, &(0x7f00000003c0)={0x0, 0x989680}, &(0x7f0000000440)={&(0x7f0000000400), 0x8}) ioctl$UI_SET_PROPBIT(0xffffffffffffffff, 0x4004556e, 0x15) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, &(0x7f0000000480)='syz1\x00') ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x6) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f00000004c0), 0x802, 0x0) ioctl$UI_SET_RELBIT(r2, 0x40045566, 0x7) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000500), 0x802, 0x0) ioctl$UI_SET_KEYBIT(r3, 0x40045565, 0x6c) ioctl$UI_SET_RELBIT(r2, 0x40045566, 0xa) clock_gettime(0x6, &(0x7f0000000680)) 14:38:03 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) ioctl$UI_SET_KEYBIT(r0, 0x40045565, 0x54) prctl$PR_SET_SECUREBITS(0x1c, 0x8) sendmsg$NL80211_CMD_SET_PMKSA(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x4000015) prctl$PR_SET_SECUREBITS(0x1c, 0x20) r1 = syz_open_dev$vcsa(&(0x7f0000000100), 0x920, 0x240) ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1d6) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000140), 0x802, 0x0) ioctl$UI_SET_EVBIT(r2, 0x40045564, 0x1d) ioctl$UI_BEGIN_FF_UPLOAD(r2, 0xc06855c8, &(0x7f00000001c0)={0x5, 0x9, {0x54, 0xfff8, 0x62, {0x100, 0x9d2}, {0x7ff, 0x101}, @period={0x59, 0x2, 0x3, 0x5, 0x8, {0x4, 0x3f7, 0x9, 0x3d9b}, 0x8, &(0x7f0000000180)=[0xfbe0, 0x31a7, 0x6, 0x3, 0xa9c, 0x1, 0x6145, 0x7]}}, {0x54, 0x20, 0x6, {0x8000, 0x401}, {0x3, 0x3ff}, @ramp={0x2, 0x3e5c, {0x1, 0x4, 0x3, 0x1000}}}}) r3 = syz_open_dev$vcsa(&(0x7f0000000240), 0x6, 0x111000) ioctl$UI_SET_PHYS(r3, 0x4008556c, &(0x7f0000000280)='syz1\x00') r4 = openat$uinput(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) clock_gettime(0x0, &(0x7f0000000300)) ioctl$UI_END_FF_ERASE(r4, 0x400c55cb, &(0x7f00000003c0)={0x5, 0x4, 0x1}) 14:38:03 executing program 4: r0 = socket(0x0, 0x1, 0x2) sendmsg$NL80211_CMD_GET_KEY(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x7c, 0x0, 0xc30, 0x70bd28, 0x25dfdbfb, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac05}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "b98e1c15b9504b03c1de98fdff"}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "a448a9969794224f53b27f76e3"}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac01}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "0c2e0e097645692b3641dbc8ff"}]}, 0x7c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10000) io_uring_setup(0x3d2a, &(0x7f0000000140)={0x0, 0xee28, 0x2, 0x2, 0xf5}) r1 = syz_open_dev$vcsa(&(0x7f00000001c0), 0x8, 0x402082) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEL_STATION(r1, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x54, 0x0, 0x800, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_STA_TX_POWER_SETTING={0x5, 0x113, 0x1}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x9d}, @NL80211_ATTR_STA_FLAGS2={0xc, 0x43, {0x7}}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_AIRTIME_WEIGHT={0x6, 0x112, 0x6}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x7012}]}, 0x54}, 0x1, 0x0, 0x0, 0x20000000}, 0x4040004) sendmsg$NL80211_CMD_GET_MPP(r1, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x44, 0x0, 0x2, 0x70bd25, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}]}, 0x44}, 0x1, 0x0, 0x0, 0x804}, 0x81) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r1, 0x40082102, &(0x7f00000004c0)) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000580)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_MCAST_RATE(r1, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x40, r3, 0x300, 0x70bd2d, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0x8, 0x61}}}}, [@NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x21c}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0xf0}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x78}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000010}, 0x1010) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f00000007c0)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000780)={&(0x7f00000006c0)={0xac, r3, 0x10, 0x70bd2a, 0x25dfdbfe, {{}, {@void, @void, @val={0xc, 0x99, {0x8000, 0x1a}}}}, [@NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @mon_options=[@NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "694edb82987efca9726b73dbad87aee9c82f5881a01e260e"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "3a6891e4f568a688f298dd323c27c3d5337f12d8da63e512"}, @NL80211_ATTR_MNTR_FLAGS={0x14, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}]}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "b402286e97edaf79b6a5ca4ad38ae0d1859405033784ba8b"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "d11a0cbf38e9334c37895f93e68d51c754bb1b6faa3e765f"}]]}, 0xac}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000000900)={0x3, 0x9, 0x1, 0x4195, 0xdd, 0x8, &(0x7f0000000800)="63f58ea60fe7dd9b64b9d78660f645dfa5779ae6a8b497cfb0441078497694e79203c3a069573f0c7b12c0d93febab8b1ba2ca2d951e0b9d8182d058ee8f22353bfecf2e666011b3851e9f916949e18a292547d2cca0da41625139c16d7c060634113556136ff3f94e70dde9f920a1a5b79567f27850358e5a704e657e7505912a6b687db7380cc01c4bda0e7303a5dfa4bc8abdfadcefbcd2ae5c09943c382692f48f967d7ceb6306166902ecbcabb032e0bed88c6b2f700aa406ec1f8175d6d80d0a1bac05373ced80901199b41b51aad80839106297d33b37df84b5"}) r5 = syz_open_dev$vcsa(&(0x7f0000000940), 0x10001, 0x880) sendmsg$NL80211_CMD_SET_REG(r5, &(0x7f0000000a40)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x240000}, 0xc, &(0x7f0000000a00)={&(0x7f00000009c0)={0x24, r3, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8, 0x1, 0x26}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x50}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x20008000) syz_open_dev$usbfs(&(0x7f0000000ac0), 0x10000, 0x84000) [ 27.388943][ T442] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2 [ 27.407037][ T442] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db 14:38:04 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$fou(&(0x7f0000000000), r0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, 0xffffffffffffffff) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) sendmsg$NL80211_CMD_DISASSOCIATE(r0, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)={0x164, r1, 0x400, 0x70bd2c, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_IE={0x14d, 0x2a, [@link_id={0x65, 0x12, {@from_mac, @device_a, @broadcast}}, @ssid={0x0, 0x6, @default_ibss_ssid}, @supported_rates={0x1, 0x6, [{0x29}, {0x30, 0x1}, {0x5}, {0x1}, {0x4}, {0x4, 0x1}]}, @tim={0x5, 0xc0, {0x7, 0x68, 0x80, "61657e60f0801a300509aab918ab1971761a963dd21eb9e9c9024899cca7173fff84acb5125eef28533baeb1d9fda0d6669cc46ce466affeb608cbf1fe42d44a07d717b07203f58dc1c6f7355c1fc80ce920418fdcaadfb61589d8fc9f9bffa45113d826d1b5f403b18c2b55a83a0ab727c4d8f3ba995882944dfd7e7b71a7d6b910b06173fca2d1c86a9adec4a962145f1bb9a95e974795a6ac80352c76d60f8de261d13a3cc1414b28ce86f725c97c5c24154048d4dab242e3e8fa86"}}, @link_id={0x65, 0x12, {@random="ae81ff7d5170", @broadcast}}, @ibss={0x6, 0x2, 0xc81c}, @random={0x1, 0x3c, "7045311358996128f2395883547f6b80b2fd27a9f69591031ecd896f20eeb76ad877ab6038afa87a277368ce754cf5ed8866f880e8a8be8ff4db00ef"}, @gcr_ga={0xbd, 0x6, @device_b}, @channel_switch={0x25, 0x3, {0x1, 0x8c, 0xa2}}]}]}, 0x164}, 0x1, 0x0, 0x0, 0xc814}, 0xc040) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TDLS_CHANNEL_SWITCH(r0, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x58, r1, 0x2, 0x70bd27, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x400, 0x3b}}}}, [@NL80211_ATTR_OPER_CLASS={0x5, 0xd6, 0x3}, @chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0xb}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x3c7}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x1}], @NL80211_ATTR_OPER_CLASS={0x5, 0xd6, 0x34}]}, 0x58}}, 0x10000080) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000480), r2) sendmsg$NL80211_CMD_TDLS_CHANNEL_SWITCH(r2, &(0x7f0000000580)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000540)={&(0x7f00000004c0)={0x64, r4, 0x300, 0x70bd27, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x80, 0x53}}}}, [@NL80211_ATTR_OPER_CLASS={0x5, 0xd6, 0x1}, @NL80211_ATTR_OPER_CLASS={0x5}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_OPER_CLASS={0x5, 0xd6, 0x1}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x64}, 0x1, 0x0, 0x0, 0x2000000}, 0x40000) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_RELOAD_REGDB(r5, &(0x7f0000000680)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x400802}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x14, r1, 0x4, 0x70bd28, 0x25dfdbff, {}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x840) r6 = syz_open_dev$vcsa(&(0x7f00000006c0), 0xfffffffffffeffff, 0x20103) sendmsg$NL80211_CMD_DEL_STATION(r6, &(0x7f0000000800)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000740)={0x6c, r4, 0x8, 0x70bd2c, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_STA_WME={0x2c, 0x81, [@NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0x6}, @NL80211_STA_WME_MAX_SP={0x5}, @NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0x2}, @NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0x9}, @NL80211_STA_WME_MAX_SP={0x5, 0x2, 0x3}]}, @NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x723}, @NL80211_ATTR_AIRTIME_WEIGHT={0x6, 0x112, 0x1}, @NL80211_ATTR_STA_WME={0x14, 0x81, [@NL80211_STA_WME_MAX_SP={0x5, 0x2, 0x7e}, @NL80211_STA_WME_MAX_SP={0x5, 0x2, 0x3}]}, @NL80211_ATTR_LOCAL_MESH_POWER_MODE={0x8, 0xa4, 0x2}]}, 0x6c}, 0x1, 0x0, 0x0, 0x8040}, 0x8000) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NET_DM_CMD_STOP(r7, &(0x7f0000000900)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000880)={0x14, 0x0, 0x10, 0x70bd2c, 0x25dfdbfb, {}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) getpgrp(0xffffffffffffffff) sendmsg$NL80211_CMD_START_P2P_DEVICE(r5, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x28, r4, 0x100, 0x70bd26, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x0, 0xe}}}}, ["", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x810}, 0x400c014) sendmsg$NL80211_CMD_RELOAD_REGDB(r5, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14, r4, 0x1, 0x70bd28, 0x25dfdbfe, {}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4040881}, 0x0) 14:38:04 executing program 0: clock_getres(0x4, &(0x7f0000000000)) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$UI_SET_SWBIT(r0, 0x4004556d, 0x0) clock_gettime(0x4, &(0x7f0000000080)) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) setsockopt$bt_hci_HCI_DATA_DIR(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000000c0)=0x81, 0x4) clock_getres(0x6, &(0x7f0000000100)) write$uinput_user_dev(r0, &(0x7f0000000140)={'syz1\x00', {0x800, 0x19, 0x100, 0x6}, 0xf, [0x5, 0xfffff800, 0xe, 0x8, 0x9, 0x1, 0x40, 0xff, 0x0, 0x1, 0xa87, 0xfffffffb, 0x8, 0x9, 0x7, 0x1, 0x1, 0x80000000, 0xfffffffe, 0x4, 0x3b, 0x7ff, 0x1, 0x5, 0xffffffff, 0x0, 0x7, 0x4, 0x7d0, 0x3b, 0x1ff, 0xffff, 0x5f0b, 0x7, 0xfffff000, 0x1, 0xa5, 0x6, 0x6, 0x10001, 0x2, 0xffffffff, 0xfc91, 0x0, 0x6, 0xfffffff8, 0xdca7, 0x2, 0xc0d, 0x80000000, 0x6, 0xffffffff, 0x0, 0x401, 0x3, 0x7, 0x2, 0x0, 0xfffffffc, 0x7ff, 0x7, 0x6, 0xf0a5, 0x81], [0x1c, 0x4, 0x1, 0xa86e, 0x8001, 0x100, 0x3, 0x5, 0x1, 0x6, 0x3568, 0x0, 0x9, 0x6, 0x7fffffff, 0x6f, 0x103, 0x4, 0xffa, 0x4, 0x0, 0x81, 0x2, 0x81f, 0x75ad, 0x4, 0x1873, 0x72e, 0x1, 0xd1, 0x6, 0x0, 0x83, 0x9, 0xc5e, 0x10000, 0x0, 0x1, 0x6, 0x9de, 0x3ff, 0x7f, 0x7, 0x8000, 0xf4c, 0x0, 0x8, 0x3f, 0x1, 0x80000001, 0xffffffff, 0xfffffffb, 0x6, 0x4d1, 0x6, 0x4, 0x5, 0xff, 0x1, 0x9, 0x6, 0x3, 0xffffffff, 0x3], [0xcd, 0x3, 0xf, 0x80000000, 0x5, 0x7, 0x1, 0x7, 0x80000000, 0x0, 0x4, 0x4, 0x7, 0x1, 0x1, 0x0, 0x8, 0x1, 0x855, 0x5, 0x75ae, 0x4411, 0x8, 0xffff, 0x200, 0x7, 0xc4, 0x11fedc7, 0xffff, 0x101, 0xffffffff, 0x7fff, 0x0, 0xffffffff, 0xf30, 0x7, 0x6, 0x2, 0x3f, 0x40000000, 0x23, 0x0, 0x21, 0x1, 0x5, 0x6, 0x401, 0x53f, 0x1, 0x10000, 0x800, 0x2, 0x0, 0x800, 0x7, 0x0, 0x7, 0x1, 0x3, 0x50000000, 0x10000, 0xffffffff, 0x2, 0x3], [0x4, 0x0, 0xffff, 0xc82d, 0xe02, 0x80000000, 0x2, 0xff, 0x5, 0x4, 0x5a, 0x80000000, 0x1ff, 0x4, 0x2, 0x89, 0x5, 0x4, 0x81, 0x5, 0xfffffeff, 0x9, 0x0, 0xb8e, 0x79ed, 0x4, 0x4, 0x1ff, 0x0, 0xde, 0x80, 0x3, 0x4, 0x5, 0x10001, 0x3f, 0x8001, 0x2, 0xdf56, 0xffff, 0x4, 0x52, 0x6, 0x7ff, 0x80000001, 0x4, 0x5, 0x8, 0x1, 0x31f24a7, 0x5, 0x1ff, 0x4f, 0x3, 0x100, 0x80000001, 0xfff, 0xd9f, 0x6f, 0x7, 0x1, 0x1, 0x9, 0x227d]}, 0x45c) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT(0xffffffffffffffff, 0x28, 0x6, &(0x7f00000005c0)={0x77359400}, 0x10) capset(&(0x7f0000000600)={0xf1504}, &(0x7f0000000640)={0x0, 0x1, 0x20, 0x20, 0x3, 0xffffffff}) select(0x40, &(0x7f0000000680)={0x5, 0x9, 0xf84, 0xfffffffffffffffc, 0x1ff, 0xded, 0xb1, 0x2}, &(0x7f00000006c0)={0xe0000000000000, 0x4, 0x3, 0x7, 0x49b5, 0x7, 0xffffffff00000000, 0x6}, &(0x7f0000000700)={0xfffffffffffffffd, 0x100000001, 0x5, 0xcdb, 0x3ff, 0x81, 0x81, 0x7c0}, &(0x7f0000000740)={0x0, 0xea60}) write$P9_RXATTRWALK(0xffffffffffffffff, &(0x7f0000000dc0)={0xf, 0x1f, 0x2, 0x8}, 0xf) 14:38:04 executing program 3: pselect6(0x40, &(0x7f0000000000)={0xe1, 0x1000, 0x5, 0x5, 0x400, 0xfffffffffffffffa, 0xffffffffffff0001, 0x8}, &(0x7f0000000040)={0x8, 0x100000001, 0x6ed0, 0x82, 0x401, 0x8, 0x3, 0x2}, &(0x7f0000000080)={0x1, 0x8000, 0x1, 0xffff, 0x6, 0x7fffffff, 0x4, 0xfffffffeffffffff}, &(0x7f00000000c0)={0x77359400}, &(0x7f0000000140)={&(0x7f0000000100)={[0x5]}, 0x8}) futex(&(0x7f0000000180)=0x1, 0x0, 0x2, &(0x7f00000001c0)={0x0, 0x989680}, &(0x7f0000000200)=0x1, 0x1) clock_getres(0x0, &(0x7f0000000240)) clock_gettime(0x0, &(0x7f0000000340)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000280)={0xffffffffffff8001, 0x8, 0x3, 0x8001, 0x1d, 0x5, 0x100000000, 0x6}, &(0x7f00000002c0)={0x10000, 0xf5, 0x9, 0x3, 0x3f, 0x10000, 0xafaa, 0xf0}, &(0x7f0000000300)={0x3f, 0x100000000, 0x9, 0xd7d9, 0xcffb, 0x854, 0x9, 0xffffffffffffffe0}, &(0x7f0000000380)={r0, r1+60000000}, &(0x7f0000000400)={&(0x7f00000003c0)={[0x80000000]}, 0x8}) clock_settime(0x4, &(0x7f0000000440)={0x77359400}) prctl$PR_SET_THP_DISABLE(0x29, 0x1) clock_getres(0x6, &(0x7f0000000480)) clock_gettime(0x3, &(0x7f00000004c0)) clock_settime(0x5, &(0x7f0000000500)={0x77359400}) pselect6(0x40, &(0x7f0000000540)={0x9, 0x9, 0x4, 0x3, 0xbc88, 0x3, 0x2, 0x2}, &(0x7f0000000580)={0x1f, 0x6, 0x26ba, 0x8, 0x1, 0x8000, 0x1, 0x8}, 0x0, &(0x7f00000005c0)={0x0, 0x3938700}, &(0x7f0000000640)={&(0x7f0000000600)={[0x10001]}, 0x8}) accept4$vsock_stream(0xffffffffffffffff, &(0x7f0000000680)={0x28, 0x0, 0x0, @local}, 0x10, 0x80800) pselect6(0x40, &(0x7f00000006c0)={0x1, 0x1, 0x89e, 0x4, 0xffffffffffffff16, 0x400, 0x1, 0x9}, &(0x7f0000000700)={0x9, 0x5, 0xc56, 0xf732, 0x1, 0x1, 0x20, 0x101}, &(0x7f0000000740)={0x1df0a00000, 0x9, 0x7, 0x8001, 0x2, 0x80000000, 0xfffffffffffff801}, &(0x7f0000000780)={0x0, 0x3938700}, &(0x7f0000000800)={&(0x7f00000007c0)={[0x6]}, 0x8}) sendmsg$IEEE802154_ASSOCIATE_RESP(0xffffffffffffffff, &(0x7f0000000900)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000880)={0x40, 0x0, 0x20, 0x70bd29, 0x25dfdbfc, {}, [@IEEE802154_ATTR_STATUS={0x5, 0x3, 0x6}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x5}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x1}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa0}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4008000}, 0x4000000) pselect6(0x40, &(0x7f0000000dc0)={0x1, 0x81, 0x0, 0x9c31, 0x502, 0xe101, 0x0, 0x4}, &(0x7f0000000e00)={0x2, 0x2e4b, 0xa6, 0x200, 0x2, 0x0, 0x8, 0x7ff}, &(0x7f0000000e40)={0x95, 0x3, 0xff, 0xffffffffffffb022, 0x96f7, 0x7fff, 0x9, 0x9}, &(0x7f0000000e80), &(0x7f0000000f00)={&(0x7f0000000ec0)={[0x2]}, 0x8}) 14:38:04 executing program 4: r0 = socket(0x0, 0x1, 0x2) sendmsg$NL80211_CMD_GET_KEY(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x7c, 0x0, 0xc30, 0x70bd28, 0x25dfdbfb, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac05}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "b98e1c15b9504b03c1de98fdff"}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "a448a9969794224f53b27f76e3"}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac01}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "0c2e0e097645692b3641dbc8ff"}]}, 0x7c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10000) io_uring_setup(0x3d2a, &(0x7f0000000140)={0x0, 0xee28, 0x2, 0x2, 0xf5}) r1 = syz_open_dev$vcsa(&(0x7f00000001c0), 0x8, 0x402082) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEL_STATION(r1, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x54, 0x0, 0x800, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_STA_TX_POWER_SETTING={0x5, 0x113, 0x1}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x9d}, @NL80211_ATTR_STA_FLAGS2={0xc, 0x43, {0x7}}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_AIRTIME_WEIGHT={0x6, 0x112, 0x6}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x7012}]}, 0x54}, 0x1, 0x0, 0x0, 0x20000000}, 0x4040004) sendmsg$NL80211_CMD_GET_MPP(r1, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x44, 0x0, 0x2, 0x70bd25, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}]}, 0x44}, 0x1, 0x0, 0x0, 0x804}, 0x81) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r1, 0x40082102, &(0x7f00000004c0)) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000580)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_MCAST_RATE(r1, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x40, r3, 0x300, 0x70bd2d, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0x8, 0x61}}}}, [@NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x21c}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0xf0}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x78}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000010}, 0x1010) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f00000007c0)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000780)={&(0x7f00000006c0)={0xac, r3, 0x10, 0x70bd2a, 0x25dfdbfe, {{}, {@void, @void, @val={0xc, 0x99, {0x8000, 0x1a}}}}, [@NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @mon_options=[@NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "694edb82987efca9726b73dbad87aee9c82f5881a01e260e"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "3a6891e4f568a688f298dd323c27c3d5337f12d8da63e512"}, @NL80211_ATTR_MNTR_FLAGS={0x14, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}]}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "b402286e97edaf79b6a5ca4ad38ae0d1859405033784ba8b"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "d11a0cbf38e9334c37895f93e68d51c754bb1b6faa3e765f"}]]}, 0xac}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000000900)={0x3, 0x9, 0x1, 0x4195, 0xdd, 0x8, &(0x7f0000000800)="63f58ea60fe7dd9b64b9d78660f645dfa5779ae6a8b497cfb0441078497694e79203c3a069573f0c7b12c0d93febab8b1ba2ca2d951e0b9d8182d058ee8f22353bfecf2e666011b3851e9f916949e18a292547d2cca0da41625139c16d7c060634113556136ff3f94e70dde9f920a1a5b79567f27850358e5a704e657e7505912a6b687db7380cc01c4bda0e7303a5dfa4bc8abdfadcefbcd2ae5c09943c382692f48f967d7ceb6306166902ecbcabb032e0bed88c6b2f700aa406ec1f8175d6d80d0a1bac05373ced80901199b41b51aad80839106297d33b37df84b5"}) syz_open_dev$vcsa(&(0x7f0000000940), 0x10001, 0x880) syz_open_dev$usbfs(&(0x7f0000000ac0), 0x10000, 0x84000) 14:38:04 executing program 1: clock_getres(0x7, &(0x7f0000000000)) pselect6(0x40, &(0x7f0000000040)={0x5, 0x7fffffff, 0x5, 0xb1, 0x10000, 0x7, 0x7, 0xe4ee}, &(0x7f0000000080)={0x1, 0x5, 0x283, 0x7e, 0x57dc, 0xffff, 0x363b2f21, 0x9}, &(0x7f00000000c0)={0x6, 0x8, 0x101, 0x1, 0x1f, 0xe68, 0x5, 0x9}, &(0x7f0000000100)={0x0, 0x989680}, &(0x7f0000000180)={&(0x7f0000000140)={[0x800]}, 0x8}) clock_gettime(0x0, &(0x7f0000000200)={0x0, 0x0}) futex(&(0x7f00000001c0), 0x4, 0x1, &(0x7f0000000240)={r0, r1+10000000}, &(0x7f0000000280)=0x2, 0x2) prctl$PR_GET_PDEATHSIG(0x2, &(0x7f00000002c0)) pselect6(0x40, &(0x7f0000000300)={0x7, 0x3, 0x2, 0x800, 0x4f7, 0x3, 0x3, 0x10001}, &(0x7f0000000340)={0x5, 0x2, 0x7ff, 0x40, 0xff, 0x2, 0x5, 0x4}, &(0x7f0000000380)={0x7, 0x0, 0x101, 0x662, 0x0, 0x5, 0x2, 0x7b4}, &(0x7f00000003c0)={0x0, 0x989680}, &(0x7f0000000440)={&(0x7f0000000400), 0x8}) ioctl$UI_SET_PROPBIT(0xffffffffffffffff, 0x4004556e, 0x15) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, &(0x7f0000000480)='syz1\x00') ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x6) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f00000004c0), 0x802, 0x0) ioctl$UI_SET_RELBIT(r2, 0x40045566, 0x7) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000500), 0x802, 0x0) ioctl$UI_SET_KEYBIT(r3, 0x40045565, 0x6c) clock_gettime(0x6, &(0x7f0000000680)) 14:38:04 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) ioctl$UI_SET_KEYBIT(r0, 0x40045565, 0x54) prctl$PR_SET_SECUREBITS(0x1c, 0x8) sendmsg$NL80211_CMD_SET_PMKSA(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x4000015) prctl$PR_SET_SECUREBITS(0x1c, 0x20) r1 = syz_open_dev$vcsa(&(0x7f0000000100), 0x920, 0x240) ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1d6) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000140), 0x802, 0x0) ioctl$UI_SET_EVBIT(r2, 0x40045564, 0x1d) ioctl$UI_BEGIN_FF_UPLOAD(r2, 0xc06855c8, &(0x7f00000001c0)={0x5, 0x9, {0x54, 0xfff8, 0x62, {0x100, 0x9d2}, {0x7ff, 0x101}, @period={0x59, 0x2, 0x3, 0x5, 0x8, {0x4, 0x3f7, 0x9, 0x3d9b}, 0x8, &(0x7f0000000180)=[0xfbe0, 0x31a7, 0x6, 0x3, 0xa9c, 0x1, 0x6145, 0x7]}}, {0x54, 0x20, 0x6, {0x8000, 0x401}, {0x3, 0x3ff}, @ramp={0x2, 0x3e5c, {0x1, 0x4, 0x3, 0x1000}}}}) r3 = syz_open_dev$vcsa(&(0x7f0000000240), 0x6, 0x111000) ioctl$UI_SET_PHYS(r3, 0x4008556c, &(0x7f0000000280)='syz1\x00') r4 = openat$uinput(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$UI_END_FF_ERASE(r4, 0x400c55cb, &(0x7f00000003c0)={0x5, 0x4, 0x1}) 14:38:04 executing program 1: clock_getres(0x7, &(0x7f0000000000)) pselect6(0x40, &(0x7f0000000040)={0x5, 0x7fffffff, 0x5, 0xb1, 0x10000, 0x7, 0x7, 0xe4ee}, &(0x7f0000000080)={0x1, 0x5, 0x283, 0x7e, 0x57dc, 0xffff, 0x363b2f21, 0x9}, &(0x7f00000000c0)={0x6, 0x8, 0x101, 0x1, 0x1f, 0xe68, 0x5, 0x9}, &(0x7f0000000100)={0x0, 0x989680}, &(0x7f0000000180)={&(0x7f0000000140)={[0x800]}, 0x8}) clock_gettime(0x0, &(0x7f0000000200)={0x0, 0x0}) futex(&(0x7f00000001c0), 0x4, 0x1, &(0x7f0000000240)={r0, r1+10000000}, &(0x7f0000000280)=0x2, 0x2) prctl$PR_GET_PDEATHSIG(0x2, &(0x7f00000002c0)) pselect6(0x40, &(0x7f0000000300)={0x7, 0x3, 0x2, 0x800, 0x4f7, 0x3, 0x3, 0x10001}, &(0x7f0000000340)={0x5, 0x2, 0x7ff, 0x40, 0xff, 0x2, 0x5, 0x4}, &(0x7f0000000380)={0x7, 0x0, 0x101, 0x662, 0x0, 0x5, 0x2, 0x7b4}, &(0x7f00000003c0)={0x0, 0x989680}, &(0x7f0000000440)={&(0x7f0000000400), 0x8}) ioctl$UI_SET_PROPBIT(0xffffffffffffffff, 0x4004556e, 0x15) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, &(0x7f0000000480)='syz1\x00') ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x6) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f00000004c0), 0x802, 0x0) ioctl$UI_SET_RELBIT(r2, 0x40045566, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000500), 0x802, 0x0) clock_gettime(0x6, &(0x7f0000000680)) 14:38:04 executing program 0: clock_getres(0x4, &(0x7f0000000000)) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$UI_SET_SWBIT(r0, 0x4004556d, 0x0) clock_gettime(0x4, &(0x7f0000000080)) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) setsockopt$bt_hci_HCI_DATA_DIR(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000000c0)=0x81, 0x4) clock_getres(0x6, &(0x7f0000000100)) write$uinput_user_dev(r0, &(0x7f0000000140)={'syz1\x00', {0x800, 0x19, 0x100, 0x6}, 0xf, [0x5, 0xfffff800, 0xe, 0x8, 0x9, 0x1, 0x40, 0xff, 0x0, 0x1, 0xa87, 0xfffffffb, 0x8, 0x9, 0x7, 0x1, 0x1, 0x80000000, 0xfffffffe, 0x4, 0x3b, 0x7ff, 0x1, 0x5, 0xffffffff, 0x0, 0x7, 0x4, 0x7d0, 0x3b, 0x1ff, 0xffff, 0x5f0b, 0x7, 0xfffff000, 0x1, 0xa5, 0x6, 0x6, 0x10001, 0x2, 0xffffffff, 0xfc91, 0x0, 0x6, 0xfffffff8, 0xdca7, 0x2, 0xc0d, 0x80000000, 0x6, 0xffffffff, 0x0, 0x401, 0x3, 0x7, 0x2, 0x0, 0xfffffffc, 0x7ff, 0x7, 0x6, 0xf0a5, 0x81], [0x1c, 0x4, 0x1, 0xa86e, 0x8001, 0x100, 0x3, 0x5, 0x1, 0x6, 0x3568, 0x0, 0x9, 0x6, 0x7fffffff, 0x6f, 0x103, 0x4, 0xffa, 0x4, 0x0, 0x81, 0x2, 0x81f, 0x75ad, 0x4, 0x1873, 0x72e, 0x1, 0xd1, 0x6, 0x0, 0x83, 0x9, 0xc5e, 0x10000, 0x0, 0x1, 0x6, 0x9de, 0x3ff, 0x7f, 0x7, 0x8000, 0xf4c, 0x0, 0x8, 0x3f, 0x1, 0x80000001, 0xffffffff, 0xfffffffb, 0x6, 0x4d1, 0x6, 0x4, 0x5, 0xff, 0x1, 0x9, 0x6, 0x3, 0xffffffff, 0x3], [0xcd, 0x3, 0xf, 0x80000000, 0x5, 0x7, 0x1, 0x7, 0x80000000, 0x0, 0x4, 0x4, 0x7, 0x1, 0x1, 0x0, 0x8, 0x1, 0x855, 0x5, 0x75ae, 0x4411, 0x8, 0xffff, 0x200, 0x7, 0xc4, 0x11fedc7, 0xffff, 0x101, 0xffffffff, 0x7fff, 0x0, 0xffffffff, 0xf30, 0x7, 0x6, 0x2, 0x3f, 0x40000000, 0x23, 0x0, 0x21, 0x1, 0x5, 0x6, 0x401, 0x53f, 0x1, 0x10000, 0x800, 0x2, 0x0, 0x800, 0x7, 0x0, 0x7, 0x1, 0x3, 0x50000000, 0x10000, 0xffffffff, 0x2, 0x3], [0x4, 0x0, 0xffff, 0xc82d, 0xe02, 0x80000000, 0x2, 0xff, 0x5, 0x4, 0x5a, 0x80000000, 0x1ff, 0x4, 0x2, 0x89, 0x5, 0x4, 0x81, 0x5, 0xfffffeff, 0x9, 0x0, 0xb8e, 0x79ed, 0x4, 0x4, 0x1ff, 0x0, 0xde, 0x80, 0x3, 0x4, 0x5, 0x10001, 0x3f, 0x8001, 0x2, 0xdf56, 0xffff, 0x4, 0x52, 0x6, 0x7ff, 0x80000001, 0x4, 0x5, 0x8, 0x1, 0x31f24a7, 0x5, 0x1ff, 0x4f, 0x3, 0x100, 0x80000001, 0xfff, 0xd9f, 0x6f, 0x7, 0x1, 0x1, 0x9, 0x227d]}, 0x45c) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT(0xffffffffffffffff, 0x28, 0x6, &(0x7f00000005c0)={0x77359400}, 0x10) capset(&(0x7f0000000600)={0xf1504}, &(0x7f0000000640)={0x0, 0x1, 0x20, 0x20, 0x3, 0xffffffff}) write$P9_RXATTRWALK(0xffffffffffffffff, &(0x7f0000000dc0)={0xf, 0x1f, 0x2, 0x8}, 0xf) 14:38:04 executing program 3: pselect6(0x40, &(0x7f0000000000)={0xe1, 0x1000, 0x5, 0x5, 0x400, 0xfffffffffffffffa, 0xffffffffffff0001, 0x8}, &(0x7f0000000040)={0x8, 0x100000001, 0x6ed0, 0x82, 0x401, 0x8, 0x3, 0x2}, &(0x7f0000000080)={0x1, 0x8000, 0x1, 0xffff, 0x6, 0x7fffffff, 0x4, 0xfffffffeffffffff}, &(0x7f00000000c0)={0x77359400}, &(0x7f0000000140)={&(0x7f0000000100)={[0x5]}, 0x8}) futex(&(0x7f0000000180)=0x1, 0x0, 0x2, &(0x7f00000001c0)={0x0, 0x989680}, &(0x7f0000000200)=0x1, 0x1) clock_getres(0x0, &(0x7f0000000240)) clock_gettime(0x0, &(0x7f0000000340)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000280)={0xffffffffffff8001, 0x8, 0x3, 0x8001, 0x1d, 0x5, 0x100000000, 0x6}, &(0x7f00000002c0)={0x10000, 0xf5, 0x9, 0x3, 0x3f, 0x10000, 0xafaa, 0xf0}, &(0x7f0000000300)={0x3f, 0x100000000, 0x9, 0xd7d9, 0xcffb, 0x854, 0x9, 0xffffffffffffffe0}, &(0x7f0000000380)={r0, r1+60000000}, &(0x7f0000000400)={&(0x7f00000003c0)={[0x80000000]}, 0x8}) clock_settime(0x4, &(0x7f0000000440)={0x77359400}) prctl$PR_SET_THP_DISABLE(0x29, 0x1) clock_getres(0x6, &(0x7f0000000480)) clock_gettime(0x3, &(0x7f00000004c0)) clock_settime(0x5, &(0x7f0000000500)={0x77359400}) pselect6(0x40, &(0x7f0000000540)={0x9, 0x9, 0x4, 0x3, 0xbc88, 0x3, 0x2, 0x2}, &(0x7f0000000580)={0x1f, 0x6, 0x26ba, 0x8, 0x1, 0x8000, 0x1, 0x8}, 0x0, &(0x7f00000005c0)={0x0, 0x3938700}, &(0x7f0000000640)={&(0x7f0000000600)={[0x10001]}, 0x8}) accept4$vsock_stream(0xffffffffffffffff, &(0x7f0000000680)={0x28, 0x0, 0x0, @local}, 0x10, 0x80800) pselect6(0x40, &(0x7f00000006c0)={0x1, 0x1, 0x89e, 0x4, 0xffffffffffffff16, 0x400, 0x1, 0x9}, &(0x7f0000000700)={0x9, 0x5, 0xc56, 0xf732, 0x1, 0x1, 0x20, 0x101}, &(0x7f0000000740)={0x1df0a00000, 0x9, 0x7, 0x8001, 0x2, 0x80000000, 0xfffffffffffff801}, &(0x7f0000000780)={0x0, 0x3938700}, &(0x7f0000000800)={&(0x7f00000007c0)={[0x6]}, 0x8}) pselect6(0x40, &(0x7f0000000dc0)={0x1, 0x81, 0x0, 0x9c31, 0x502, 0xe101, 0x0, 0x4}, &(0x7f0000000e00)={0x2, 0x2e4b, 0xa6, 0x200, 0x2, 0x0, 0x8, 0x7ff}, &(0x7f0000000e40)={0x95, 0x3, 0xff, 0xffffffffffffb022, 0x96f7, 0x7fff, 0x9, 0x9}, &(0x7f0000000e80), &(0x7f0000000f00)={&(0x7f0000000ec0)={[0x2]}, 0x8}) 14:38:04 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) ioctl$UI_SET_KEYBIT(r0, 0x40045565, 0x54) prctl$PR_SET_SECUREBITS(0x1c, 0x8) sendmsg$NL80211_CMD_SET_PMKSA(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x4000015) prctl$PR_SET_SECUREBITS(0x1c, 0x20) r1 = syz_open_dev$vcsa(&(0x7f0000000100), 0x920, 0x240) ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1d6) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000140), 0x802, 0x0) ioctl$UI_SET_EVBIT(r2, 0x40045564, 0x1d) ioctl$UI_BEGIN_FF_UPLOAD(r2, 0xc06855c8, &(0x7f00000001c0)={0x5, 0x9, {0x54, 0xfff8, 0x62, {0x100, 0x9d2}, {0x7ff, 0x101}, @period={0x59, 0x2, 0x3, 0x5, 0x8, {0x4, 0x3f7, 0x9, 0x3d9b}, 0x8, &(0x7f0000000180)=[0xfbe0, 0x31a7, 0x6, 0x3, 0xa9c, 0x1, 0x6145, 0x7]}}, {0x54, 0x20, 0x6, {0x8000, 0x401}, {0x3, 0x3ff}, @ramp={0x2, 0x3e5c, {0x1, 0x4, 0x3, 0x1000}}}}) r3 = syz_open_dev$vcsa(&(0x7f0000000240), 0x6, 0x111000) ioctl$UI_SET_PHYS(r3, 0x4008556c, &(0x7f0000000280)='syz1\x00') ioctl$UI_END_FF_ERASE(0xffffffffffffffff, 0x400c55cb, &(0x7f00000003c0)={0x5, 0x4, 0x1}) 14:38:04 executing program 4: r0 = socket(0x0, 0x1, 0x2) sendmsg$NL80211_CMD_GET_KEY(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x7c, 0x0, 0xc30, 0x70bd28, 0x25dfdbfb, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac05}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "b98e1c15b9504b03c1de98fdff"}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "a448a9969794224f53b27f76e3"}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac01}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "0c2e0e097645692b3641dbc8ff"}]}, 0x7c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10000) io_uring_setup(0x3d2a, &(0x7f0000000140)={0x0, 0xee28, 0x2, 0x2, 0xf5}) r1 = syz_open_dev$vcsa(&(0x7f00000001c0), 0x8, 0x402082) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEL_STATION(r1, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x54, 0x0, 0x800, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_STA_TX_POWER_SETTING={0x5, 0x113, 0x1}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x9d}, @NL80211_ATTR_STA_FLAGS2={0xc, 0x43, {0x7}}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_AIRTIME_WEIGHT={0x6, 0x112, 0x6}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x7012}]}, 0x54}, 0x1, 0x0, 0x0, 0x20000000}, 0x4040004) sendmsg$NL80211_CMD_GET_MPP(r1, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x44, 0x0, 0x2, 0x70bd25, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}]}, 0x44}, 0x1, 0x0, 0x0, 0x804}, 0x81) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r1, 0x40082102, &(0x7f00000004c0)) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000580)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_MCAST_RATE(r1, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x40, r3, 0x300, 0x70bd2d, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0x8, 0x61}}}}, [@NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x21c}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0xf0}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x78}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000010}, 0x1010) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f00000007c0)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000780)={&(0x7f00000006c0)={0xac, r3, 0x10, 0x70bd2a, 0x25dfdbfe, {{}, {@void, @void, @val={0xc, 0x99, {0x8000, 0x1a}}}}, [@NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @mon_options=[@NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "694edb82987efca9726b73dbad87aee9c82f5881a01e260e"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "3a6891e4f568a688f298dd323c27c3d5337f12d8da63e512"}, @NL80211_ATTR_MNTR_FLAGS={0x14, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}]}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "b402286e97edaf79b6a5ca4ad38ae0d1859405033784ba8b"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "d11a0cbf38e9334c37895f93e68d51c754bb1b6faa3e765f"}]]}, 0xac}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000000900)={0x3, 0x9, 0x1, 0x4195, 0xdd, 0x8, &(0x7f0000000800)="63f58ea60fe7dd9b64b9d78660f645dfa5779ae6a8b497cfb0441078497694e79203c3a069573f0c7b12c0d93febab8b1ba2ca2d951e0b9d8182d058ee8f22353bfecf2e666011b3851e9f916949e18a292547d2cca0da41625139c16d7c060634113556136ff3f94e70dde9f920a1a5b79567f27850358e5a704e657e7505912a6b687db7380cc01c4bda0e7303a5dfa4bc8abdfadcefbcd2ae5c09943c382692f48f967d7ceb6306166902ecbcabb032e0bed88c6b2f700aa406ec1f8175d6d80d0a1bac05373ced80901199b41b51aad80839106297d33b37df84b5"}) syz_open_dev$usbfs(&(0x7f0000000ac0), 0x10000, 0x84000) 14:38:04 executing program 3: pselect6(0x40, &(0x7f0000000000)={0xe1, 0x1000, 0x5, 0x5, 0x400, 0xfffffffffffffffa, 0xffffffffffff0001, 0x8}, &(0x7f0000000040)={0x8, 0x100000001, 0x6ed0, 0x82, 0x401, 0x8, 0x3, 0x2}, &(0x7f0000000080)={0x1, 0x8000, 0x1, 0xffff, 0x6, 0x7fffffff, 0x4, 0xfffffffeffffffff}, &(0x7f00000000c0)={0x77359400}, &(0x7f0000000140)={&(0x7f0000000100)={[0x5]}, 0x8}) futex(&(0x7f0000000180)=0x1, 0x0, 0x2, &(0x7f00000001c0)={0x0, 0x989680}, &(0x7f0000000200)=0x1, 0x1) clock_getres(0x0, &(0x7f0000000240)) clock_gettime(0x0, &(0x7f0000000340)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000280)={0xffffffffffff8001, 0x8, 0x3, 0x8001, 0x1d, 0x5, 0x100000000, 0x6}, &(0x7f00000002c0)={0x10000, 0xf5, 0x9, 0x3, 0x3f, 0x10000, 0xafaa, 0xf0}, &(0x7f0000000300)={0x3f, 0x100000000, 0x9, 0xd7d9, 0xcffb, 0x854, 0x9, 0xffffffffffffffe0}, &(0x7f0000000380)={r0, r1+60000000}, &(0x7f0000000400)={&(0x7f00000003c0)={[0x80000000]}, 0x8}) clock_settime(0x4, &(0x7f0000000440)={0x77359400}) prctl$PR_SET_THP_DISABLE(0x29, 0x1) clock_getres(0x6, &(0x7f0000000480)) clock_gettime(0x3, &(0x7f00000004c0)) clock_settime(0x5, &(0x7f0000000500)={0x77359400}) pselect6(0x40, &(0x7f0000000540)={0x9, 0x9, 0x4, 0x3, 0xbc88, 0x3, 0x2, 0x2}, &(0x7f0000000580)={0x1f, 0x6, 0x26ba, 0x8, 0x1, 0x8000, 0x1, 0x8}, 0x0, &(0x7f00000005c0)={0x0, 0x3938700}, &(0x7f0000000640)={&(0x7f0000000600)={[0x10001]}, 0x8}) accept4$vsock_stream(0xffffffffffffffff, &(0x7f0000000680)={0x28, 0x0, 0x0, @local}, 0x10, 0x80800) pselect6(0x40, &(0x7f0000000dc0)={0x1, 0x81, 0x0, 0x9c31, 0x502, 0xe101, 0x0, 0x4}, &(0x7f0000000e00)={0x2, 0x2e4b, 0xa6, 0x200, 0x2, 0x0, 0x8, 0x7ff}, &(0x7f0000000e40)={0x95, 0x3, 0xff, 0xffffffffffffb022, 0x96f7, 0x7fff, 0x9, 0x9}, &(0x7f0000000e80), &(0x7f0000000f00)={&(0x7f0000000ec0)={[0x2]}, 0x8}) [ 28.217799][ T455] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2 [ 28.245543][ T455] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db 14:38:05 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$fou(&(0x7f0000000000), r0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, 0xffffffffffffffff) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) sendmsg$NL80211_CMD_DISASSOCIATE(r0, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)={0x164, r1, 0x400, 0x70bd2c, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_IE={0x14d, 0x2a, [@link_id={0x65, 0x12, {@from_mac, @device_a, @broadcast}}, @ssid={0x0, 0x6, @default_ibss_ssid}, @supported_rates={0x1, 0x6, [{0x29}, {0x30, 0x1}, {0x5}, {0x1}, {0x4}, {0x4, 0x1}]}, @tim={0x5, 0xc0, {0x7, 0x68, 0x80, "61657e60f0801a300509aab918ab1971761a963dd21eb9e9c9024899cca7173fff84acb5125eef28533baeb1d9fda0d6669cc46ce466affeb608cbf1fe42d44a07d717b07203f58dc1c6f7355c1fc80ce920418fdcaadfb61589d8fc9f9bffa45113d826d1b5f403b18c2b55a83a0ab727c4d8f3ba995882944dfd7e7b71a7d6b910b06173fca2d1c86a9adec4a962145f1bb9a95e974795a6ac80352c76d60f8de261d13a3cc1414b28ce86f725c97c5c24154048d4dab242e3e8fa86"}}, @link_id={0x65, 0x12, {@random="ae81ff7d5170", @broadcast}}, @ibss={0x6, 0x2, 0xc81c}, @random={0x1, 0x3c, "7045311358996128f2395883547f6b80b2fd27a9f69591031ecd896f20eeb76ad877ab6038afa87a277368ce754cf5ed8866f880e8a8be8ff4db00ef"}, @gcr_ga={0xbd, 0x6, @device_b}, @channel_switch={0x25, 0x3, {0x1, 0x8c, 0xa2}}]}]}, 0x164}, 0x1, 0x0, 0x0, 0xc814}, 0xc040) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TDLS_CHANNEL_SWITCH(r0, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x58, r1, 0x2, 0x70bd27, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x400, 0x3b}}}}, [@NL80211_ATTR_OPER_CLASS={0x5, 0xd6, 0x3}, @chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0xb}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x3c7}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x1}], @NL80211_ATTR_OPER_CLASS={0x5, 0xd6, 0x34}]}, 0x58}}, 0x10000080) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000480), r2) sendmsg$NL80211_CMD_TDLS_CHANNEL_SWITCH(r2, &(0x7f0000000580)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000540)={&(0x7f00000004c0)={0x64, r4, 0x300, 0x70bd27, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x80, 0x53}}}}, [@NL80211_ATTR_OPER_CLASS={0x5, 0xd6, 0x1}, @NL80211_ATTR_OPER_CLASS={0x5}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_OPER_CLASS={0x5, 0xd6, 0x1}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x64}, 0x1, 0x0, 0x0, 0x2000000}, 0x40000) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_RELOAD_REGDB(r5, &(0x7f0000000680)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x400802}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x14, r1, 0x4, 0x70bd28, 0x25dfdbff, {}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x840) r6 = syz_open_dev$vcsa(&(0x7f00000006c0), 0xfffffffffffeffff, 0x20103) sendmsg$NL80211_CMD_DEL_STATION(r6, &(0x7f0000000800)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000740)={0x6c, r4, 0x8, 0x70bd2c, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_STA_WME={0x2c, 0x81, [@NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0x6}, @NL80211_STA_WME_MAX_SP={0x5}, @NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0x2}, @NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0x9}, @NL80211_STA_WME_MAX_SP={0x5, 0x2, 0x3}]}, @NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x723}, @NL80211_ATTR_AIRTIME_WEIGHT={0x6, 0x112, 0x1}, @NL80211_ATTR_STA_WME={0x14, 0x81, [@NL80211_STA_WME_MAX_SP={0x5, 0x2, 0x7e}, @NL80211_STA_WME_MAX_SP={0x5, 0x2, 0x3}]}, @NL80211_ATTR_LOCAL_MESH_POWER_MODE={0x8, 0xa4, 0x2}]}, 0x6c}, 0x1, 0x0, 0x0, 0x8040}, 0x8000) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NET_DM_CMD_STOP(r7, &(0x7f0000000900)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000880)={0x14, 0x0, 0x10, 0x70bd2c, 0x25dfdbfb, {}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) getpgrp(0xffffffffffffffff) sendmsg$NL80211_CMD_START_P2P_DEVICE(r5, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x28, r4, 0x100, 0x70bd26, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x0, 0xe}}}}, ["", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x810}, 0x400c014) sendmsg$NL80211_CMD_RELOAD_REGDB(r5, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14, r4, 0x1, 0x70bd28, 0x25dfdbfe, {}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4040881}, 0x0) 14:38:05 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) ioctl$UI_SET_KEYBIT(r0, 0x40045565, 0x54) prctl$PR_SET_SECUREBITS(0x1c, 0x8) sendmsg$NL80211_CMD_SET_PMKSA(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x4000015) prctl$PR_SET_SECUREBITS(0x1c, 0x20) r1 = syz_open_dev$vcsa(&(0x7f0000000100), 0x920, 0x240) ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1d6) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000140), 0x802, 0x0) ioctl$UI_SET_EVBIT(r2, 0x40045564, 0x1d) ioctl$UI_BEGIN_FF_UPLOAD(r2, 0xc06855c8, &(0x7f00000001c0)={0x5, 0x9, {0x54, 0xfff8, 0x62, {0x100, 0x9d2}, {0x7ff, 0x101}, @period={0x59, 0x2, 0x3, 0x5, 0x8, {0x4, 0x3f7, 0x9, 0x3d9b}, 0x8, &(0x7f0000000180)=[0xfbe0, 0x31a7, 0x6, 0x3, 0xa9c, 0x1, 0x6145, 0x7]}}, {0x54, 0x20, 0x6, {0x8000, 0x401}, {0x3, 0x3ff}, @ramp={0x2, 0x3e5c, {0x1, 0x4, 0x3, 0x1000}}}}) r3 = syz_open_dev$vcsa(&(0x7f0000000240), 0x6, 0x111000) ioctl$UI_SET_PHYS(r3, 0x4008556c, &(0x7f0000000280)='syz1\x00') ioctl$UI_END_FF_ERASE(0xffffffffffffffff, 0x400c55cb, &(0x7f00000003c0)={0x5, 0x4, 0x1}) 14:38:05 executing program 0: clock_getres(0x4, &(0x7f0000000000)) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$UI_SET_SWBIT(r0, 0x4004556d, 0x0) clock_gettime(0x4, &(0x7f0000000080)) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) setsockopt$bt_hci_HCI_DATA_DIR(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000000c0)=0x81, 0x4) clock_getres(0x6, &(0x7f0000000100)) write$uinput_user_dev(r0, &(0x7f0000000140)={'syz1\x00', {0x800, 0x19, 0x100, 0x6}, 0xf, [0x5, 0xfffff800, 0xe, 0x8, 0x9, 0x1, 0x40, 0xff, 0x0, 0x1, 0xa87, 0xfffffffb, 0x8, 0x9, 0x7, 0x1, 0x1, 0x80000000, 0xfffffffe, 0x4, 0x3b, 0x7ff, 0x1, 0x5, 0xffffffff, 0x0, 0x7, 0x4, 0x7d0, 0x3b, 0x1ff, 0xffff, 0x5f0b, 0x7, 0xfffff000, 0x1, 0xa5, 0x6, 0x6, 0x10001, 0x2, 0xffffffff, 0xfc91, 0x0, 0x6, 0xfffffff8, 0xdca7, 0x2, 0xc0d, 0x80000000, 0x6, 0xffffffff, 0x0, 0x401, 0x3, 0x7, 0x2, 0x0, 0xfffffffc, 0x7ff, 0x7, 0x6, 0xf0a5, 0x81], [0x1c, 0x4, 0x1, 0xa86e, 0x8001, 0x100, 0x3, 0x5, 0x1, 0x6, 0x3568, 0x0, 0x9, 0x6, 0x7fffffff, 0x6f, 0x103, 0x4, 0xffa, 0x4, 0x0, 0x81, 0x2, 0x81f, 0x75ad, 0x4, 0x1873, 0x72e, 0x1, 0xd1, 0x6, 0x0, 0x83, 0x9, 0xc5e, 0x10000, 0x0, 0x1, 0x6, 0x9de, 0x3ff, 0x7f, 0x7, 0x8000, 0xf4c, 0x0, 0x8, 0x3f, 0x1, 0x80000001, 0xffffffff, 0xfffffffb, 0x6, 0x4d1, 0x6, 0x4, 0x5, 0xff, 0x1, 0x9, 0x6, 0x3, 0xffffffff, 0x3], [0xcd, 0x3, 0xf, 0x80000000, 0x5, 0x7, 0x1, 0x7, 0x80000000, 0x0, 0x4, 0x4, 0x7, 0x1, 0x1, 0x0, 0x8, 0x1, 0x855, 0x5, 0x75ae, 0x4411, 0x8, 0xffff, 0x200, 0x7, 0xc4, 0x11fedc7, 0xffff, 0x101, 0xffffffff, 0x7fff, 0x0, 0xffffffff, 0xf30, 0x7, 0x6, 0x2, 0x3f, 0x40000000, 0x23, 0x0, 0x21, 0x1, 0x5, 0x6, 0x401, 0x53f, 0x1, 0x10000, 0x800, 0x2, 0x0, 0x800, 0x7, 0x0, 0x7, 0x1, 0x3, 0x50000000, 0x10000, 0xffffffff, 0x2, 0x3], [0x4, 0x0, 0xffff, 0xc82d, 0xe02, 0x80000000, 0x2, 0xff, 0x5, 0x4, 0x5a, 0x80000000, 0x1ff, 0x4, 0x2, 0x89, 0x5, 0x4, 0x81, 0x5, 0xfffffeff, 0x9, 0x0, 0xb8e, 0x79ed, 0x4, 0x4, 0x1ff, 0x0, 0xde, 0x80, 0x3, 0x4, 0x5, 0x10001, 0x3f, 0x8001, 0x2, 0xdf56, 0xffff, 0x4, 0x52, 0x6, 0x7ff, 0x80000001, 0x4, 0x5, 0x8, 0x1, 0x31f24a7, 0x5, 0x1ff, 0x4f, 0x3, 0x100, 0x80000001, 0xfff, 0xd9f, 0x6f, 0x7, 0x1, 0x1, 0x9, 0x227d]}, 0x45c) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT(0xffffffffffffffff, 0x28, 0x6, &(0x7f00000005c0)={0x77359400}, 0x10) write$P9_RXATTRWALK(0xffffffffffffffff, &(0x7f0000000dc0)={0xf, 0x1f, 0x2, 0x8}, 0xf) 14:38:05 executing program 1: clock_getres(0x7, &(0x7f0000000000)) pselect6(0x40, &(0x7f0000000040)={0x5, 0x7fffffff, 0x5, 0xb1, 0x10000, 0x7, 0x7, 0xe4ee}, &(0x7f0000000080)={0x1, 0x5, 0x283, 0x7e, 0x57dc, 0xffff, 0x363b2f21, 0x9}, &(0x7f00000000c0)={0x6, 0x8, 0x101, 0x1, 0x1f, 0xe68, 0x5, 0x9}, &(0x7f0000000100)={0x0, 0x989680}, &(0x7f0000000180)={&(0x7f0000000140)={[0x800]}, 0x8}) clock_gettime(0x0, &(0x7f0000000200)={0x0, 0x0}) futex(&(0x7f00000001c0), 0x4, 0x1, &(0x7f0000000240)={r0, r1+10000000}, &(0x7f0000000280)=0x2, 0x2) prctl$PR_GET_PDEATHSIG(0x2, &(0x7f00000002c0)) pselect6(0x40, &(0x7f0000000300)={0x7, 0x3, 0x2, 0x800, 0x4f7, 0x3, 0x3, 0x10001}, &(0x7f0000000340)={0x5, 0x2, 0x7ff, 0x40, 0xff, 0x2, 0x5, 0x4}, &(0x7f0000000380)={0x7, 0x0, 0x101, 0x662, 0x0, 0x5, 0x2, 0x7b4}, &(0x7f00000003c0)={0x0, 0x989680}, &(0x7f0000000440)={&(0x7f0000000400), 0x8}) ioctl$UI_SET_PROPBIT(0xffffffffffffffff, 0x4004556e, 0x15) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, &(0x7f0000000480)='syz1\x00') ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x6) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f00000004c0), 0x802, 0x0) ioctl$UI_SET_RELBIT(r2, 0x40045566, 0x7) clock_gettime(0x6, &(0x7f0000000680)) 14:38:05 executing program 4: r0 = socket(0x0, 0x1, 0x2) sendmsg$NL80211_CMD_GET_KEY(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x7c, 0x0, 0xc30, 0x70bd28, 0x25dfdbfb, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac05}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "b98e1c15b9504b03c1de98fdff"}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "a448a9969794224f53b27f76e3"}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac01}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "0c2e0e097645692b3641dbc8ff"}]}, 0x7c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10000) io_uring_setup(0x3d2a, &(0x7f0000000140)={0x0, 0xee28, 0x2, 0x2, 0xf5}) r1 = syz_open_dev$vcsa(&(0x7f00000001c0), 0x8, 0x402082) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEL_STATION(r1, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x54, 0x0, 0x800, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_STA_TX_POWER_SETTING={0x5, 0x113, 0x1}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x9d}, @NL80211_ATTR_STA_FLAGS2={0xc, 0x43, {0x7}}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_AIRTIME_WEIGHT={0x6, 0x112, 0x6}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x7012}]}, 0x54}, 0x1, 0x0, 0x0, 0x20000000}, 0x4040004) sendmsg$NL80211_CMD_GET_MPP(r1, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x44, 0x0, 0x2, 0x70bd25, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}]}, 0x44}, 0x1, 0x0, 0x0, 0x804}, 0x81) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r1, 0x40082102, &(0x7f00000004c0)) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000580)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_MCAST_RATE(r1, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x40, r3, 0x300, 0x70bd2d, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0x8, 0x61}}}}, [@NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x21c}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0xf0}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x78}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000010}, 0x1010) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f00000007c0)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000780)={&(0x7f00000006c0)={0xac, r3, 0x10, 0x70bd2a, 0x25dfdbfe, {{}, {@void, @void, @val={0xc, 0x99, {0x8000, 0x1a}}}}, [@NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @mon_options=[@NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "694edb82987efca9726b73dbad87aee9c82f5881a01e260e"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "3a6891e4f568a688f298dd323c27c3d5337f12d8da63e512"}, @NL80211_ATTR_MNTR_FLAGS={0x14, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}]}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "b402286e97edaf79b6a5ca4ad38ae0d1859405033784ba8b"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "d11a0cbf38e9334c37895f93e68d51c754bb1b6faa3e765f"}]]}, 0xac}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) syz_open_dev$usbfs(&(0x7f0000000ac0), 0x10000, 0x84000) 14:38:05 executing program 3: pselect6(0x40, &(0x7f0000000000)={0xe1, 0x1000, 0x5, 0x5, 0x400, 0xfffffffffffffffa, 0xffffffffffff0001, 0x8}, &(0x7f0000000040)={0x8, 0x100000001, 0x6ed0, 0x82, 0x401, 0x8, 0x3, 0x2}, &(0x7f0000000080)={0x1, 0x8000, 0x1, 0xffff, 0x6, 0x7fffffff, 0x4, 0xfffffffeffffffff}, &(0x7f00000000c0)={0x77359400}, &(0x7f0000000140)={&(0x7f0000000100)={[0x5]}, 0x8}) futex(&(0x7f0000000180)=0x1, 0x0, 0x2, &(0x7f00000001c0)={0x0, 0x989680}, &(0x7f0000000200)=0x1, 0x1) clock_getres(0x0, &(0x7f0000000240)) clock_gettime(0x0, &(0x7f0000000340)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000280)={0xffffffffffff8001, 0x8, 0x3, 0x8001, 0x1d, 0x5, 0x100000000, 0x6}, &(0x7f00000002c0)={0x10000, 0xf5, 0x9, 0x3, 0x3f, 0x10000, 0xafaa, 0xf0}, &(0x7f0000000300)={0x3f, 0x100000000, 0x9, 0xd7d9, 0xcffb, 0x854, 0x9, 0xffffffffffffffe0}, &(0x7f0000000380)={r0, r1+60000000}, &(0x7f0000000400)={&(0x7f00000003c0)={[0x80000000]}, 0x8}) clock_settime(0x4, &(0x7f0000000440)={0x77359400}) prctl$PR_SET_THP_DISABLE(0x29, 0x1) clock_getres(0x6, &(0x7f0000000480)) clock_gettime(0x3, &(0x7f00000004c0)) clock_settime(0x5, &(0x7f0000000500)={0x77359400}) pselect6(0x40, &(0x7f0000000540)={0x9, 0x9, 0x4, 0x3, 0xbc88, 0x3, 0x2, 0x2}, &(0x7f0000000580)={0x1f, 0x6, 0x26ba, 0x8, 0x1, 0x8000, 0x1, 0x8}, 0x0, &(0x7f00000005c0)={0x0, 0x3938700}, &(0x7f0000000640)={&(0x7f0000000600)={[0x10001]}, 0x8}) pselect6(0x40, &(0x7f0000000dc0)={0x1, 0x81, 0x0, 0x9c31, 0x502, 0xe101, 0x0, 0x4}, &(0x7f0000000e0