1ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r3}, 0x18, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r5) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r6, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) r7 = gettid() tkill(r7, 0x3b) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r8, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r8, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r8, 0x5501) 22:50:44 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0x0, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32, @ANYBLOB], 0x1c) r2 = timerfd_create(0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r7}, 0x18, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r9) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r10, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r10, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r10, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r10, 0x5501) r11 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r11, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x0, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, 0x0) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r16, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, r22, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r6, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce4620162e9d20", 0xab}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r7, @ANYRES32=r9, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r5, @ANYRESHEX=r9, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r12, @ANYRES32=r2, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r13, @ANYRES32=r3, @ANYRES32=r14, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT=r22, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="000000001800000000000000010000", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="180000000000000001000000010000", @ANYRES32=r21, @ANYRES32=r2], 0x18d}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x40) [ 984.063212] [] ? compaction_deferred+0x118/0x320 22:50:44 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0x0, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r13, 0x1000008912, &(0x7f0000000140)) r14 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) r16 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r16, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r16, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r16, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r16, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r17 = gettid() ptrace$setopts(0x4206, r17, 0x0, 0x0) tkill(r17, 0x3b) ptrace$setregs(0xd, r17, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r17, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r18}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r20 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r21 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r21, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r21, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r21, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r21, 0x5501) r22 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r23 = gettid() ptrace$setopts(0x4206, r23, 0x0, 0x0) tkill(r23, 0x3b) ptrace$setregs(0xd, r23, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147", 0x81}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r8, @ANYRES32=r10, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r13, @ANYRES32=r3, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r14, @ANYRES32=r4, @ANYRES32=r15, @ANYRES32=r1, @ANYRES32=r16, @ANYRESOCT=r23, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r17, @ANYRES32=r18, @ANYRES32=r19, @ANYBLOB="000000001800000000000000010000000100", @ANYRES32=r20, @ANYRES32=r14, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r22, @ANYRES32=r3], 0x191}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x40) 22:50:44 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, 0x0}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149", 0xa4}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c00000000000000", @ANYRES32=r5, @ANYRES32=r10, @ANYBLOB, @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98", @ANYRES32, @ANYBLOB='(\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r13, @ANYRES32=r4, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r21, @ANYRES32=r3], 0x158}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x40) 22:50:44 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r3}, 0x18, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r5) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r6, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r6, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r6, 0x5501) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b00") socket$inet_udplite(0x2, 0x2, 0x88) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r8, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r8, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r8, 0x5501) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r9, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r9, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r9, 0x5501) r10 = gettid() ptrace$setopts(0x4206, r10, 0x0, 0x0) tkill(r10, 0x3b) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0), &(0x7f0000000600)=0xc) r11 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) gettid() [ 984.063220] [] ? try_to_compact_pages+0x41/0x710 [ 984.063228] [] __alloc_pages_nodemask+0x628/0x1bd0 22:50:44 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r3}, 0x18, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r5) openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) r6 = gettid() tkill(r6, 0x3b) r7 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r7, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r7, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r7, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r7, 0x5501) [ 984.063238] [] ? gfp_pfmemalloc_allowed+0x110/0x110 22:50:44 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r5}, 0x18, 0x0) r6 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r7) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r8, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r8, 0x5501) r9 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r9, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r10 = socket$inet_udplite(0x2, 0x2, 0x88) r11 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={0x0, r1}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r12, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r12, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r12, 0x5501) r13 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r13, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r13, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r13, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r13, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r14 = gettid() ptrace$setopts(0x4206, r14, 0x0, 0x0) tkill(r14, 0x3b) ptrace$setregs(0xd, r14, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r14, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r15}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r17 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x0, 0x0) r18 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r18, 0x401c5504, &(0x7f0000000100)={0x400000100002f}) ioctl$UI_SET_EVBIT(r18, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r18, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r18, 0x5501) r19 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r20 = gettid() ptrace$setopts(0x4206, r20, 0x0, 0x0) tkill(r20, 0x3b) ptrace$setregs(0xffffffffffffffff, r20, 0x0, &(0x7f0000000080)) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce46", 0xa6}, {0x0}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r5, @ANYRES32=r7, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32, @ANYRESHEX=r7, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r10, @ANYRES32, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r11, @ANYRES32=r3, @ANYRES32=r12, @ANYRES32=r1, @ANYRES32=r13, @ANYRESOCT=r20, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r14, @ANYRES32=r15, @ANYRES32=r16, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r17, @ANYRES32=r11, @ANYRES32=r19, @ANYRES32], 0x183}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') tkill(r4, 0x40) 22:50:44 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, 0x0}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149", 0xa4}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c0000000000000001000000", @ANYRES32=r5, @ANYRES32=r10, @ANYBLOB, @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98", @ANYRES32, @ANYBLOB='(\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r13, @ANYRES32=r4, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r21, @ANYRES32=r3], 0x15c}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x40) [ 984.063245] [] ? drop_futex_key_refs.isra.2+0x56/0xd0 22:50:44 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r3}, 0x18, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r5) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r6, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r6, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r6, 0x5501) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b00") socket$inet_udplite(0x2, 0x2, 0x88) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r8, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r8, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r8, 0x5501) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r9, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r9, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r9, 0x5501) r10 = gettid() ptrace$setopts(0x4206, r10, 0x0, 0x0) tkill(r10, 0x3b) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0), &(0x7f0000000600)=0xc) r11 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) gettid() [ 984.063253] [] ? trace_hardirqs_on+0x10/0x10 22:50:44 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0x0, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32, @ANYBLOB], 0x1c) r2 = timerfd_create(0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r7}, 0x18, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r9) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r10, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r10, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r10, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r10, 0x5501) r11 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r11, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x0, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, 0x0) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r16, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, r22, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r6, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce4620162e9d20", 0xab}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r7, @ANYRES32=r9, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r5, @ANYRESHEX=r9, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r12, @ANYRES32=r2, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r13, @ANYRES32=r3, @ANYRES32=r14, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT=r22, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="000000001800000000000000010000", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="180000000000000001000000010000", @ANYRES32=r21, @ANYRES32=r2], 0x18d}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x40) 22:50:44 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r3}, 0x18, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r5) r6 = gettid() tkill(r6, 0x3b) r7 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r7, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r7, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r7, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r7, 0x5501) 22:50:44 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0x0, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r13, 0x1000008912, &(0x7f0000000140)) r14 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) r16 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r16, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r16, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r16, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r16, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r17 = gettid() ptrace$setopts(0x4206, r17, 0x0, 0x0) tkill(r17, 0x3b) ptrace$setregs(0xd, r17, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r17, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r18}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r20 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r21 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r21, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r21, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r21, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r21, 0x5501) r22 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r23 = gettid() ptrace$setopts(0x4206, r23, 0x0, 0x0) tkill(r23, 0x3b) ptrace$setregs(0xd, r23, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147", 0x81}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r8, @ANYRES32=r10, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r13, @ANYRES32=r3, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r14, @ANYRES32=r4, @ANYRES32=r15, @ANYRES32=r1, @ANYRES32=r16, @ANYRESOCT=r23, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r17, @ANYRES32=r18, @ANYRES32=r19, @ANYBLOB="000000001800000000000000010000000100", @ANYRES32=r20, @ANYRES32=r14, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r22, @ANYRES32=r3], 0x191}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x40) [ 984.063262] [] ? futex_wait_setup+0x330/0x330 22:50:44 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, 0x0}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149", 0xa4}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c0000000000000001000000", @ANYRES32=r5, @ANYRES32=r10, @ANYBLOB, @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98", @ANYRES32, @ANYBLOB='(\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r13, @ANYRES32=r4, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r21, @ANYRES32=r3], 0x15c}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x40) 22:50:44 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r3}, 0x18, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r5) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r6, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r6, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r6, 0x5501) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b00") socket$inet_udplite(0x2, 0x2, 0x88) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r8, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r8, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r8, 0x5501) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r9, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r9, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r10 = gettid() ptrace$setopts(0x4206, r10, 0x0, 0x0) tkill(r10, 0x3b) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0), &(0x7f0000000600)=0xc) r11 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) gettid() [ 984.063269] [] ? mark_held_locks+0xc7/0x130 22:50:44 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0x0, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32, @ANYBLOB], 0x1c) r2 = timerfd_create(0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r7}, 0x18, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r9) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r10, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r10, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r10, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r10, 0x5501) r11 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r11, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x0, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, 0x0) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r16, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, r22, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r6, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce4620162e9d20", 0xab}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r7, @ANYRES32=r9, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r5, @ANYRESHEX=r9, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r12, @ANYRES32=r2, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r13, @ANYRES32=r3, @ANYRES32=r14, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT=r22, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="000000001800000000000000010000", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="180000000000000001000000010000", @ANYRES32=r21, @ANYRES32=r2], 0x18d}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x40) 22:50:44 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r5}, 0x18, 0x0) r6 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r7) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r8, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r8, 0x5501) r9 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r9, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r10 = socket$inet_udplite(0x2, 0x2, 0x88) r11 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={0x0, r1}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r12, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r12, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r12, 0x5501) r13 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r13, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r13, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r13, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r13, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r14 = gettid() ptrace$setopts(0x4206, r14, 0x0, 0x0) tkill(r14, 0x3b) ptrace$setregs(0xd, r14, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r14, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r15}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r17 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x0, 0x0) r18 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r18, 0x401c5504, &(0x7f0000000100)={0x400000100002f}) ioctl$UI_SET_EVBIT(r18, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r18, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r18, 0x5501) r19 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r20 = gettid() ptrace$setopts(0x4206, r20, 0x0, 0x0) tkill(r20, 0x3b) ptrace$setregs(0xffffffffffffffff, r20, 0x0, &(0x7f0000000080)) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce46", 0xa6}, {0x0}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r5, @ANYRES32=r7, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32, @ANYRESHEX=r7, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r10, @ANYRES32, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r11, @ANYRES32=r3, @ANYRES32=r12, @ANYRES32=r1, @ANYRES32=r13, @ANYRESOCT=r20, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r14, @ANYRES32=r15, @ANYRES32=r16, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r17, @ANYRES32=r11, @ANYRES32=r19, @ANYRES32], 0x183}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') tkill(r4, 0x40) 22:50:44 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r3}, 0x18, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000040), &(0x7f0000000080)=0xc) r5 = gettid() tkill(r5, 0x3b) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r6, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r6, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r6, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r6, 0x5501) [ 984.063279] [] ? mutex_lock_interruptible_nested+0x7f3/0x9c0 [ 984.063287] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 984.063295] [] kmalloc_order+0x2a/0x70 22:50:44 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, 0x0}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149", 0xa4}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c0000000000000001000000", @ANYRES32=r5, @ANYRES32=r10, @ANYBLOB, @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98", @ANYRES32, @ANYBLOB='(\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r13, @ANYRES32=r4, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r21, @ANYRES32=r3], 0x15c}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x40) 22:50:44 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0x0, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r13, 0x1000008912, &(0x7f0000000140)) r14 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) r16 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r16, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r16, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r16, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r16, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r17 = gettid() ptrace$setopts(0x4206, r17, 0x0, 0x0) tkill(r17, 0x3b) ptrace$setregs(0xd, r17, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r17, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r18}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r20 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r21 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r21, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r21, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r21, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r21, 0x5501) r22 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r23 = gettid() ptrace$setopts(0x4206, r23, 0x0, 0x0) tkill(r23, 0x3b) ptrace$setregs(0xd, r23, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147", 0x81}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r8, @ANYRES32=r10, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r13, @ANYRES32=r3, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r14, @ANYRES32=r4, @ANYRES32=r15, @ANYRES32=r1, @ANYRES32=r16, @ANYRESOCT=r23, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r17, @ANYRES32=r18, @ANYRES32=r19, @ANYBLOB="000000001800000000000000010000000100", @ANYRES32=r20, @ANYRES32=r14, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r22, @ANYRES32=r3], 0x191}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x40) [ 984.063303] [] kmalloc_order_trace+0x1f/0x190 22:50:44 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0x0, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32, @ANYBLOB], 0x1c) r2 = timerfd_create(0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r7}, 0x18, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r9) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r10, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r10, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r10, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r10, 0x5501) r11 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r11, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x0, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, 0x0) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r16, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, r22, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r6, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce4620162e9d20", 0xab}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r7, @ANYRES32=r9, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r5, @ANYRESHEX=r9, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r12, @ANYRES32=r2, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r13, @ANYRES32=r3, @ANYRES32=r14, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT=r22, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="000000001800000000000000010000000100", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="180000000000000001000000010000", @ANYRES32=r21, @ANYRES32=r2], 0x190}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x40) 22:50:44 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r3}, 0x18, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r5) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r6, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r6, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r6, 0x5501) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b00") socket$inet_udplite(0x2, 0x2, 0x88) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r8, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r8, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r8, 0x5501) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r9, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r9, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r10 = gettid() ptrace$setopts(0x4206, r10, 0x0, 0x0) tkill(r10, 0x3b) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0), &(0x7f0000000600)=0xc) r11 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) gettid() 22:50:44 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r3}, 0x18, 0x0) socket$packet(0x11, 0x2, 0x300) r4 = gettid() tkill(r4, 0x3b) r5 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r5, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r5, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r5, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r5, 0x5501) [ 984.063311] [] __kmalloc+0x1ae/0x310 [ 984.063321] [] ? avc_has_extended_perms+0x56a/0xd90 [ 984.063336] [] ? avc_has_extended_perms+0xde/0xd90 22:50:44 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r5}, 0x18, 0x0) r6 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r7) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r8, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r8, 0x5501) r9 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r9, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r10 = socket$inet_udplite(0x2, 0x2, 0x88) r11 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={0x0, r1}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r12, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r12, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r12, 0x5501) r13 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r13, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r13, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r13, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r13, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r14 = gettid() ptrace$setopts(0x4206, r14, 0x0, 0x0) tkill(r14, 0x3b) ptrace$setregs(0xd, r14, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r14, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r15}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r17 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x0, 0x0) r18 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r18, 0x401c5504, &(0x7f0000000100)={0x400000100002f}) ioctl$UI_SET_EVBIT(r18, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r18, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r18, 0x5501) r19 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r20 = gettid() ptrace$setopts(0x4206, r20, 0x0, 0x0) tkill(r20, 0x3b) ptrace$setregs(0xffffffffffffffff, r20, 0x0, &(0x7f0000000080)) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce46", 0xa6}, {0x0}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r5, @ANYRES32=r7, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32, @ANYRESHEX=r7, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r10, @ANYRES32, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r11, @ANYRES32=r3, @ANYRES32=r12, @ANYRES32=r1, @ANYRES32=r13, @ANYRESOCT=r20, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r14, @ANYRES32=r15, @ANYRES32=r16, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r17, @ANYRES32=r11, @ANYRES32=r19, @ANYRES32], 0x183}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') tkill(r4, 0x40) 22:50:44 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, 0x0}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149", 0xa4}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c00000000000000010000000200", @ANYRES32=r5, @ANYRES32=r10, @ANYBLOB, @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98", @ANYRES32, @ANYBLOB='(\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r13, @ANYRES32=r4, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r21, @ANYRES32=r3], 0x15e}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x40) 22:50:44 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0x0, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r13, 0x1000008912, &(0x7f0000000140)) r14 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) r16 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r16, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r16, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r16, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r16, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r17 = gettid() ptrace$setopts(0x4206, r17, 0x0, 0x0) tkill(r17, 0x3b) ptrace$setregs(0xd, r17, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r17, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r18}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r20 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r21 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r21, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r21, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r21, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r21, 0x5501) r22 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r23 = gettid() ptrace$setopts(0x4206, r23, 0x0, 0x0) tkill(r23, 0x3b) ptrace$setregs(0xd, r23, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147", 0x81}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r8, @ANYRES32=r10, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r13, @ANYRES32=r3, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r14, @ANYRES32=r4, @ANYRES32=r15, @ANYRES32=r1, @ANYRES32=r16, @ANYRESOCT=r23, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r17, @ANYRES32=r18, @ANYRES32=r19, @ANYBLOB="00000000180000000000000001000000010000", @ANYRES32=r20, @ANYRES32=r14, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r22, @ANYRES32=r3], 0x192}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x40) 22:50:44 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0x0, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32, @ANYBLOB], 0x1c) r2 = timerfd_create(0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r7}, 0x18, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r9) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r10, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r10, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r10, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r10, 0x5501) r11 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r11, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x0, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, 0x0) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r16, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, r22, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r6, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce4620162e9d20", 0xab}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r7, @ANYRES32=r9, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r5, @ANYRESHEX=r9, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r12, @ANYRES32=r2, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r13, @ANYRES32=r3, @ANYRES32=r14, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT=r22, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="000000001800000000000000010000000100", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="180000000000000001000000010000", @ANYRES32=r21, @ANYRES32=r2], 0x190}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x40) 22:50:44 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r3}, 0x18, 0x0) socket$packet(0x11, 0x2, 0x300) r4 = gettid() tkill(r4, 0x3b) r5 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r5, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r5, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r5, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r5, 0x5501) [ 984.063346] [] input_mt_init_slots+0xcb/0x400 [ 984.063357] [] uinput_ioctl_handler.isra.4+0x161d/0x1980 22:50:44 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r3}, 0x18, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r5) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r6, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r6, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r6, 0x5501) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b00") socket$inet_udplite(0x2, 0x2, 0x88) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r8, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r8, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r8, 0x5501) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r9, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x3) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r10 = gettid() ptrace$setopts(0x4206, r10, 0x0, 0x0) tkill(r10, 0x3b) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0), &(0x7f0000000600)=0xc) r11 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) gettid() [ 984.063364] [] ? avc_ss_reset+0x110/0x110 22:50:45 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, 0x0}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149", 0xa4}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c00000000000000010000000200", @ANYRES32=r5, @ANYRES32=r10, @ANYBLOB, @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98", @ANYRES32, @ANYBLOB='(\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r13, @ANYRES32=r4, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r21, @ANYRES32=r3], 0x15e}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x40) 22:50:45 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0x0, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r13, 0x1000008912, &(0x7f0000000140)) r14 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) r16 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r16, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r16, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r16, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r16, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r17 = gettid() ptrace$setopts(0x4206, r17, 0x0, 0x0) tkill(r17, 0x3b) ptrace$setregs(0xd, r17, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r17, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r18}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r20 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r21 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r21, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r21, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r21, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r21, 0x5501) r22 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r23 = gettid() ptrace$setopts(0x4206, r23, 0x0, 0x0) tkill(r23, 0x3b) ptrace$setregs(0xd, r23, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147", 0x81}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r8, @ANYRES32=r10, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r13, @ANYRES32=r3, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r14, @ANYRES32=r4, @ANYRES32=r15, @ANYRES32=r1, @ANYRES32=r16, @ANYRESOCT=r23, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r17, @ANYRES32=r18, @ANYRES32=r19, @ANYBLOB="00000000180000000000000001000000010000", @ANYRES32=r20, @ANYRES32=r14, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r22, @ANYRES32=r3], 0x192}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x40) [ 984.063373] [] ? uinput_ff_upload_from_user+0x350/0x350 [ 984.063380] [] ? __lock_acquire+0x654/0x4a10 22:50:45 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r3}, 0x18, 0x0) r4 = gettid() tkill(r4, 0x3b) r5 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r5, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r5, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r5, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r5, 0x5501) 22:50:45 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0x0, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32, @ANYBLOB], 0x1c) r2 = timerfd_create(0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r7}, 0x18, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r9) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r10, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r10, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r10, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r10, 0x5501) r11 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r11, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x0, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, 0x0) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r16, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, r22, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r6, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce4620162e9d20", 0xab}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r7, @ANYRES32=r9, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r5, @ANYRESHEX=r9, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r12, @ANYRES32=r2, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r13, @ANYRES32=r3, @ANYRES32=r14, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT=r22, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="000000001800000000000000010000000100", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="180000000000000001000000010000", @ANYRES32=r21, @ANYRES32=r2], 0x190}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x40) 22:50:45 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r3}, 0x18, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r5) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r6, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r6, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r6, 0x5501) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b00") socket$inet_udplite(0x2, 0x2, 0x88) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r8, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r8, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r8, 0x5501) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r9, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x3) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r10 = gettid() ptrace$setopts(0x4206, r10, 0x0, 0x0) tkill(r10, 0x3b) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0), &(0x7f0000000600)=0xc) r11 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) gettid() [ 984.063389] [] uinput_ioctl+0x4c/0x60 22:50:45 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r5}, 0x18, 0x0) r6 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r7) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r8, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r8, 0x5501) r9 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r9, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r10 = socket$inet_udplite(0x2, 0x2, 0x88) r11 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={0x0, r1}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r12, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r12, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r12, 0x5501) r13 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r13, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r13, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r13, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r13, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r14 = gettid() ptrace$setopts(0x4206, r14, 0x0, 0x0) tkill(r14, 0x3b) ptrace$setregs(0xd, r14, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r14, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r15}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r17 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x0, 0x0) r18 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r18, 0x401c5504, &(0x7f0000000100)={0x400000100002f}) ioctl$UI_SET_EVBIT(r18, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r18, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r18, 0x5501) r19 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r20 = gettid() ptrace$setopts(0x4206, r20, 0x0, 0x0) tkill(r20, 0x3b) ptrace$setregs(0xffffffffffffffff, r20, 0x0, &(0x7f0000000080)) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce46", 0xa6}, {0x0}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r5, @ANYRES32=r7, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32, @ANYRESHEX=r7, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r10, @ANYRES32, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r11, @ANYRES32=r3, @ANYRES32=r12, @ANYRES32=r1, @ANYRES32=r13, @ANYRESOCT=r20, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r14, @ANYRES32=r15, @ANYRES32=r16, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r17, @ANYRES32=r11, @ANYBLOB, @ANYRES32=r19, @ANYRES32], 0x183}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') tkill(r4, 0x40) [ 984.063397] [] ? uinput_compat_ioctl+0x80/0x80 [ 984.063405] [] do_vfs_ioctl+0x1ac/0x11a0 22:50:45 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)) r3 = gettid() tkill(r3, 0x3b) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r4, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r4, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r4, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r4, 0x5501) [ 984.063413] [] ? ioctl_preallocate+0x220/0x220 22:50:45 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0x0, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32, @ANYBLOB], 0x1c) r2 = timerfd_create(0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r7}, 0x18, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r9) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r10, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r10, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r10, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r10, 0x5501) r11 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r11, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x0, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, 0x0) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r16, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, r22, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r6, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce4620162e9d20", 0xab}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r7, @ANYRES32=r9, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r5, @ANYRESHEX=r9, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r12, @ANYRES32=r2, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r13, @ANYRES32=r3, @ANYRES32=r14, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT=r22, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="00000000180000000000000001000000010000", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="180000000000000001000000010000", @ANYRES32=r21, @ANYRES32=r2], 0x191}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x40) 22:50:45 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r3}, 0x18, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r5) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r6, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r6, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r6, 0x5501) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b00") socket$inet_udplite(0x2, 0x2, 0x88) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r8, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r8, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r8, 0x5501) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r9, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x3) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r10 = gettid() ptrace$setopts(0x4206, r10, 0x0, 0x0) tkill(r10, 0x3b) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0), &(0x7f0000000600)=0xc) r11 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) gettid() 22:50:45 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, 0x0}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149", 0xa4}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c00000000000000010000000200", @ANYRES32=r5, @ANYRES32=r10, @ANYBLOB, @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98", @ANYRES32, @ANYBLOB='(\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r13, @ANYRES32=r4, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r21, @ANYRES32=r3], 0x15e}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x40) [ 984.063422] [] ? selinux_parse_skb.constprop.42+0x1a90/0x1a90 [ 984.063430] [] ? check_preemption_disabled+0x3b/0x200 [ 984.063436] [] ? __fget+0x214/0x3d0 22:50:45 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0x0, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r13, 0x1000008912, &(0x7f0000000140)) r14 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) r16 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r16, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r16, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r16, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r16, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r17 = gettid() ptrace$setopts(0x4206, r17, 0x0, 0x0) tkill(r17, 0x3b) ptrace$setregs(0xd, r17, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r17, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r18}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r20 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r21 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r21, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r21, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r21, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r21, 0x5501) r22 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r23 = gettid() ptrace$setopts(0x4206, r23, 0x0, 0x0) tkill(r23, 0x3b) ptrace$setregs(0xd, r23, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147", 0x81}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r8, @ANYRES32=r10, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r13, @ANYRES32=r3, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r14, @ANYRES32=r4, @ANYRES32=r15, @ANYRES32=r1, @ANYRES32=r16, @ANYRESOCT=r23, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r17, @ANYRES32=r18, @ANYRES32=r19, @ANYBLOB="00000000180000000000000001000000010000", @ANYRES32=r20, @ANYRES32=r14, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r22, @ANYRES32=r3], 0x192}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x40) 22:50:45 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r5}, 0x18, 0x0) r6 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r7) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r8, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r8, 0x5501) r9 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r9, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r10 = socket$inet_udplite(0x2, 0x2, 0x88) r11 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={0x0, r1}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r12, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r12, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r12, 0x5501) r13 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r13, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r13, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r13, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r13, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r14 = gettid() ptrace$setopts(0x4206, r14, 0x0, 0x0) tkill(r14, 0x3b) ptrace$setregs(0xd, r14, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r14, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r15}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r17 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x0, 0x0) r18 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r18, 0x401c5504, &(0x7f0000000100)={0x400000100002f}) ioctl$UI_SET_EVBIT(r18, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r18, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r18, 0x5501) r19 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r20 = gettid() ptrace$setopts(0x4206, r20, 0x0, 0x0) tkill(r20, 0x3b) ptrace$setregs(0xffffffffffffffff, r20, 0x0, &(0x7f0000000080)) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce46", 0xa6}, {0x0}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r5, @ANYRES32=r7, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32, @ANYRESHEX=r7, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r10, @ANYRES32, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r11, @ANYRES32=r3, @ANYRES32=r12, @ANYRES32=r1, @ANYRES32=r13, @ANYRESOCT=r20, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r14, @ANYRES32=r15, @ANYRES32=r16, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r17, @ANYRES32=r11, @ANYBLOB, @ANYRES32=r19, @ANYRES32], 0x183}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') tkill(r4, 0x40) [ 984.063453] [] ? __fget+0x23b/0x3d0 [ 984.063461] [] ? __fget+0x47/0x3d0 22:50:45 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)) r3 = gettid() tkill(r3, 0x3b) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r4, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r4, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r4, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r4, 0x5501) [ 984.063470] [] ? security_file_ioctl+0x8f/0xc0 22:50:45 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0x0, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r13, 0x1000008912, &(0x7f0000000140)) r14 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) r16 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r16, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r16, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r16, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r16, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r17 = gettid() ptrace$setopts(0x4206, r17, 0x0, 0x0) tkill(r17, 0x3b) ptrace$setregs(0xd, r17, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r17, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r18}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0), &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, r22, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147", 0x81}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r8, @ANYRES32=r10, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r13, @ANYRES32=r3, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r14, @ANYRES32=r4, @ANYRES32=r15, @ANYRES32=r1, @ANYRES32=r16, @ANYRESOCT=r22, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r19, @ANYRES32=r14, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r21, @ANYRES32=r3], 0x18f}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x40) 22:50:45 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, 0x0}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149", 0xa4}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c0000000000000001000000020000", @ANYRES32=r5, @ANYRES32=r10, @ANYBLOB, @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98", @ANYRES32, @ANYBLOB='(\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r13, @ANYRES32=r4, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r21, @ANYRES32=r3], 0x15f}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x40) 22:50:45 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0x0, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32, @ANYBLOB], 0x1c) r2 = timerfd_create(0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r7}, 0x18, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r9) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r10, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r10, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r10, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r10, 0x5501) r11 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r11, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x0, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, 0x0) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r16, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, r22, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r6, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce4620162e9d20", 0xab}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r7, @ANYRES32=r9, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r5, @ANYRESHEX=r9, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r12, @ANYRES32=r2, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r13, @ANYRES32=r3, @ANYRES32=r14, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT=r22, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="000000001800000000000000010000000100", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="180000000000000001000000010000", @ANYRES32=r21, @ANYRES32=r2], 0x190}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x40) 22:50:45 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r3}, 0x18, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r5) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r6, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r6, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r6, 0x5501) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b00") socket$inet_udplite(0x2, 0x2, 0x88) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r8, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r8, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r8, 0x5501) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r9, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r10 = gettid() ptrace$setopts(0x4206, r10, 0x0, 0x0) tkill(r10, 0x3b) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0), &(0x7f0000000600)=0xc) r11 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) gettid() [ 984.063478] [] SyS_ioctl+0x8f/0xc0 [ 984.063486] [] ? do_vfs_ioctl+0x11a0/0x11a0 22:50:45 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) r3 = gettid() tkill(r3, 0x3b) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r4, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r4, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r4, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r4, 0x5501) [ 984.063496] [] do_syscall_64+0x19f/0x550 [ 984.063507] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb 22:50:45 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0x0, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r13, 0x1000008912, &(0x7f0000000140)) r14 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) r16 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r16, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r16, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r16, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r16, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r17 = gettid() ptrace$setopts(0x4206, r17, 0x0, 0x0) tkill(r17, 0x3b) ptrace$setregs(0xd, r17, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r17, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r18}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0), &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, r22, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147", 0x81}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r8, @ANYRES32=r10, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r13, @ANYRES32=r3, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r14, @ANYRES32=r4, @ANYRES32=r15, @ANYRES32=r1, @ANYRES32=r16, @ANYRESOCT=r22, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r19, @ANYRES32=r14, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r21, @ANYRES32=r3], 0x18f}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x40) 22:50:45 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r5}, 0x18, 0x0) r6 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r7) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r8, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r8, 0x5501) r9 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r9, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r10 = socket$inet_udplite(0x2, 0x2, 0x88) r11 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={0x0, r1}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r12, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r12, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r12, 0x5501) r13 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r13, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r13, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r13, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r13, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r14 = gettid() ptrace$setopts(0x4206, r14, 0x0, 0x0) tkill(r14, 0x3b) ptrace$setregs(0xd, r14, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r14, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r15}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r17 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x0, 0x0) r18 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r18, 0x401c5504, &(0x7f0000000100)={0x400000100002f}) ioctl$UI_SET_EVBIT(r18, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r18, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r18, 0x5501) r19 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r20 = gettid() ptrace$setopts(0x4206, r20, 0x0, 0x0) tkill(r20, 0x3b) ptrace$setregs(0xffffffffffffffff, r20, 0x0, &(0x7f0000000080)) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce46", 0xa6}, {0x0}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r5, @ANYRES32=r7, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32, @ANYRESHEX=r7, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r10, @ANYRES32, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r11, @ANYRES32=r3, @ANYRES32=r12, @ANYRES32=r1, @ANYRES32=r13, @ANYRESOCT=r20, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r14, @ANYRES32=r15, @ANYRES32=r16, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r17, @ANYRES32=r11, @ANYBLOB, @ANYRES32=r19, @ANYRES32], 0x183}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') tkill(r4, 0x40) 22:50:45 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0x0, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32, @ANYBLOB], 0x1c) r2 = timerfd_create(0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r7}, 0x18, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r9) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r10, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r10, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r10, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r10, 0x5501) r11 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r11, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x0, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, 0x0) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r16, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, r22, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r6, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce4620162e9d20", 0xab}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r7, @ANYRES32=r9, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r5, @ANYRESHEX=r9, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r12, @ANYRES32=r2, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r13, @ANYRES32=r3, @ANYRES32=r14, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT=r22, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="000000001800000000000000010000000100", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="180000000000000001000000010000", @ANYRES32=r21, @ANYRES32=r2], 0x190}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x40) 22:50:45 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, 0x0}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149", 0xa4}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c0000000000000001000000020000", @ANYRES32=r5, @ANYRES32=r10, @ANYBLOB, @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98", @ANYRES32, @ANYBLOB='(\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r13, @ANYRES32=r4, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r21, @ANYRES32=r3], 0x15f}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x40) [ 984.064265] Mem-Info: [ 984.064288] active_anon:788218 inactive_anon:64297 isolated_anon:9 [ 984.064288] active_file:1272 inactive_file:872 isolated_file:32 [ 984.064288] unevictable:4 dirty:234 writeback:0 unstable:0 [ 984.064288] slab_reclaimable:9975 slab_unreclaimable:88824 [ 984.064288] mapped:71405 shmem:175140 pagetables:30141 bounce:0 [ 984.064288] free:36940 free_pcp:0 free_cma:0 22:50:45 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) r3 = gettid() tkill(r3, 0x3b) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r4, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r4, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r4, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r4, 0x5501) 22:50:45 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r3}, 0x18, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r5) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r6, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r6, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r6, 0x5501) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b00") socket$inet_udplite(0x2, 0x2, 0x88) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r8, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r8, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r8, 0x5501) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r9, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r10 = gettid() ptrace$setopts(0x4206, r10, 0x0, 0x0) tkill(r10, 0x3b) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0), &(0x7f0000000600)=0xc) r11 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) gettid() 22:50:45 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, 0x0}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149", 0xa4}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c0000000000000001000000020000", @ANYRES32=r5, @ANYRES32=r10, @ANYBLOB, @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98", @ANYRES32, @ANYBLOB='(\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r13, @ANYRES32=r4, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r21, @ANYRES32=r3], 0x15f}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x40) 22:50:45 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0x0, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r13, 0x1000008912, &(0x7f0000000140)) r14 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) r16 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r16, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r16, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r16, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r16, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r17 = gettid() ptrace$setopts(0x4206, r17, 0x0, 0x0) tkill(r17, 0x3b) ptrace$setregs(0xd, r17, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r17, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r18}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0), &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, r22, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147", 0x81}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r8, @ANYRES32=r10, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r13, @ANYRES32=r3, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r14, @ANYRES32=r4, @ANYRES32=r15, @ANYRES32=r1, @ANYRES32=r16, @ANYRESOCT=r22, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r19, @ANYRES32=r14, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r21, @ANYRES32=r3], 0x18f}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x40) 22:50:45 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0x0, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32, @ANYBLOB], 0x1c) r2 = timerfd_create(0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r7}, 0x18, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r9) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r10, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r10, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r10, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r10, 0x5501) r11 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r11, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x0, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, 0x0) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r16, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, r22, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r6, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce4620162e9d20", 0xab}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r7, @ANYRES32=r9, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r5, @ANYRESHEX=r9, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r12, @ANYRES32=r2, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r13, @ANYRES32=r3, @ANYRES32=r14, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT=r22, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="000000001800000000000000010000000100", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="180000000000000001000000010000", @ANYRES32=r21, @ANYRES32=r2], 0x190}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x40) 22:50:45 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r5}, 0x18, 0x0) r6 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r7) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r8, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r8, 0x5501) r9 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r9, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r10 = socket$inet_udplite(0x2, 0x2, 0x88) r11 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={0x0, r1}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r12, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r12, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r12, 0x5501) r13 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r13, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r13, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r13, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r13, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r14 = gettid() ptrace$setopts(0x4206, r14, 0x0, 0x0) tkill(r14, 0x3b) ptrace$setregs(0xd, r14, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r14, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r15}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r17 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x0, 0x0) r18 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r18, 0x401c5504, &(0x7f0000000100)={0x400000100002f}) ioctl$UI_SET_EVBIT(r18, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r18, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r18, 0x5501) r19 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r20 = gettid() ptrace$setopts(0x4206, r20, 0x0, 0x0) tkill(r20, 0x3b) ptrace$setregs(0xffffffffffffffff, r20, 0x0, &(0x7f0000000080)) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce46", 0xa6}, {0x0}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r5, @ANYRES32=r7, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32, @ANYRESHEX=r7, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r10, @ANYRES32, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r11, @ANYRES32=r3, @ANYRES32=r12, @ANYRES32=r1, @ANYRES32=r13, @ANYRESOCT=r20, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r14, @ANYRES32=r15, @ANYRES32=r16, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r17, @ANYRES32=r11, @ANYBLOB="1800000000000000", @ANYRES32=r19, @ANYRES32], 0x18b}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') tkill(r4, 0x40) [ 984.064306] Node 0 active_anon:3152872kB inactive_anon:257188kB active_file:5088kB inactive_file:3488kB unevictable:16kB isolated(anon):36kB isolated(file):128kB mapped:285620kB dirty:936kB writeback:0kB shmem:700560kB writeback_tmp:0kB unstable:0kB pages_scanned:0 all_unreclaimable? no 22:50:45 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() r3 = gettid() tkill(r3, 0x3b) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r4, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r4, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r4, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r4, 0x5501) 22:50:46 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() r3 = gettid() tkill(r3, 0x3b) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r4, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r4, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r4, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r4, 0x5501) 22:50:46 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, 0x0}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149", 0xa4}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r10, @ANYBLOB, @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98", @ANYRES32, @ANYBLOB='(\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r13, @ANYRES32=r4, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r21, @ANYRES32=r3], 0x160}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x40) 22:50:46 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0x0, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r13, 0x1000008912, &(0x7f0000000140)) r14 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) r16 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r16, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r16, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r16, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r16, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r17 = gettid() ptrace$setopts(0x4206, r17, 0x0, 0x0) tkill(r17, 0x3b) ptrace$setregs(0xd, r17, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r17, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r18}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0), &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, r22, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147", 0x81}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r8, @ANYRES32=r10, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r13, @ANYRES32=r3, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r14, @ANYRES32=r4, @ANYRES32=r15, @ANYRES32=r1, @ANYRES32=r16, @ANYRESOCT=r22, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r17, @ANYRES32=r18, @ANYRES32, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r19, @ANYRES32=r14, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r21, @ANYRES32=r3], 0x193}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x40) 22:50:46 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0x0, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32, @ANYBLOB], 0x1c) r2 = timerfd_create(0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r7}, 0x18, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r9) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r10, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r10, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r10, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r10, 0x5501) r11 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r11, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x0, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, 0x0) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r16, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0), &(0x7f0000000600)=0xc) r18 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r19, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r19, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r19, 0x5501) r20 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r21 = gettid() ptrace$setopts(0x4206, r21, 0x0, 0x0) tkill(r21, 0x3b) ptrace$setregs(0xd, r21, 0x0, &(0x7f0000000080)) sendmsg$unix(r6, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce4620162e9d20", 0xab}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r7, @ANYRES32=r9, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r5, @ANYRESHEX=r9, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r12, @ANYRES32=r2, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r13, @ANYRES32=r3, @ANYRES32=r14, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT=r21, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r17, @ANYBLOB="00000000180000000000000001000000010000", @ANYRES32=r18, @ANYRES32=r13, @ANYBLOB="180000000000000001000000010000", @ANYRES32=r20, @ANYRES32=r2], 0x18d}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x40) 22:50:46 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r3}, 0x18, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r5) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r6, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r6, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r6, 0x5501) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b00") socket$inet_udplite(0x2, 0x2, 0x88) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r8, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r8, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r8, 0x5501) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r9, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r10 = gettid() ptrace$setopts(0x4206, r10, 0x0, 0x0) tkill(r10, 0x3b) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0), &(0x7f0000000600)=0xc) r11 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) gettid() [ 984.064331] DMA32 free:138240kB min:4696kB low:7712kB high:10728kB active_anon:522488kB inactive_anon:26840kB active_file:2124kB inactive_file:2848kB unevictable:0kB writepending:456kB present:3145324kB managed:3020132kB mlocked:0kB slab_reclaimable:9060kB slab_unreclaimable:141428kB kernel_stack:14752kB pagetables:32316kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB 22:50:46 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() r3 = gettid() tkill(r3, 0x3b) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r4, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r4, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r4, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r4, 0x5501) 22:50:46 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, 0x0}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149", 0xa4}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r10, @ANYBLOB, @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98", @ANYRES32, @ANYBLOB='(\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r13, @ANYRES32=r4, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r21, @ANYRES32=r3], 0x160}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x40) 22:50:46 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0x0, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r13, 0x1000008912, &(0x7f0000000140)) r14 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) r16 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r16, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r16, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r16, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r16, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r17 = gettid() ptrace$setopts(0x4206, r17, 0x0, 0x0) tkill(r17, 0x3b) ptrace$setregs(0xd, r17, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r17, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r18}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0), &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, r22, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147", 0x81}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r8, @ANYRES32=r10, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r13, @ANYRES32=r3, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r14, @ANYRES32=r4, @ANYRES32=r15, @ANYRES32=r1, @ANYRES32=r16, @ANYRESOCT=r22, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r17, @ANYRES32=r18, @ANYRES32, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r19, @ANYRES32=r14, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r21, @ANYRES32=r3], 0x193}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x40) 22:50:46 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r5}, 0x18, 0x0) r6 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r7) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r8, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r8, 0x5501) r9 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r9, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r10 = socket$inet_udplite(0x2, 0x2, 0x88) r11 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={0x0, r1}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r12, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r12, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r12, 0x5501) r13 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r13, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r13, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r13, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r13, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r14 = gettid() ptrace$setopts(0x4206, r14, 0x0, 0x0) tkill(r14, 0x3b) ptrace$setregs(0xd, r14, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r14, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r15}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r17 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x0, 0x0) r18 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r18, 0x401c5504, &(0x7f0000000100)={0x400000100002f}) ioctl$UI_SET_EVBIT(r18, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r18, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r18, 0x5501) r19 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r20 = gettid() ptrace$setopts(0x4206, r20, 0x0, 0x0) tkill(r20, 0x3b) ptrace$setregs(0xffffffffffffffff, r20, 0x0, &(0x7f0000000080)) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce46", 0xa6}, {0x0}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r5, @ANYRES32=r7, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32, @ANYRESHEX=r7, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r10, @ANYRES32, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r11, @ANYRES32=r3, @ANYRES32=r12, @ANYRES32=r1, @ANYRES32=r13, @ANYRESOCT=r20, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r14, @ANYRES32=r15, @ANYRES32=r16, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r17, @ANYRES32=r11, @ANYBLOB="1800000000000000", @ANYRES32=r19, @ANYRES32], 0x18b}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') tkill(r4, 0x40) lowmem_reserve[]: 0 3505 3505 22:50:46 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0x0, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32, @ANYBLOB], 0x1c) r2 = timerfd_create(0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r7}, 0x18, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r9) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r10, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r10, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r10, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r10, 0x5501) r11 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r11, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x0, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, 0x0) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r16, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0), &(0x7f0000000600)=0xc) r18 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r19, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r19, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r19, 0x5501) r20 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r21 = gettid() ptrace$setopts(0x4206, r21, 0x0, 0x0) tkill(r21, 0x3b) ptrace$setregs(0xd, r21, 0x0, &(0x7f0000000080)) sendmsg$unix(r6, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce4620162e9d20", 0xab}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r7, @ANYRES32=r9, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r5, @ANYRESHEX=r9, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r12, @ANYRES32=r2, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r13, @ANYRES32=r3, @ANYRES32=r14, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT=r21, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r17, @ANYBLOB="00000000180000000000000001000000010000", @ANYRES32=r18, @ANYRES32=r13, @ANYBLOB="180000000000000001000000010000", @ANYRES32=r20, @ANYRES32=r2], 0x18d}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x40) 22:50:46 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) r3 = gettid() tkill(r3, 0x3b) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r4, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r4, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r4, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r4, 0x5501) [ 984.064363] Normal free:9520kB min:5580kB low:9168kB high:12756kB active_anon:2630584kB inactive_anon:230348kB active_file:3056kB inactive_file:688kB unevictable:16kB writepending:480kB present:4718592kB managed:3589316kB mlocked:16kB slab_reclaimable:30840kB slab_unreclaimable:213868kB kernel_stack:26048kB pagetables:88248kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB 22:50:46 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r3}, 0x18, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r5) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r6, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r6, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r6, 0x5501) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b00") socket$inet_udplite(0x2, 0x2, 0x88) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r8, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r8, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r8, 0x5501) openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r9 = gettid() ptrace$setopts(0x4206, r9, 0x0, 0x0) tkill(r9, 0x3b) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0), &(0x7f0000000600)=0xc) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r10, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r10, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r10, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r10, 0x5501) gettid() 22:50:46 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, 0x0}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149", 0xa4}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r10, @ANYBLOB, @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98", @ANYRES32, @ANYBLOB='(\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r13, @ANYRES32=r4, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r21, @ANYRES32=r3], 0x160}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x40) 22:50:46 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) wait4(0x0, 0x0, 0x80000000, 0x0) r3 = gettid() tkill(r3, 0x3b) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r4, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r4, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r4, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r4, 0x5501) 22:50:46 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0x0, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32, @ANYBLOB], 0x1c) r2 = timerfd_create(0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r7}, 0x18, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r9) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r10, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r10, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r10, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r10, 0x5501) r11 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r11, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x0, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, 0x0) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r16, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0), &(0x7f0000000600)=0xc) r18 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r19, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r19, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r19, 0x5501) r20 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r21 = gettid() ptrace$setopts(0x4206, r21, 0x0, 0x0) tkill(r21, 0x3b) ptrace$setregs(0xd, r21, 0x0, &(0x7f0000000080)) sendmsg$unix(r6, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce4620162e9d20", 0xab}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r7, @ANYRES32=r9, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r5, @ANYRESHEX=r9, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r12, @ANYRES32=r2, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r13, @ANYRES32=r3, @ANYRES32=r14, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT=r21, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r17, @ANYBLOB="00000000180000000000000001000000010000", @ANYRES32=r18, @ANYRES32=r13, @ANYBLOB="180000000000000001000000010000", @ANYRES32=r20, @ANYRES32=r2], 0x18d}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x40) 22:50:46 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0x0, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r13, 0x1000008912, &(0x7f0000000140)) r14 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) r16 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r16, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r16, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r16, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r16, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r17 = gettid() ptrace$setopts(0x4206, r17, 0x0, 0x0) tkill(r17, 0x3b) ptrace$setregs(0xd, r17, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r17, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r18}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0), &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, r22, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147", 0x81}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r8, @ANYRES32=r10, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r13, @ANYRES32=r3, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r14, @ANYRES32=r4, @ANYRES32=r15, @ANYRES32=r1, @ANYRES32=r16, @ANYRESOCT=r22, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r17, @ANYRES32=r18, @ANYRES32, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r19, @ANYRES32=r14, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r21, @ANYRES32=r3], 0x193}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x40) 22:50:46 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) wait4(0x0, 0x0, 0x80000000, 0x0) r3 = gettid() tkill(r3, 0x3b) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r4, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r4, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r4, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r4, 0x5501) 22:50:46 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0x0, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r13, 0x1000008912, &(0x7f0000000140)) r14 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) r16 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r16, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r16, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r16, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r16, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r17 = gettid() ptrace$setopts(0x4206, r17, 0x0, 0x0) tkill(r17, 0x3b) ptrace$setregs(0xd, r17, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r17, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r18}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r20 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r21 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r21, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r21, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r21, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r21, 0x5501) r22 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r23 = gettid() ptrace$setopts(0x4206, r23, 0x0, 0x0) tkill(r23, 0x3b) ptrace$setregs(0xd, r23, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147", 0x81}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r8, @ANYRES32=r10, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r13, @ANYRES32=r3, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r14, @ANYRES32=r4, @ANYRES32=r15, @ANYRES32=r1, @ANYRES32=r16, @ANYRESOCT=r23, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r17, @ANYRES32=r19, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r20, @ANYRES32=r14, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r22, @ANYRES32=r3], 0x18f}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x40) lowmem_reserve[]: 0 0 0 [ 984.064415] DMA32: 179*4kB (UME) 113*8kB (UME) 231*16kB (UME) 122*32kB (UME) 484*64kB (UME) 213*128kB (UME) 135*256kB (UM) 71*512kB (UM) 0*1024kB 0*2048kB 0*4096kB = 138372kB 22:50:46 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, 0x0}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149", 0xa4}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r10, @ANYBLOB, @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98", @ANYRES32, @ANYBLOB='(\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r13, @ANYRES32=r4, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r21, @ANYRES32=r3], 0x160}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x40) 22:50:46 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r3}, 0x18, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r5) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r6, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r6, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r6, 0x5501) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b00") socket$inet_udplite(0x2, 0x2, 0x88) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r8, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r8, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r8, 0x5501) openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r9 = gettid() ptrace$setopts(0x4206, r9, 0x0, 0x0) tkill(r9, 0x3b) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0), &(0x7f0000000600)=0xc) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r10, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r10, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r10, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r10, 0x5501) gettid() ** 244 printk messages dropped ** [ 989.074370] 1965979 pages RAM [ 989.074372] 0 pages HighMem/MovableOnly 22:50:46 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r5}, 0x18, 0x0) r6 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r7) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r8, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r8, 0x5501) r9 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r9, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r10 = socket$inet_udplite(0x2, 0x2, 0x88) r11 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={0x0, r1}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r12, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r12, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r12, 0x5501) r13 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r13, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r13, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r13, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r13, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r14 = gettid() ptrace$setopts(0x4206, r14, 0x0, 0x0) tkill(r14, 0x3b) ptrace$setregs(0xd, r14, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r14, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r15}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r17 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x0, 0x0) r18 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r18, 0x401c5504, &(0x7f0000000100)={0x400000100002f}) ioctl$UI_SET_EVBIT(r18, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r18, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r18, 0x5501) r19 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r20 = gettid() ptrace$setopts(0x4206, r20, 0x0, 0x0) tkill(r20, 0x3b) ptrace$setregs(0xffffffffffffffff, r20, 0x0, &(0x7f0000000080)) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce46", 0xa6}, {0x0}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r5, @ANYRES32=r7, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32, @ANYRESHEX=r7, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r10, @ANYRES32, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r11, @ANYRES32=r3, @ANYRES32=r12, @ANYRES32=r1, @ANYRES32=r13, @ANYRESOCT=r20, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r14, @ANYRES32=r15, @ANYRES32=r16, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r17, @ANYRES32=r11, @ANYBLOB="1800000000000000", @ANYRES32=r19, @ANYRES32], 0x18b}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') tkill(r4, 0x40) 22:50:46 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) wait4(0x0, 0x0, 0x80000000, 0x0) r3 = gettid() tkill(r3, 0x3b) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r4, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r4, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r4, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r4, 0x5501) 22:50:46 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0x0, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32, @ANYBLOB], 0x1c) r2 = timerfd_create(0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r7}, 0x18, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r9) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r10, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r10, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r10, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r10, 0x5501) r11 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r11, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x0, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, 0x0) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r16, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0), &(0x7f0000000600)=0xc) r18 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r19, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r19, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r19, 0x5501) r20 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r21 = gettid() ptrace$setopts(0x4206, r21, 0x0, 0x0) tkill(r21, 0x3b) ptrace$setregs(0xd, r21, 0x0, &(0x7f0000000080)) sendmsg$unix(r6, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce4620162e9d20", 0xab}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r7, @ANYRES32=r9, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r5, @ANYRESHEX=r9, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r12, @ANYRES32=r2, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r13, @ANYRES32=r3, @ANYRES32=r14, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT=r21, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r17, @ANYRES32, @ANYBLOB="00000000180000000000000001000000010000", @ANYRES32=r18, @ANYRES32=r13, @ANYBLOB="180000000000000001000000010000", @ANYRES32=r20, @ANYRES32=r2], 0x191}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x40) 22:50:46 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0x0, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r13, 0x1000008912, &(0x7f0000000140)) r14 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) r16 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r16, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r16, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r16, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r16, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r17 = gettid() ptrace$setopts(0x4206, r17, 0x0, 0x0) tkill(r17, 0x3b) ptrace$setregs(0xd, r17, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r17, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r18}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r20 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r21 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r21, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r21, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r21, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r21, 0x5501) r22 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r23 = gettid() ptrace$setopts(0x4206, r23, 0x0, 0x0) tkill(r23, 0x3b) ptrace$setregs(0xd, r23, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147", 0x81}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r8, @ANYRES32=r10, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r13, @ANYRES32=r3, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r14, @ANYRES32=r4, @ANYRES32=r15, @ANYRES32=r1, @ANYRES32=r16, @ANYRESOCT=r23, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r17, @ANYRES32=r19, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r20, @ANYRES32=r14, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r22, @ANYRES32=r3], 0x18f}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x40) 22:50:46 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, 0x0}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149", 0xa4}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r10, @ANYBLOB, @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98", @ANYRES32, @ANYBLOB='(\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r13, @ANYRES32=r4, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r21, @ANYRES32=r3], 0x160}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x40) ** 363 printk messages dropped ** [ 989.141599] Swap cache stats: add 0, delete 0, find 0/0 [ 989.141600] Free swap = 0kB [ 989.141602] Total swap = 0kB [ 989.141603] 1965979 pages RAM [ 989.141605] 0 pages HighMem/MovableOnly [ 989.141607] 313617 pages reserved 22:50:46 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) r3 = gettid() tkill(r3, 0x3b) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r4, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r4, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r4, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r4, 0x5501) 22:50:46 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r3}, 0x18, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r5) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r6, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r6, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r6, 0x5501) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b00") socket$inet_udplite(0x2, 0x2, 0x88) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r8, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r8, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r8, 0x5501) openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r9 = gettid() ptrace$setopts(0x4206, r9, 0x0, 0x0) tkill(r9, 0x3b) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0), &(0x7f0000000600)=0xc) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r10, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r10, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r10, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r10, 0x5501) gettid() [ 989.155451] syz-executor.3: page allocation failure: order:9, mode:0x240c0c0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO) 22:50:46 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0x0, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r13, 0x1000008912, &(0x7f0000000140)) r14 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) r16 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r16, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r16, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r16, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r16, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r17 = gettid() ptrace$setopts(0x4206, r17, 0x0, 0x0) tkill(r17, 0x3b) ptrace$setregs(0xd, r17, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r17, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r18}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r20 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r21 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r21, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r21, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r21, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r21, 0x5501) r22 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r23 = gettid() ptrace$setopts(0x4206, r23, 0x0, 0x0) tkill(r23, 0x3b) ptrace$setregs(0xd, r23, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147", 0x81}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r8, @ANYRES32=r10, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r13, @ANYRES32=r3, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r14, @ANYRES32=r4, @ANYRES32=r15, @ANYRES32=r1, @ANYRES32=r16, @ANYRESOCT=r23, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r17, @ANYRES32=r19, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r20, @ANYRES32=r14, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r22, @ANYRES32=r3], 0x18f}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x40) 22:50:46 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, 0x0}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149", 0xa4}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r10, @ANYBLOB, @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98", @ANYRES32, @ANYBLOB='(\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r13, @ANYRES32=r4, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r21, @ANYRES32=r3], 0x160}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, 0x0) ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x40) 22:50:46 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0x0, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32, @ANYBLOB], 0x1c) r2 = timerfd_create(0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r7}, 0x18, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r9) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r10, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r10, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r10, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r10, 0x5501) r11 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r11, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x0, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, 0x0) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r16, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0), &(0x7f0000000600)=0xc) r18 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r19, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r19, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r19, 0x5501) r20 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r21 = gettid() ptrace$setopts(0x4206, r21, 0x0, 0x0) tkill(r21, 0x3b) ptrace$setregs(0xd, r21, 0x0, &(0x7f0000000080)) sendmsg$unix(r6, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce4620162e9d20", 0xab}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r7, @ANYRES32=r9, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r5, @ANYRESHEX=r9, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r12, @ANYRES32=r2, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r13, @ANYRES32=r3, @ANYRES32=r14, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT=r21, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r17, @ANYRES32, @ANYBLOB="00000000180000000000000001000000010000", @ANYRES32=r18, @ANYRES32=r13, @ANYBLOB="180000000000000001000000010000", @ANYRES32=r20, @ANYRES32=r2], 0x191}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x40) 22:50:46 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) r2 = gettid() tkill(r2, 0x3b) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r3, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r3, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r3, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r3, 0x5501) [ 989.155458] CPU: 0 PID: 32555 Comm: syz-executor.3 Not tainted 4.9.141+ #1 [ 989.155468] ffff88010174f6e8 ffffffff81b42e79 1ffff100202e9edf ffff8801c4df0000 [ 989.155476] ffffffff82a974e0 0000000000000001 0000000000400000 ffff88010174f830 22:50:46 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r5}, 0x18, 0x0) r6 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r7) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r8, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r8, 0x5501) r9 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r9, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r10 = socket$inet_udplite(0x2, 0x2, 0x88) r11 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={0x0, r1}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r12, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r12, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r12, 0x5501) r13 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r13, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r13, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r13, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r13, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r14 = gettid() ptrace$setopts(0x4206, r14, 0x0, 0x0) tkill(r14, 0x3b) ptrace$setregs(0xd, r14, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r14, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r15}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r17 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x0, 0x0) r18 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r18, 0x401c5504, &(0x7f0000000100)={0x400000100002f}) ioctl$UI_SET_EVBIT(r18, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r18, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r18, 0x5501) r19 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r20 = gettid() ptrace$setopts(0x4206, r20, 0x0, 0x0) tkill(r20, 0x3b) ptrace$setregs(0xffffffffffffffff, r20, 0x0, &(0x7f0000000080)) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce46", 0xa6}, {0x0}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r5, @ANYRES32=r7, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32, @ANYRESHEX=r7, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r10, @ANYRES32, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r11, @ANYRES32=r3, @ANYRES32=r12, @ANYRES32=r1, @ANYRES32=r13, @ANYRESOCT=r20, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r14, @ANYRES32=r15, @ANYRES32=r16, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r17, @ANYRES32=r11, @ANYBLOB="180000000000000001000000", @ANYRES32=r19, @ANYRES32], 0x18f}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') tkill(r4, 0x40) [ 989.155483] ffffffff814fc7c8 0000000041b58ab3 ffffffff82e37a10 ffffffff81427db0 [ 989.155485] Call Trace: 22:50:47 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0x0, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32, @ANYBLOB], 0x1c) r2 = timerfd_create(0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r7}, 0x18, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r9) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r10, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r10, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r10, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r10, 0x5501) r11 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r11, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x0, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, 0x0) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r16, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0), &(0x7f0000000600)=0xc) r18 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r19, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r19, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r19, 0x5501) r20 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r21 = gettid() ptrace$setopts(0x4206, r21, 0x0, 0x0) tkill(r21, 0x3b) ptrace$setregs(0xd, r21, 0x0, &(0x7f0000000080)) sendmsg$unix(r6, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce4620162e9d20", 0xab}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r7, @ANYRES32=r9, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r5, @ANYRESHEX=r9, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r12, @ANYRES32=r2, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r13, @ANYRES32=r3, @ANYRES32=r14, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT=r21, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r17, @ANYRES32, @ANYBLOB="00000000180000000000000001000000010000", @ANYRES32=r18, @ANYRES32=r13, @ANYBLOB="180000000000000001000000010000", @ANYRES32=r20, @ANYRES32=r2], 0x191}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x40) 22:50:47 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, 0x0}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149", 0xa4}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r10, @ANYBLOB, @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98", @ANYRES32, @ANYBLOB='(\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r13, @ANYRES32=r4, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r21, @ANYRES32=r3], 0x160}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0xffffffffffffffff, r5, 0x0, 0x0) tkill(r5, 0x40) [ 989.155497] [] dump_stack+0xc1/0x128 22:50:47 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r3}, 0x18, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r5) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r6, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r6, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r6, 0x5501) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b00") socket$inet_udplite(0x2, 0x2, 0x88) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r8, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r8, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r8, 0x5501) ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r9 = gettid() ptrace$setopts(0x4206, r9, 0x0, 0x0) tkill(r9, 0x3b) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0), &(0x7f0000000600)=0xc) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r10, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r10, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r10, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r10, 0x5501) gettid() [ 989.155505] [] warn_alloc.cold.31+0x7f/0x9c 22:50:47 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0x0, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r13, 0x1000008912, &(0x7f0000000140)) r14 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) r16 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r16, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r16, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r16, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r16, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r17 = gettid() ptrace$setopts(0x4206, r17, 0x0, 0x0) tkill(r17, 0x3b) ptrace$setregs(0xd, r17, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r17, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r18}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r20 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r21 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r21, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r21, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r21, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r21, 0x5501) r22 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r23 = gettid() ptrace$setopts(0x4206, r23, 0x0, 0x0) tkill(r23, 0x3b) ptrace$setregs(0xd, r23, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147", 0x81}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r8, @ANYRES32=r10, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r13, @ANYRES32=r3, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r14, @ANYRES32=r4, @ANYRES32=r15, @ANYRES32=r1, @ANYRES32=r16, @ANYRESOCT=r23, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r17, @ANYRES32, @ANYRES32=r19, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r20, @ANYRES32=r14, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r22, @ANYRES32=r3], 0x193}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x40) [ 989.155513] [] ? zone_watermark_ok_safe+0x250/0x250 22:50:47 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) r2 = gettid() tkill(r2, 0x3b) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r3, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r3, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r3, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r3, 0x5501) [ 989.155520] [] ? rcu_read_lock_sched_held+0x103/0x120 [ 989.155527] [] ? compaction_deferred+0x118/0x320 [ 989.155533] [] ? try_to_compact_pages+0x41/0x710 [ 989.155541] [] __alloc_pages_nodemask+0x628/0x1bd0 [ 989.155548] [] ? gfp_pfmemalloc_allowed+0x110/0x110 [ 989.155554] [] ? _raw_spin_unlock_irqrestore+0x6b/0x70 [ 989.155561] [] ? trace_hardirqs_on+0x10/0x10 [ 989.155567] [] ? migrate_swap_stop+0x810/0x810 [ 989.155573] [] ? mark_held_locks+0xc7/0x130 [ 989.155581] [] ? mutex_lock_interruptible_nested+0x7f3/0x9c0 [ 989.155586] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 989.155592] [] kmalloc_order+0x2a/0x70 [ 989.155598] [] kmalloc_order_trace+0x1f/0x190 [ 989.155606] [] __kmalloc+0x1ae/0x310 [ 989.155616] [] ? avc_has_extended_perms+0x56a/0xd90 [ 989.155622] [] ? avc_has_extended_perms+0xde/0xd90 [ 989.155631] [] input_mt_init_slots+0xcb/0x400 [ 989.155638] [] uinput_ioctl_handler.isra.4+0x161d/0x1980 [ 989.155643] [] ? avc_ss_reset+0x110/0x110 [ 989.155650] [] ? uinput_ff_upload_from_user+0x350/0x350 [ 989.155655] [] ? __lock_acquire+0x654/0x4a10 [ 989.155661] [] uinput_ioctl+0x4c/0x60 [ 989.155667] [] ? uinput_compat_ioctl+0x80/0x80 [ 989.155674] [] do_vfs_ioctl+0x1ac/0x11a0 [ 989.155680] [] ? ioctl_preallocate+0x220/0x220 [ 989.155688] [] ? selinux_parse_skb.constprop.42+0x1a90/0x1a90 [ 989.155695] [] ? check_preemption_disabled+0x3b/0x200 [ 989.155701] [] ? __fget+0x214/0x3d0 [ 989.155706] [] ? __fget+0x23b/0x3d0 [ 989.155711] [] ? __fget+0x47/0x3d0 [ 989.155717] [] ? security_file_ioctl+0x8f/0xc0 [ 989.155723] [] SyS_ioctl+0x8f/0xc0 [ 989.155729] [] ? do_vfs_ioctl+0x11a0/0x11a0 [ 989.155735] [] do_syscall_64+0x19f/0x550 [ 989.155743] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 989.155746] Mem-Info: [ 989.155760] active_anon:788526 inactive_anon:64307 isolated_anon:0 [ 989.155760] active_file:1320 inactive_file:519 isolated_file:32 [ 989.155760] unevictable:4 dirty:217 writeback:0 unstable:0 [ 989.155760] slab_reclaimable:9963 slab_unreclaimable:89997 [ 989.155760] mapped:71155 shmem:175150 pagetables:30386 bounce:0 [ 989.155760] free:35583 free_pcp:0 free_cma:0 [ 989.155771] Node 0 active_anon:3154104kB inactive_anon:257228kB active_file:5280kB inactive_file:2076kB unevictable:16kB isolated(anon):0kB isolated(file):128kB mapped:284620kB dirty:868kB writeback:0kB shmem:700600kB writeback_tmp:0kB unstable:0kB pages_scanned:0 all_unreclaimable? no [ 989.155786] DMA32 free:132620kB min:4696kB low:7712kB high:10728kB active_anon:523400kB inactive_anon:26868kB active_file:2120kB inactive_file:1392kB unevictable:0kB writepending:392kB present:3145324kB managed:3020132kB mlocked:0kB slab_reclaimable:9060kB slab_unreclaimable:146172kB kernel_stack:15168kB pagetables:33372kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 3505 3505 [ 989.155807] Normal free:9712kB min:5580kB low:9168kB high:12756kB active_anon:2630704kB inactive_anon:230360kB active_file:2964kB inactive_file:768kB unevictable:16kB writepending:476kB present:4718592kB managed:3589316kB mlocked:16kB slab_reclaimable:30792kB slab_unreclaimable:213816kB kernel_stack:25984kB pagetables:88172kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 0 0 [ 989.155846] DMA32: 186*4kB (UME) 121*8kB (UME) 139*16kB (UME) 69*32kB (UME) 435*64kB (UME) 215*128kB (UME) 134*256kB (UM) 72*512kB (UM) 0*1024kB 0*2048kB 0*4096kB = 132672kB Normal: 460*4kB (UME) 258*8kB (UME) 40*16kB (UME) 73*32kB (UME) 34*64kB (UM) 6*128kB (UME) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 9824kB 177014 total pagecache pages [ 989.155879] 0 pages in swap cache [ 989.155882] Swap cache stats: add 0, delete 0, find 0/0 [ 989.155883] Free swap = 0kB [ 989.155885] Total swap = 0kB [ 989.155886] 1965979 pages RAM [ 989.155888] 0 pages HighMem/MovableOnly [ 989.155890] 313617 pages reserved [ 989.156671] syz-executor.3: page allocation failure: order:9, mode:0x240c0c0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO) [ 989.156678] CPU: 0 PID: 32555 Comm: syz-executor.3 Not tainted 4.9.141+ #1 [ 989.156689] ffff88010174f6e8 ffffffff81b42e79 1ffff100202e9edf ffff8801c4df0000 [ 989.156697] ffffffff82a974e0 0000000000000001 0000000000400000 ffff88010174f830 [ 989.156705] ffffffff814fc7c8 0000000041b58ab3 ffffffff82e37a10 ffffffff81427db0 [ 989.156707] Call Trace: [ 989.156716] [] dump_stack+0xc1/0x128 [ 989.156723] [] warn_alloc.cold.31+0x7f/0x9c [ 989.156731] [] ? zone_watermark_ok_safe+0x250/0x250 [ 989.156737] [] ? rcu_read_lock_sched_held+0x103/0x120 [ 989.156744] [] ? compaction_deferred+0x118/0x320 [ 989.156750] [] ? try_to_compact_pages+0x41/0x710 [ 989.156757] [] __alloc_pages_nodemask+0x628/0x1bd0 [ 989.156764] [] ? gfp_pfmemalloc_allowed+0x110/0x110 [ 989.156770] [] ? _raw_spin_unlock_irqrestore+0x6b/0x70 [ 989.156776] [] ? trace_hardirqs_on+0x10/0x10 [ 989.156781] [] ? migrate_swap_stop+0x810/0x810 [ 989.156787] [] ? mark_held_locks+0xc7/0x130 [ 989.156794] [] ? mutex_lock_interruptible_nested+0x7f3/0x9c0 [ 989.156800] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 989.156806] [] kmalloc_order+0x2a/0x70 [ 989.156811] [] kmalloc_order_trace+0x1f/0x190 [ 989.156818] [] __kmalloc+0x1ae/0x310 [ 989.156825] [] ? avc_has_extended_perms+0x56a/0xd90 [ 989.156831] [] ? avc_has_extended_perms+0xde/0xd90 [ 989.156839] [] input_mt_init_slots+0xcb/0x400 22:50:47 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, 0x0}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149", 0xa4}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r10, @ANYBLOB, @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98", @ANYRES32, @ANYBLOB='(\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r13, @ANYRES32=r4, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r21, @ANYRES32=r3], 0x160}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0xffffffffffffffff, r5, 0x0, 0x0) tkill(r5, 0x40) [ 989.156847] [] uinput_ioctl_handler.isra.4+0x161d/0x1980 [ 989.156853] [] ? avc_ss_reset+0x110/0x110 [ 989.156860] [] ? uinput_ff_upload_from_user+0x350/0x350 [ 989.156866] [] ? __lock_acquire+0x654/0x4a10 [ 989.156873] [] uinput_ioctl+0x4c/0x60 [ 989.156879] [] ? uinput_compat_ioctl+0x80/0x80 [ 989.156886] [] do_vfs_ioctl+0x1ac/0x11a0 22:50:47 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r3}, 0x18, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r5) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r6, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r6, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r6, 0x5501) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b00") socket$inet_udplite(0x2, 0x2, 0x88) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r8, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r8, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r8, 0x5501) ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r9 = gettid() ptrace$setopts(0x4206, r9, 0x0, 0x0) tkill(r9, 0x3b) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0), &(0x7f0000000600)=0xc) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r10, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r10, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r10, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r10, 0x5501) gettid() 22:50:47 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0x0, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r13, 0x1000008912, &(0x7f0000000140)) r14 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) r16 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r16, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r16, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r16, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r16, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r17 = gettid() ptrace$setopts(0x4206, r17, 0x0, 0x0) tkill(r17, 0x3b) ptrace$setregs(0xd, r17, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r17, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r18}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r20 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r21 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r21, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r21, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r21, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r21, 0x5501) r22 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r23 = gettid() ptrace$setopts(0x4206, r23, 0x0, 0x0) tkill(r23, 0x3b) ptrace$setregs(0xd, r23, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147", 0x81}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r8, @ANYRES32=r10, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r13, @ANYRES32=r3, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r14, @ANYRES32=r4, @ANYRES32=r15, @ANYRES32=r1, @ANYRES32=r16, @ANYRESOCT=r23, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r17, @ANYRES32, @ANYRES32=r19, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r20, @ANYRES32=r14, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r22, @ANYRES32=r3], 0x193}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x40) 22:50:47 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r5}, 0x18, 0x0) r6 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r7) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r8, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r8, 0x5501) r9 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r9, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r10 = socket$inet_udplite(0x2, 0x2, 0x88) r11 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={0x0, r1}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r12, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r12, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r12, 0x5501) r13 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r13, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r13, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r13, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r13, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r14 = gettid() ptrace$setopts(0x4206, r14, 0x0, 0x0) tkill(r14, 0x3b) ptrace$setregs(0xd, r14, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r14, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r15}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r17 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x0, 0x0) r18 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r18, 0x401c5504, &(0x7f0000000100)={0x400000100002f}) ioctl$UI_SET_EVBIT(r18, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r18, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r18, 0x5501) r19 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r20 = gettid() ptrace$setopts(0x4206, r20, 0x0, 0x0) tkill(r20, 0x3b) ptrace$setregs(0xffffffffffffffff, r20, 0x0, &(0x7f0000000080)) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce46", 0xa6}, {0x0}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r5, @ANYRES32=r7, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32, @ANYRESHEX=r7, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r10, @ANYRES32, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r11, @ANYRES32=r3, @ANYRES32=r12, @ANYRES32=r1, @ANYRES32=r13, @ANYRESOCT=r20, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r14, @ANYRES32=r15, @ANYRES32=r16, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r17, @ANYRES32=r11, @ANYBLOB="180000000000000001000000", @ANYRES32=r19, @ANYRES32], 0x18f}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') tkill(r4, 0x40) [ 989.156892] [] ? ioctl_preallocate+0x220/0x220 [ 989.156899] [] ? selinux_parse_skb.constprop.42+0x1a90/0x1a90 [ 989.156905] [] ? check_preemption_disabled+0x3b/0x200 [ 989.156911] [] ? __fget+0x214/0x3d0 [ 989.156917] [] ? __fget+0x23b/0x3d0 [ 989.156922] [] ? __fget+0x47/0x3d0 [ 989.156928] [] ? security_file_ioctl+0x8f/0xc0 22:50:47 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0x0, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32, @ANYBLOB], 0x1c) r2 = timerfd_create(0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r7}, 0x18, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r9) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r10, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r10, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r10, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r10, 0x5501) r11 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r11, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x0, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, 0x0) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r16, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, r22, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r6, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce4620162e9d20", 0xab}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r7, @ANYRES32=r9, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r5, @ANYRESHEX=r9, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r12, @ANYRES32=r2, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r13, @ANYRES32=r3, @ANYRES32=r14, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT=r22, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r18, @ANYBLOB="00000000180000000000000001000000010000", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="180000000000000001000000010000", @ANYRES32=r21, @ANYRES32=r2], 0x18d}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x40) [ 989.156934] [] SyS_ioctl+0x8f/0xc0 [ 989.156940] [] ? do_vfs_ioctl+0x11a0/0x11a0 [ 989.156945] [] do_syscall_64+0x19f/0x550 [ 989.156951] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 989.156954] Mem-Info: [ 989.156968] active_anon:788526 inactive_anon:64307 isolated_anon:0 [ 989.156968] active_file:1320 inactive_file:519 isolated_file:32 [ 989.156968] unevictable:4 dirty:217 writeback:0 unstable:0 [ 989.156968] slab_reclaimable:9963 slab_unreclaimable:89997 [ 989.156968] mapped:71155 shmem:175150 pagetables:30386 bounce:0 [ 989.156968] free:35586 free_pcp:0 free_cma:0 [ 989.156979] Node 0 active_anon:3154104kB inactive_anon:257228kB active_file:5280kB inactive_file:2076kB unevictable:16kB isolated(anon):0kB isolated(file):128kB mapped:284620kB dirty:868kB writeback:0kB shmem:700600kB writeback_tmp:0kB unstable:0kB pages_scanned:0 all_unreclaimable? no [ 989.156994] DMA32 free:132620kB min:4696kB low:7712kB high:10728kB active_anon:523400kB inactive_anon:26868kB active_file:2120kB inactive_file:1392kB unevictable:0kB writepending:392kB present:3145324kB managed:3020132kB mlocked:0kB slab_reclaimable:9060kB slab_unreclaimable:146172kB kernel_stack:15168kB pagetables:33372kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 3505 3505 [ 989.157015] Normal free:9724kB min:5580kB low:9168kB high:12756kB active_anon:2630704kB inactive_anon:230360kB active_file:2964kB inactive_file:768kB unevictable:16kB writepending:476kB present:4718592kB managed:3589316kB mlocked:16kB slab_reclaimable:30792kB slab_unreclaimable:213816kB kernel_stack:26016kB pagetables:88172kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB 22:50:48 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r5}, 0x18, 0x0) r6 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r7) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r8, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r8, 0x5501) r9 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r9, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r10 = socket$inet_udplite(0x2, 0x2, 0x88) r11 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={0x0, r1}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r12, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r12, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r12, 0x5501) r13 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r13, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r13, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r13, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r13, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r14 = gettid() ptrace$setopts(0x4206, r14, 0x0, 0x0) tkill(r14, 0x3b) ptrace$setregs(0xd, r14, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r14, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r15}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r17 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x0, 0x0) r18 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r18, 0x401c5504, &(0x7f0000000100)={0x400000100002f}) ioctl$UI_SET_EVBIT(r18, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r18, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r18, 0x5501) r19 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r20 = gettid() ptrace$setopts(0x4206, r20, 0x0, 0x0) tkill(r20, 0x3b) ptrace$setregs(0xffffffffffffffff, r20, 0x0, &(0x7f0000000080)) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce46", 0xa6}, {0x0}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r5, @ANYRES32=r7, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32, @ANYRESHEX=r7, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r10, @ANYRES32, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r11, @ANYRES32=r3, @ANYRES32=r12, @ANYRES32=r1, @ANYRES32=r13, @ANYRESOCT=r20, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r14, @ANYRES32=r15, @ANYRES32=r16, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r17, @ANYRES32=r11, @ANYBLOB="180000000000000001000000", @ANYRES32=r19, @ANYRES32], 0x18f}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') tkill(r4, 0x40) 22:50:48 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, 0x0}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149", 0xa4}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r10, @ANYBLOB, @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98", @ANYRES32, @ANYBLOB='(\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r13, @ANYRES32=r4, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r21, @ANYRES32=r3], 0x160}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0xffffffffffffffff, r5, 0x0, 0x0) tkill(r5, 0x40) 22:50:48 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0x0, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r13, 0x1000008912, &(0x7f0000000140)) r14 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) r16 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r16, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r16, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r16, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r16, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r17 = gettid() ptrace$setopts(0x4206, r17, 0x0, 0x0) tkill(r17, 0x3b) ptrace$setregs(0xd, r17, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r17, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r18}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r20 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r21 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r21, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r21, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r21, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r21, 0x5501) r22 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r23 = gettid() ptrace$setopts(0x4206, r23, 0x0, 0x0) tkill(r23, 0x3b) ptrace$setregs(0xd, r23, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147", 0x81}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r8, @ANYRES32=r10, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r13, @ANYRES32=r3, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r14, @ANYRES32=r4, @ANYRES32=r15, @ANYRES32=r1, @ANYRES32=r16, @ANYRESOCT=r23, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r17, @ANYRES32, @ANYRES32=r19, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r20, @ANYRES32=r14, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r22, @ANYRES32=r3], 0x193}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x40) 22:50:48 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) r2 = gettid() tkill(r2, 0x3b) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r3, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r3, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r3, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r3, 0x5501) 22:50:48 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0x0, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32, @ANYBLOB], 0x1c) r2 = timerfd_create(0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r7}, 0x18, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r9) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r10, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r10, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r10, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r10, 0x5501) r11 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r11, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x0, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, 0x0) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r16, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, r22, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r6, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce4620162e9d20", 0xab}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r7, @ANYRES32=r9, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r5, @ANYRESHEX=r9, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r12, @ANYRES32=r2, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r13, @ANYRES32=r3, @ANYRES32=r14, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT=r22, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r18, @ANYBLOB="00000000180000000000000001000000010000", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="180000000000000001000000010000", @ANYRES32=r21, @ANYRES32=r2], 0x18d}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x40) 22:50:48 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r3}, 0x18, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r5) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r6, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r6, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r6, 0x5501) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b00") socket$inet_udplite(0x2, 0x2, 0x88) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r8, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r8, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r8, 0x5501) ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r9 = gettid() ptrace$setopts(0x4206, r9, 0x0, 0x0) tkill(r9, 0x3b) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0), &(0x7f0000000600)=0xc) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r10, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r10, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r10, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r10, 0x5501) gettid() 22:50:48 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0x0, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r13, 0x1000008912, &(0x7f0000000140)) r14 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) r16 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r16, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r16, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r16, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r16, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r17 = gettid() ptrace$setopts(0x4206, r17, 0x0, 0x0) tkill(r17, 0x3b) ptrace$setregs(0xd, r17, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r17, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r18}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r20 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r21 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r21, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r21, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r21, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r21, 0x5501) r22 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r23 = gettid() ptrace$setopts(0x4206, r23, 0x0, 0x0) tkill(r23, 0x3b) ptrace$setregs(0xd, r23, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147", 0x81}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r8, @ANYRES32=r10, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r13, @ANYRES32=r3, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r14, @ANYRES32=r4, @ANYRES32=r15, @ANYRES32=r1, @ANYRES32=r16, @ANYRESOCT=r23, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r18, @ANYRES32=r19, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r20, @ANYRES32=r14, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r22, @ANYRES32=r3], 0x18f}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x40) lowmem_reserve[]: 0 0 0 22:50:48 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, 0x0}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149", 0xa4}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r10, @ANYBLOB, @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98", @ANYRES32, @ANYBLOB='(\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r13, @ANYRES32=r4, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r21, @ANYRES32=r3], 0x160}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r5, 0x40) [ 989.157058] DMA32: 186*4kB (UME) 121*8kB (UME) 139*16kB (UME) 69*32kB (UME) 435*64kB (UME) 215*128kB (UME) 134*256kB (UM) 72*512kB (UM) 0*1024kB 0*2048kB 0*4096kB = 132672kB 22:50:48 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0x0, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32, @ANYBLOB], 0x1c) r2 = timerfd_create(0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r7}, 0x18, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r9) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r10, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r10, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r10, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r10, 0x5501) r11 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r11, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x0, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, 0x0) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r16, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, r22, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r6, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce4620162e9d20", 0xab}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r7, @ANYRES32=r9, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r5, @ANYRESHEX=r9, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r12, @ANYRES32=r2, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r13, @ANYRES32=r3, @ANYRES32=r14, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT=r22, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r18, @ANYBLOB="00000000180000000000000001000000010000", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="180000000000000001000000010000", @ANYRES32=r21, @ANYRES32=r2], 0x18d}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x40) 22:50:48 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32, @ANYBLOB], 0x10) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) r2 = gettid() tkill(r2, 0x3b) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r3, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r3, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r3, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r3, 0x5501) 22:50:48 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, 0x0}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149", 0xa4}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r10, @ANYBLOB, @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98", @ANYRES32, @ANYBLOB='(\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r13, @ANYRES32=r4, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r21, @ANYRES32=r3], 0x160}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r5, 0x40) 22:50:48 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r3}, 0x18, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r5) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r6, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r6, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r6, 0x5501) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b00") socket$inet_udplite(0x2, 0x2, 0x88) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r8, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r8, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r9, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r10 = gettid() ptrace$setopts(0x4206, r10, 0x0, 0x0) tkill(r10, 0x3b) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0), &(0x7f0000000600)=0xc) r11 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) gettid() Normal: 458*4kB (UME) 258*8kB (UME) 40*16kB (UME) 72*32kB (UME) 34*64kB (UM) 6*128kB (UME) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 9784kB 22:50:48 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r5}, 0x18, 0x0) r6 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r7) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r8, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r8, 0x5501) r9 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r9, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r10 = socket$inet_udplite(0x2, 0x2, 0x88) r11 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={0x0, r1}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r12, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r12, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r12, 0x5501) r13 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r13, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r13, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r13, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r13, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r14 = gettid() ptrace$setopts(0x4206, r14, 0x0, 0x0) tkill(r14, 0x3b) ptrace$setregs(0xd, r14, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r14, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r15}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r17 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x0, 0x0) r18 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r18, 0x401c5504, &(0x7f0000000100)={0x400000100002f}) ioctl$UI_SET_EVBIT(r18, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r18, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r18, 0x5501) r19 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r20 = gettid() ptrace$setopts(0x4206, r20, 0x0, 0x0) tkill(r20, 0x3b) ptrace$setregs(0xffffffffffffffff, r20, 0x0, &(0x7f0000000080)) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce46", 0xa6}, {0x0}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r5, @ANYRES32=r7, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32, @ANYRESHEX=r7, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r10, @ANYRES32, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r11, @ANYRES32=r3, @ANYRES32=r12, @ANYRES32=r1, @ANYRES32=r13, @ANYRESOCT=r20, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r14, @ANYRES32=r15, @ANYRES32=r16, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r17, @ANYRES32=r11, @ANYBLOB="1800000000000000010000000100", @ANYRES32=r19, @ANYRES32], 0x191}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') tkill(r4, 0x40) 22:50:48 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32, @ANYBLOB], 0x10) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) r1 = gettid() tkill(r1, 0x3b) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r2, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r2, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r2, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r2, 0x5501) 22:50:48 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0x0, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r13, 0x1000008912, &(0x7f0000000140)) r14 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) r16 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r16, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r16, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r16, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r16, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r17 = gettid() ptrace$setopts(0x4206, r17, 0x0, 0x0) tkill(r17, 0x3b) ptrace$setregs(0xd, r17, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r17, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r18}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r20 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r21 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r21, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r21, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r21, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r21, 0x5501) r22 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r23 = gettid() ptrace$setopts(0x4206, r23, 0x0, 0x0) tkill(r23, 0x3b) ptrace$setregs(0xd, r23, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147", 0x81}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r8, @ANYRES32=r10, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r13, @ANYRES32=r3, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r14, @ANYRES32=r4, @ANYRES32=r15, @ANYRES32=r1, @ANYRES32=r16, @ANYRESOCT=r23, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r18, @ANYRES32=r19, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r20, @ANYRES32=r14, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r22, @ANYRES32=r3], 0x18f}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x40) 22:50:48 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0x0, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32, @ANYBLOB], 0x1c) r2 = timerfd_create(0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r7}, 0x18, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r9) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r10, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r10, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r10, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r10, 0x5501) r11 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r11, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x0, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, 0x0) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r16, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, r22, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r6, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce4620162e9d20", 0xab}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r7, @ANYRES32=r9, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r5, @ANYRESHEX=r9, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r12, @ANYRES32=r2, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r13, @ANYRES32=r3, @ANYRES32=r14, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT=r22, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32, @ANYRES32=r18, @ANYBLOB="00000000180000000000000001000000010000", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="180000000000000001000000010000", @ANYRES32=r21, @ANYRES32=r2], 0x191}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x40) 177014 total pagecache pages [ 989.157095] 0 pages in swap cache [ 989.157098] Swap cache stats: add 0, delete 0, find 0/0 22:50:48 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, 0x0}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149", 0xa4}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r10, @ANYBLOB, @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98", @ANYRES32, @ANYBLOB='(\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r13, @ANYRES32=r4, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r21, @ANYRES32=r3], 0x160}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r5, 0x40) 22:50:48 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32, @ANYBLOB], 0x10) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) r1 = gettid() tkill(r1, 0x3b) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r2, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r2, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r2, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r2, 0x5501) [ 989.157100] Free swap = 0kB 22:50:48 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0x0, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r13, 0x1000008912, &(0x7f0000000140)) r14 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) r16 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r16, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r16, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r16, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r16, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r17 = gettid() ptrace$setopts(0x4206, r17, 0x0, 0x0) tkill(r17, 0x3b) ptrace$setregs(0xd, r17, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r17, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r18}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r20 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r21 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r21, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r21, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r21, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r21, 0x5501) r22 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r23 = gettid() ptrace$setopts(0x4206, r23, 0x0, 0x0) tkill(r23, 0x3b) ptrace$setregs(0xd, r23, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147", 0x81}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r8, @ANYRES32=r10, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r13, @ANYRES32=r3, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r14, @ANYRES32=r4, @ANYRES32=r15, @ANYRES32=r1, @ANYRES32=r16, @ANYRESOCT=r23, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r18, @ANYRES32=r19, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r20, @ANYRES32=r14, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r22, @ANYRES32=r3], 0x18f}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x40) [ 989.157101] Total swap = 0kB [ 989.157110] 1965979 pages RAM 22:50:48 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32, @ANYBLOB], 0x10) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) r1 = gettid() tkill(r1, 0x3b) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r2, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r2, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r2, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r2, 0x5501) 22:50:48 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r5}, 0x18, 0x0) r6 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r7) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r8, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r8, 0x5501) r9 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r9, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r10 = socket$inet_udplite(0x2, 0x2, 0x88) r11 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={0x0, r1}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r12, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r12, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r12, 0x5501) r13 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r13, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r13, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r13, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r13, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r14 = gettid() ptrace$setopts(0x4206, r14, 0x0, 0x0) tkill(r14, 0x3b) ptrace$setregs(0xd, r14, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r14, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r15}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r17 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x0, 0x0) r18 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r18, 0x401c5504, &(0x7f0000000100)={0x400000100002f}) ioctl$UI_SET_EVBIT(r18, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r18, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r18, 0x5501) r19 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r20 = gettid() ptrace$setopts(0x4206, r20, 0x0, 0x0) tkill(r20, 0x3b) ptrace$setregs(0xffffffffffffffff, r20, 0x0, &(0x7f0000000080)) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce46", 0xa6}, {0x0}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r5, @ANYRES32=r7, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32, @ANYRESHEX=r7, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r10, @ANYRES32, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r11, @ANYRES32=r3, @ANYRES32=r12, @ANYRES32=r1, @ANYRES32=r13, @ANYRESOCT=r20, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r14, @ANYRES32=r15, @ANYRES32=r16, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r17, @ANYRES32=r11, @ANYBLOB="1800000000000000010000000100", @ANYRES32=r19, @ANYRES32], 0x191}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') tkill(r4, 0x40) [ 989.157112] 0 pages HighMem/MovableOnly 22:50:48 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0x0, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32, @ANYBLOB], 0x1c) r2 = timerfd_create(0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r7}, 0x18, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r9) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r10, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r10, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r10, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r10, 0x5501) r11 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r11, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x0, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, 0x0) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r16, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, r22, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r6, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce4620162e9d20", 0xab}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r7, @ANYRES32=r9, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r5, @ANYRESHEX=r9, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r12, @ANYRES32=r2, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r13, @ANYRES32=r3, @ANYRES32=r14, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT=r22, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32, @ANYRES32=r18, @ANYBLOB="00000000180000000000000001000000010000", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="180000000000000001000000010000", @ANYRES32=r21, @ANYRES32=r2], 0x191}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x40) [ 989.157113] 313617 pages reserved 22:50:48 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r3}, 0x18, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r5) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r6, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r6, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r6, 0x5501) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b00") socket$inet_udplite(0x2, 0x2, 0x88) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r8, 0x40045564, 0x3) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r9, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r10 = gettid() ptrace$setopts(0x4206, r10, 0x0, 0x0) tkill(r10, 0x3b) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0), &(0x7f0000000600)=0xc) r11 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) gettid() [ 989.183508] input: syz0 as /devices/virtual/input/input22498 [ 989.203550] input: syz0 as /devices/virtual/input/input22501 22:50:48 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32, @ANYBLOB], 0x10) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) r1 = gettid() tkill(r1, 0x3b) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r2, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r2, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r2, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r2, 0x5501) 22:50:48 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, 0x0}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149", 0xa4}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r10, @ANYBLOB, @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98", @ANYRES32, @ANYBLOB='(\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r13, @ANYRES32=r4, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r21, @ANYRES32=r3], 0x160}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(0x0, 0x40) 22:50:49 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0x0, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r13, 0x1000008912, &(0x7f0000000140)) r14 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) r16 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r16, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r16, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r16, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r16, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r17 = gettid() ptrace$setopts(0x4206, r17, 0x0, 0x0) tkill(r17, 0x3b) ptrace$setregs(0xd, r17, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r17, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r18}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r20 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r21 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r21, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r21, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r21, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r21, 0x5501) r22 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r23 = gettid() ptrace$setopts(0x4206, r23, 0x0, 0x0) tkill(r23, 0x3b) ptrace$setregs(0xd, r23, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147", 0x81}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r8, @ANYRES32=r10, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r13, @ANYRES32=r3, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r14, @ANYRES32=r4, @ANYRES32=r15, @ANYRES32=r1, @ANYRES32=r16, @ANYRESOCT=r23, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32, @ANYRES32=r18, @ANYRES32=r19, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r20, @ANYRES32=r14, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r22, @ANYRES32=r3], 0x193}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x40) [ 989.207027] input: syz0 as /devices/virtual/input/input22497 22:50:49 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0x0, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32, @ANYBLOB], 0x1c) r2 = timerfd_create(0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r7}, 0x18, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r9) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r10, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r10, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r10, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r10, 0x5501) r11 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r11, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x0, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, 0x0) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r16, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, r22, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r6, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce4620162e9d20", 0xab}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r7, @ANYRES32=r9, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r5, @ANYRESHEX=r9, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r12, @ANYRES32=r2, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r13, @ANYRES32=r3, @ANYRES32=r14, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT=r22, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32, @ANYRES32=r18, @ANYBLOB="00000000180000000000000001000000010000", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="180000000000000001000000010000", @ANYRES32=r21, @ANYRES32=r2], 0x191}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x40) 22:50:49 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, 0x0}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149", 0xa4}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r10, @ANYBLOB, @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98", @ANYRES32, @ANYBLOB='(\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r13, @ANYRES32=r4, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r21, @ANYRES32=r3], 0x160}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(0x0, 0x40) 22:50:49 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32, @ANYBLOB], 0x10) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) r1 = gettid() tkill(r1, 0x3b) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r2, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r2, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r2, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r2, 0x5501) [ 989.338698] input: syz0 as /devices/virtual/input/input22510 [ 989.361653] input: syz0 as /devices/virtual/input/input22515 22:50:49 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r5}, 0x18, 0x0) r6 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r7) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r8, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r8, 0x5501) r9 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r9, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r10 = socket$inet_udplite(0x2, 0x2, 0x88) r11 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={0x0, r1}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r12, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r12, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r12, 0x5501) r13 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r13, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r13, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r13, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r13, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r14 = gettid() ptrace$setopts(0x4206, r14, 0x0, 0x0) tkill(r14, 0x3b) ptrace$setregs(0xd, r14, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r14, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r15}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r17 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x0, 0x0) r18 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r18, 0x401c5504, &(0x7f0000000100)={0x400000100002f}) ioctl$UI_SET_EVBIT(r18, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r18, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r18, 0x5501) r19 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r20 = gettid() ptrace$setopts(0x4206, r20, 0x0, 0x0) tkill(r20, 0x3b) ptrace$setregs(0xffffffffffffffff, r20, 0x0, &(0x7f0000000080)) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce46", 0xa6}, {0x0}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r5, @ANYRES32=r7, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32, @ANYRESHEX=r7, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r10, @ANYRES32, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r11, @ANYRES32=r3, @ANYRES32=r12, @ANYRES32=r1, @ANYRES32=r13, @ANYRESOCT=r20, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r14, @ANYRES32=r15, @ANYRES32=r16, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r17, @ANYRES32=r11, @ANYBLOB="1800000000000000010000000100", @ANYRES32=r19, @ANYRES32], 0x191}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') tkill(r4, 0x40) [ 989.442018] input: syz0 as /devices/virtual/input/input22519 22:50:49 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0x0, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r13, 0x1000008912, &(0x7f0000000140)) r14 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) r16 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r16, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r16, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r16, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r16, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r17 = gettid() ptrace$setopts(0x4206, r17, 0x0, 0x0) tkill(r17, 0x3b) ptrace$setregs(0xd, r17, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r17, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r18}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r20 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r21 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r21, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r21, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r21, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r21, 0x5501) r22 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r23 = gettid() ptrace$setopts(0x4206, r23, 0x0, 0x0) tkill(r23, 0x3b) ptrace$setregs(0xd, r23, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147", 0x81}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r8, @ANYRES32=r10, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r13, @ANYRES32=r3, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r14, @ANYRES32=r4, @ANYRES32=r15, @ANYRES32=r1, @ANYRES32=r16, @ANYRESOCT=r23, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32, @ANYRES32=r18, @ANYRES32=r19, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r20, @ANYRES32=r14, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r22, @ANYRES32=r3], 0x193}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x40) [ 989.443468] input: syz0 as /devices/virtual/input/input22520 22:50:49 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r3}, 0x18, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r5) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r6, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r6, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r6, 0x5501) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b00") socket$inet_udplite(0x2, 0x2, 0x88) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r9, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r10 = gettid() ptrace$setopts(0x4206, r10, 0x0, 0x0) tkill(r10, 0x3b) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0), &(0x7f0000000600)=0xc) r11 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) gettid() 22:50:49 executing program 5: write$P9_RGETLOCK(0xffffffffffffffff, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32, @ANYBLOB], 0x10) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) r0 = gettid() tkill(r0, 0x3b) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r1, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r1, 0x5501) 22:50:49 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, 0x0}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149", 0xa4}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r10, @ANYBLOB, @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98", @ANYRES32, @ANYBLOB='(\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r13, @ANYRES32=r4, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r21, @ANYRES32=r3], 0x160}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(0x0, 0x40) [ 989.476186] input: syz0 as /devices/virtual/input/input22525 22:50:49 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0x0, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32, @ANYBLOB], 0x1c) r2 = timerfd_create(0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r7}, 0x18, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r9) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r10, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r10, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r10, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r10, 0x5501) r11 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r11, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x0, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, 0x0) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r16, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, r22, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r6, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce4620162e9d20", 0xab}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r7, @ANYRES32=r9, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r5, @ANYRESHEX=r9, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r12, @ANYRES32=r2, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r13, @ANYRES32=r3, @ANYRES32=r14, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT=r22, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="00000000180000000000000001000000010000", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="180000000000000001000000010000", @ANYRES32=r21, @ANYRES32=r2], 0x18d}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x40) [ 989.587643] input: syz0 as /devices/virtual/input/input22530 [ 989.628671] input: syz0 as /devices/virtual/input/input22537 22:50:49 executing program 5: write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) r0 = gettid() tkill(r0, 0x3b) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r1, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r1, 0x5501) [ 989.653890] input: syz0 as /devices/virtual/input/input22541 [ 989.801300] input: syz0 as /devices/virtual/input/input22552 22:50:49 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r3}, 0x18, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r5) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r6, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r6, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r6, 0x5501) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b00") socket$inet_udplite(0x2, 0x2, 0x88) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r9, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r10 = gettid() ptrace$setopts(0x4206, r10, 0x0, 0x0) tkill(r10, 0x3b) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0), &(0x7f0000000600)=0xc) r11 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) gettid() 22:50:49 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0x0, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r13, 0x1000008912, &(0x7f0000000140)) r14 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) r16 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r16, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r16, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r16, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r16, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r17 = gettid() ptrace$setopts(0x4206, r17, 0x0, 0x0) tkill(r17, 0x3b) ptrace$setregs(0xd, r17, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r17, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r18}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r20 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r21 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r21, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r21, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r21, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r21, 0x5501) r22 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r23 = gettid() ptrace$setopts(0x4206, r23, 0x0, 0x0) tkill(r23, 0x3b) ptrace$setregs(0xd, r23, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147", 0x81}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r8, @ANYRES32=r10, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r13, @ANYRES32=r3, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r14, @ANYRES32=r4, @ANYRES32=r15, @ANYRES32=r1, @ANYRES32=r16, @ANYRESOCT=r23, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32, @ANYRES32=r18, @ANYRES32=r19, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r20, @ANYRES32=r14, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r22, @ANYRES32=r3], 0x193}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x40) 22:50:49 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, 0x0}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149", 0xa4}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r10, @ANYBLOB, @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98", @ANYRES32, @ANYBLOB='(\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r13, @ANYRES32=r4, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r21, @ANYRES32=r3], 0x160}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x0) [ 989.829289] input: syz0 as /devices/virtual/input/input22561 22:50:49 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r5}, 0x18, 0x0) r6 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r7) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r8, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r8, 0x5501) r9 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r9, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r10 = socket$inet_udplite(0x2, 0x2, 0x88) r11 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={0x0, r1}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r12, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r12, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r12, 0x5501) r13 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r13, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r13, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r13, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r13, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r14 = gettid() ptrace$setopts(0x4206, r14, 0x0, 0x0) tkill(r14, 0x3b) ptrace$setregs(0xd, r14, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r14, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r15}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r17 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x0, 0x0) r18 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r18, 0x401c5504, &(0x7f0000000100)={0x400000100002f}) ioctl$UI_SET_EVBIT(r18, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r18, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r18, 0x5501) r19 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r20 = gettid() ptrace$setopts(0x4206, r20, 0x0, 0x0) tkill(r20, 0x3b) ptrace$setregs(0xffffffffffffffff, r20, 0x0, &(0x7f0000000080)) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce46", 0xa6}, {0x0}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r5, @ANYRES32=r7, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32, @ANYRESHEX=r7, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r10, @ANYRES32, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r11, @ANYRES32=r3, @ANYRES32=r12, @ANYRES32=r1, @ANYRES32=r13, @ANYRESOCT=r20, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r14, @ANYRES32=r15, @ANYRES32=r16, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r17, @ANYRES32=r11, @ANYBLOB="180000000000000001000000010000", @ANYRES32=r19, @ANYRES32], 0x192}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') tkill(r4, 0x40) [ 989.853784] input: syz0 as /devices/virtual/input/input22562 [ 989.894561] input: syz0 as /devices/virtual/input/input22566 [ 989.906487] input: syz0 as /devices/virtual/input/input22565 [ 990.088276] input: syz0 as /devices/virtual/input/input22580 22:50:49 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0x0, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32, @ANYBLOB], 0x1c) r2 = timerfd_create(0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r7}, 0x18, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r9) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r10, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r10, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r10, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r10, 0x5501) r11 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r11, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x0, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, 0x0) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r16, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, r22, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r6, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce4620162e9d20", 0xab}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r7, @ANYRES32=r9, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r5, @ANYRESHEX=r9, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r12, @ANYRES32=r2, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r13, @ANYRES32=r3, @ANYRES32=r14, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT=r22, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="00000000180000000000000001000000010000", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="180000000000000001000000010000", @ANYRES32=r21, @ANYRES32=r2], 0x18d}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x40) 22:50:49 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0x0, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r13, 0x1000008912, &(0x7f0000000140)) r14 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) r16 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r16, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r16, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r16, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r16, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r17 = gettid() ptrace$setopts(0x4206, r17, 0x0, 0x0) tkill(r17, 0x3b) ptrace$setregs(0xd, r17, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r17, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r18}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r20 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r21 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r21, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r21, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r21, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r21, 0x5501) r22 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r23 = gettid() ptrace$setopts(0x4206, r23, 0x0, 0x0) tkill(r23, 0x3b) ptrace$setregs(0xd, r23, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147", 0x81}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r8, @ANYRES32=r10, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r13, @ANYRES32=r3, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r14, @ANYRES32=r4, @ANYRES32=r15, @ANYRES32=r1, @ANYRES32=r16, @ANYRESOCT=r23, @ANYRES32=r17, @ANYRES32=r18, @ANYRES32=r19, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r20, @ANYRES32=r14, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r22, @ANYRES32=r3], 0x183}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x40) 22:50:49 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, 0x0}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149", 0xa4}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r10, @ANYBLOB, @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98", @ANYRES32, @ANYBLOB='(\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r13, @ANYRES32=r4, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r21, @ANYRES32=r3], 0x160}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x0) 22:50:49 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r5}, 0x18, 0x0) r6 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r7) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r8, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r8, 0x5501) r9 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r9, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r10 = socket$inet_udplite(0x2, 0x2, 0x88) r11 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={0x0, r1}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r12, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r12, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r12, 0x5501) r13 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r13, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r13, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r13, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r13, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r14 = gettid() ptrace$setopts(0x4206, r14, 0x0, 0x0) tkill(r14, 0x3b) ptrace$setregs(0xd, r14, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r14, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r15}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r17 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x0, 0x0) r18 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r18, 0x401c5504, &(0x7f0000000100)={0x400000100002f}) ioctl$UI_SET_EVBIT(r18, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r18, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r18, 0x5501) r19 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r20 = gettid() ptrace$setopts(0x4206, r20, 0x0, 0x0) tkill(r20, 0x3b) ptrace$setregs(0xffffffffffffffff, r20, 0x0, &(0x7f0000000080)) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce46", 0xa6}, {0x0}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r5, @ANYRES32=r7, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32, @ANYRESHEX=r7, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r10, @ANYRES32, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r11, @ANYRES32=r3, @ANYRES32=r12, @ANYRES32=r1, @ANYRES32=r13, @ANYRESOCT=r20, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r14, @ANYRES32=r15, @ANYRES32=r16, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r17, @ANYRES32=r11, @ANYBLOB="180000000000000001000000010000", @ANYRES32=r19, @ANYRES32], 0x192}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') tkill(r4, 0x40) 22:50:49 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r3}, 0x18, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r5) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r6, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r6, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r6, 0x5501) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b00") socket$inet_udplite(0x2, 0x2, 0x88) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r9 = gettid() ptrace$setopts(0x4206, r9, 0x0, 0x0) tkill(r9, 0x3b) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0), &(0x7f0000000600)=0xc) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r10, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r10, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r10, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r10, 0x5501) gettid() 22:50:49 executing program 5: write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) r0 = gettid() tkill(r0, 0x3b) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r1, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r1, 0x5501) [ 990.137467] input: syz0 as /devices/virtual/input/input22590 [ 990.177738] input: syz0 as /devices/virtual/input/input22593 22:50:49 executing program 5: write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) r0 = gettid() tkill(r0, 0x3b) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r1, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r1, 0x5501) [ 990.290722] input: syz0 as /devices/virtual/input/input22600 [ 990.374547] input: syz0 as /devices/virtual/input/input22608 22:50:49 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0x0, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r13, 0x1000008912, &(0x7f0000000140)) r14 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) r16 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r16, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r16, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r16, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r16, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r17 = gettid() ptrace$setopts(0x4206, r17, 0x0, 0x0) tkill(r17, 0x3b) ptrace$setregs(0xd, r17, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r17, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r18}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r20 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r21 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r21, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r21, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r21, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r21, 0x5501) r22 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r23 = gettid() ptrace$setopts(0x4206, r23, 0x0, 0x0) tkill(r23, 0x3b) ptrace$setregs(0xd, r23, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147", 0x81}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r8, @ANYRES32=r10, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r13, @ANYRES32=r3, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r14, @ANYRES32=r4, @ANYRES32=r15, @ANYRES32=r1, @ANYRES32=r16, @ANYRESOCT=r23, @ANYRES32=r17, @ANYRES32=r18, @ANYRES32=r19, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r20, @ANYRES32=r14, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r22, @ANYRES32=r3], 0x183}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x40) 22:50:49 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, 0x0}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149", 0xa4}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r10, @ANYBLOB, @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98", @ANYRES32, @ANYBLOB='(\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r13, @ANYRES32=r4, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r21, @ANYRES32=r3], 0x160}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x0) 22:50:49 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0x0, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32, @ANYBLOB], 0x1c) r2 = timerfd_create(0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r7}, 0x18, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r9) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r10, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r10, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r10, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r10, 0x5501) r11 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r11, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x0, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, 0x0) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r16, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, r22, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r6, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce4620162e9d20", 0xab}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r7, @ANYRES32=r9, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r5, @ANYRESHEX=r9, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r12, @ANYRES32=r2, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r13, @ANYRES32=r3, @ANYRES32=r14, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT=r22, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="00000000180000000000000001000000010000", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="180000000000000001000000010000", @ANYRES32=r21, @ANYRES32=r2], 0x18d}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x40) [ 990.407236] input: syz0 as /devices/virtual/input/input22613 [ 990.417906] input: syz0 as /devices/virtual/input/input22611 [ 990.486613] input: syz0 as /devices/virtual/input/input22620 22:50:49 executing program 5: write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) r0 = gettid() tkill(r0, 0x3b) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r1, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r1, 0x5501) 22:50:49 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0x0, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r13, 0x1000008912, &(0x7f0000000140)) r14 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) r16 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r16, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r16, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r16, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r16, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r17 = gettid() ptrace$setopts(0x4206, r17, 0x0, 0x0) tkill(r17, 0x3b) ptrace$setregs(0xd, r17, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r17, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r18}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r20 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r21 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r21, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r21, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r21, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r21, 0x5501) r22 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r23 = gettid() ptrace$setopts(0x4206, r23, 0x0, 0x0) tkill(r23, 0x3b) ptrace$setregs(0xd, r23, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147", 0x81}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r8, @ANYRES32=r10, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r13, @ANYRES32=r3, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r14, @ANYRES32=r4, @ANYRES32=r15, @ANYRES32=r1, @ANYRES32=r16, @ANYRESOCT=r23, @ANYRES32=r17, @ANYRES32=r18, @ANYRES32=r19, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r20, @ANYRES32=r14, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r22, @ANYRES32=r3], 0x183}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x40) 22:50:49 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r5}, 0x18, 0x0) r6 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r7) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r8, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r8, 0x5501) r9 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r9, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r10 = socket$inet_udplite(0x2, 0x2, 0x88) r11 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={0x0, r1}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r12, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r12, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r12, 0x5501) r13 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r13, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r13, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r13, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r13, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r14 = gettid() ptrace$setopts(0x4206, r14, 0x0, 0x0) tkill(r14, 0x3b) ptrace$setregs(0xd, r14, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r14, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r15}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r17 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x0, 0x0) r18 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r18, 0x401c5504, &(0x7f0000000100)={0x400000100002f}) ioctl$UI_SET_EVBIT(r18, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r18, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r18, 0x5501) r19 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r20 = gettid() ptrace$setopts(0x4206, r20, 0x0, 0x0) tkill(r20, 0x3b) ptrace$setregs(0xffffffffffffffff, r20, 0x0, &(0x7f0000000080)) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce46", 0xa6}, {0x0}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r5, @ANYRES32=r7, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32, @ANYRESHEX=r7, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r10, @ANYRES32, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r11, @ANYRES32=r3, @ANYRES32=r12, @ANYRES32=r1, @ANYRES32=r13, @ANYRESOCT=r20, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r14, @ANYRES32=r15, @ANYRES32=r16, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r17, @ANYRES32=r11, @ANYBLOB="180000000000000001000000010000", @ANYRES32=r19, @ANYRES32], 0x192}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') tkill(r4, 0x40) 22:50:49 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r3}, 0x18, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r5) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r6, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r6, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r6, 0x5501) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b00") socket$inet_udplite(0x2, 0x2, 0x88) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r9 = gettid() ptrace$setopts(0x4206, r9, 0x0, 0x0) tkill(r9, 0x3b) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0), &(0x7f0000000600)=0xc) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r10, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r10, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r10, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r10, 0x5501) gettid() 22:50:49 executing program 4: 22:50:49 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0x0, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32, @ANYBLOB], 0x1c) r2 = timerfd_create(0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r7}, 0x18, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r9) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r10, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r10, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r10, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r10, 0x5501) r11 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r11, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x0, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, 0x0) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r16, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, r22, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r6, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce4620162e9d20", 0xab}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r7, @ANYRES32=r9, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r5, @ANYRESHEX=r9, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r12, @ANYRES32=r2, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r13, @ANYRES32=r3, @ANYRES32=r14, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT=r22, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32, @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="00000000180000000000000001000000010000", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="180000000000000001000000010000", @ANYRES32=r21, @ANYRES32=r2], 0x191}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x40) [ 990.720107] input: syz0 as /devices/virtual/input/input22637 [ 990.737322] input: syz0 as /devices/virtual/input/input22638 [ 990.742885] input: syz0 as /devices/virtual/input/input22641 22:50:50 executing program 4: [ 990.755859] input: syz0 as /devices/virtual/input/input22642 [ 990.996252] input: syz0 as /devices/virtual/input/input22658 22:50:50 executing program 4: 22:50:50 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0x0, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32=r2, @ANYBLOB], 0x1c) r3 = timerfd_create(0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r8}, 0x18, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r10) r11 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r11, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r11, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r11, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r11, 0x5501) r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r13, 0x1000008912, &(0x7f0000000140)) r14 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) r16 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r16, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r16, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r16, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r16, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r17 = gettid() ptrace$setopts(0x4206, r17, 0x0, 0x0) tkill(r17, 0x3b) ptrace$setregs(0xd, r17, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r17, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r18}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r20 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r21 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r21, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r21, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r21, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r21, 0x5501) r22 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r23 = gettid() ptrace$setopts(0x4206, r23, 0x0, 0x0) tkill(r23, 0x3b) ptrace$setregs(0xd, r23, 0x0, &(0x7f0000000080)) sendmsg$unix(r7, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147", 0x81}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r8, @ANYRES32=r10, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r6, @ANYRESHEX=r10, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r13, @ANYRES32=r3, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r14, @ANYRES32=r4, @ANYRES32=r15, @ANYRES32=r1, @ANYRES32=r16, @ANYRESOCT=r23, @ANYBLOB, @ANYRES32=r17, @ANYRES32=r18, @ANYRES32=r19, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r20, @ANYRES32=r14, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r22, @ANYRES32=r3], 0x183}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x40) 22:50:50 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc, 0x10001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0x0, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000000000000700000000000000", @ANYRES32, @ANYBLOB], 0x1c) r2 = timerfd_create(0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="0f34f800"], 0x4}}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r7}, 0x18, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r9) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r10, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r10, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r10, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r10, 0x5501) r11 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r11, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r12, 0x0, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r13 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r14, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r14, 0x405c5503, 0x0) ioctl$UI_DEV_CREATE(r14, 0x5501) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r15, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r15, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r15, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r16 = gettid() ptrace$setopts(0x4206, r16, 0x0, 0x0) tkill(r16, 0x3b) ptrace$setregs(0xd, r16, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r16, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r17}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r19 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x80001, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r20, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r20, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r20, 0x5501) r21 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r22 = gettid() ptrace$setopts(0x4206, r22, 0x0, 0x0) tkill(r22, 0x3b) ptrace$setregs(0xd, r22, 0x0, &(0x7f0000000080)) sendmsg$unix(r6, &(0x7f0000000780)={&(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce4620162e9d20", 0xab}, {&(0x7f0000000400)="ae8e61951e33840b8cb19af44288b844e40278b9045ce7d46c20d571ca6e6a0d814c469a9b8a31b6992950a859fedeebd389b52c40134cdb6cc1058ae1800f2c366027c43a7ecd86639d7f22b81cbbc4c25bca34569f752780c70a3476e21545c18bb74d955dbdfd0806a6cacd6daf54508aa8284627ecdbdbb38c1c21a0df6f8c7bca5bb0c23737d708b631b429f6004db5c0b4dcc19e1b140dd0640f27d9aac82e5d03abac8669700d07a31bdf01fa28d69a40c5a61e166cc08ca0dc32", 0xbe}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r7, @ANYRES32=r9, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r5, @ANYRESHEX=r9, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r12, @ANYRES32=r2, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r13, @ANYRES32=r3, @ANYRES32=r14, @ANYRES32=r1, @ANYRES32=r15, @ANYRESOCT=r22, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32, @ANYRES32=r17, @ANYRES32=r18, @ANYBLOB="00000000180000000000000001000000010000", @ANYRES32=r19, @ANYRES32=r13, @ANYBLOB="180000000000000001000000010000", @ANYRES32=r21, @ANYRES32=r2], 0x191}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x40) 22:50:50 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r3}, 0x18, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r5) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r6, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r6, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r6, 0x5501) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b00") socket$inet_udplite(0x2, 0x2, 0x88) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)='\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', r1}, 0x10) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r9 = gettid() ptrace$setopts(0x4206, r9, 0x0, 0x0) tkill(r9, 0x3b) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0), &(0x7f0000000600)=0xc) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r10, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r10, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r10, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r10, 0x5501) gettid() [ 991.024041] input: syz0 as /devices/virtual/input/input22665 22:50:50 executing program 4: 22:50:50 executing program 5: write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) r0 = gettid() tkill(r0, 0x3b) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r1, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r1, 0x5501) 22:50:50 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x1ec, 0x30, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [{0x90, 0x1, @m_simple={0x8c, 0x13, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xbdae, 0xffffffffffffffff, 0xc}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x3391, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x1, 0x0, 0x0, 0x4}}, @TCA_DEF_PARMS={0x18, 0x2, {0x20, 0xc895, 0x7}}]}, {0x14, 0x6, "de75116465b720ea060663b20e"}}}}, {0x148, 0x1, @m_skbedit={0x144, 0xb, {{0xc, 0x1, 'skbedit\x00'}, {0x54, 0x2, [@TCA_SKBEDIT_QUEUE_MAPPING={0x8}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0xd160, 0x888843b1c71fcf05, 0x7f, 0xeb99}}, @TCA_SKBEDIT_PRIORITY={0x1, 0x3, {0x6, 0x3}}, @TCA_SKBEDIT_MARK={0x8}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x80000000}]}, {0xdc, 0x6, "ec3daa26bf57c41477486d5b4b3833ac711582950218ba658f8bb52dfe920788b1be15b855aebcb574ecef29e93222f07fe4bf0abc1df553c349eb67da61b70659e8185909e120aa3521ad5970d751794b17607056887c7f5c67ebb7faa17ce03373992d5133412453ae7b75d78f1b846e8e464f2101293ebe96239c35016f75f1a2f42c3dc04ec730020b8bedf2458e6d5b1e4868826e9f2bf1a0e2ca66774658514296eb6e852b21cb42caa96c2d29d98e4489ba01c4c9d12bbe7f45fd290c1a0154fc96c99a72f29502a06f7ac50e8b9fd6e55b76"}}}}]}, 0x1ec}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'\x04\x00\x00\x00\x1eU\xc2\x8b\xfa\xc0\x12\xdcg\x00', 0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="2600000037010003e0070000", @ANYRES32=r2, @ANYBLOB], 0x10) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r5}, 0x18, 0x0) r6 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, r7) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r8, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r8, 0x5501) r9 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r9, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r10 = socket$inet_udplite(0x2, 0x2, 0x88) r11 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={0x0, r1}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r12, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r12, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r12, 0x5501) r13 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r13, 0x401c5504, &(0x7f0000000100)={0x400000100002f, {0x0, 0x0, 0x685e}}) ioctl$UI_SET_EVBIT(r13, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r13, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r13, 0x5501) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/attr/current\x00', 0x2, 0x0) r14 = gettid() ptrace$setopts(0x4206, r14, 0x0, 0x0) tkill(r14, 0x3b) ptrace$setregs(0xd, r14, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r14, 0x0, 0x0) stat(&(0x7f0000000640)='./bus\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000005c0)='./bus\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000980)=@v3={0x3000000, [{0xffffffff, 0x8}, {0x8}], r15}, 0x18, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) r17 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000640)='/dev/loop-control\x00', 0x0, 0x0) r18 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r18, 0x401c5504, &(0x7f0000000100)={0x400000100002f}) ioctl$UI_SET_EVBIT(r18, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r18, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00\x00\x00\x00\x00\x80\xa017\b\xec\xd6#\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00q\xab\x94%\x00\x00\xff\xff\xff\xff\xff\xff\xff\xe7\x00'}) ioctl$UI_DEV_CREATE(r18, 0x5501) r19 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) r20 = gettid() ptrace$setopts(0x4206, r20, 0x0, 0x0) tkill(r20, 0x3b) ptrace$setregs(0xffffffffffffffff, r20, 0x0, &(0x7f0000000080)) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000340)="1c5fe569e88171bc99befbcd0fcd011c387e3e44e49b2fa58bbd46cba034711b5c11e52e7799edc427c219cd72e9c33f82738edcdaf7b51f67ec40eb1f7c96b55536c78cbefe4465d75ecfbdcbe33ea7c522f9e343497464bc0fd71baa7e51af1d69cfbf8d032748a29ab61aa6045da24f42d6e85dabaccd8076d6bbad8d864147367795b5d12bef9bc9a064cd2ac820270ed950bcbcbb08841b4a4e66347e20d7248149ce46", 0xa6}, {0x0}], 0x2, &(0x7f0000000b40)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r5, @ANYRES32=r7, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32, @ANYRESHEX=r7, @ANYBLOB="1800fc000000578400000100000001000000daeca12a19364d8b88e27a92ac5db4aff997dc01e035347ba6fe3dbca93a81a8f4a325523c608d8b3a9d999e954dbee409ea655642792462caa48c3bf59d498861ca6fdeac5be4442d9ef1eb1ce75444c05059dca92a1102000000000000008fb51373fb35a4b33d79999293d1a15911891a78a47cc58daece41971009666e4b4403e7270800475b2b65695e71eb2a099383f0f9d3b6954e4568ad9f98ebe794738b771635a694c7", @ANYRES32=r10, @ANYRES32, @ANYBLOB="28000000000000000100000001000000", @ANYRES32=r11, @ANYRES32=r3, @ANYRES32=r12, @ANYRES32=r1, @ANYRES32=r13, @ANYRESOCT=r20, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r14, @ANYRES32=r15, @ANYRES32=r16, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r17, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r19, @ANYRES32], 0x18f}, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') tkill(r4, 0x40) [ 991.080389] input: syz0 as /devices/virtual/input/input22671 [ 991.244403] input: syz0 as /devices/virtual/input/input22684 [ 991.261040] input: syz0 as /devices/virtual/input/input22686 [ 991.277150] input: syz0 as /devices/virtual/input/input22688 22:50:50 executing program 4: [ 991.315441] input: syz0 as /devices/virtual/input/input22696 [ 991.532309] input: syz0 as /devices/virtual/input/input22709 ** 3 printk messages dropped ** [ 991.713141] uinput: write device info first [ 991.746678] input: syz0 as /devices/virtual/input/input22729 [ 991.832786] input: syz0 as /devices/virtual/input/input22738 [ 991.853419] input: syz0 as /devices/virtual/input/input22739 [ 991.969574] uinput: write device info first [ 992.036610] input: syz0 as /devices/virtual/input/input22756 [ 992.077203] input: syz0 as /devices/virtual/input/input22760 [ 992.105197] input: syz0 as /devices/virtual/input/input22759 [ 992.144657] input: syz0 as /devices/virtual/input/input22765 [ 992.169058] uinput: write device info first [ 992.317958] input: syz0 as /devices/virtual/input/input22777 [ 992.339796] input: syz0 as /devices/virtual/input/input22778 [ 992.384909] input: syz0 as /devices/virtual/input/input22786 [ 992.396498] uinput: write device info first [ 992.442948] input: syz0 as /devices/virtual/input/input22794 [ 992.568263] input: syz0 as /devices/virtual/input/input22804 [ 992.571857] uinput: write device info first [ 992.580634] input: syz0 as /devices/virtual/input/input22805 [ 992.675525] input: syz0 as /devices/virtual/input/input22816 [ 992.738830] input: syz0 as /devices/virtual/input/input22822 [ 992.751245] uinput: write device info first [ 992.805486] input: syz0 as /devices/virtual/input/input22829 [ 992.841399] selinux_nlmsg_perm: 126 callbacks suppressed [ 992.841408] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=311 sclass=netlink_route_socket pig=568 comm=syz-executor.4 [ 992.850730] input: syz0 as /devices/virtual/input/input22831 [ 992.852188] uinput: write device info first [ 992.922839] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=311 sclass=netlink_route_socket pig=577 comm=syz-executor.3 [ 992.968768] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=311 sclass=netlink_route_socket pig=583 comm=syz-executor.4 [ 992.979283] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=311 sclass=netlink_route_socket pig=585 comm=syz-executor.5 [ 992.990748] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=311 sclass=netlink_route_socket pig=590 comm=syz-executor.2 [ 993.003744] input: syz0 as /devices/virtual/input/input22849 [ 993.007196] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=311 sclass=netlink_route_socket pig=593 comm=syz-executor.0 [ 993.020371] uinput: write device info first [ 993.048894] input: syz0 as /devices/virtual/input/input22860 [ 993.076014] input: syz0 as /devices/virtual/input/input22863 [ 993.123128] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=311 sclass=netlink_route_socket pig=604 comm=syz-executor.3 [ 993.126357] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=311 sclass=netlink_route_socket pig=606 comm=syz-executor.1 [ 993.133062] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=311 sclass=netlink_route_socket pig=605 comm=syz-executor.2 [ 993.137468] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=311 sclass=netlink_route_socket pig=607 comm=syz-executor.4 [ 993.158936] input: syz0 as /devices/virtual/input/input22865 [ 993.166259] uinput: write device info first [ 993.213680] input: syz0 as /devices/virtual/input/input22875 [ 993.314617] input: syz0 as /devices/virtual/input/input22881 [ 993.347555] input: syz0 as /devices/virtual/input/input22884 [ 993.363468] uinput: write device info first [ 993.428340] input: syz0 as /devices/virtual/input/input22894 [ 993.514635] input: syz0 as /devices/virtual/input/input22897 [ 993.533422] uinput: write device info first [ 993.650398] input: syz0 as /devices/virtual/input/input22910 [ 993.727816] input: syz0 as /devices/virtual/input/input22918 [ 993.760578] input: syz0 as /devices/virtual/input/input22924 [ 993.772053] input: syz0 as /devices/virtual/input/input22925 [ 993.774286] uinput: write device info first [ 993.943658] input: syz0 as /devices/virtual/input/input22934 [ 993.965040] uinput: write device info first [ 994.042241] input: syz0 as /devices/virtual/input/input22948 [ 994.080426] input: syz0 as /devices/virtual/input/input22951 [ 994.090525] warn_alloc: 351 callbacks suppressed [ 994.090537] syz-executor.0: page allocation failure: order:9, mode:0x240c0c0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO) [ 994.090545] CPU: 1 PID: 722 Comm: syz-executor.0 Not tainted 4.9.141+ #1 [ 994.090558] ffff8800b329f6e8 ffffffff81b42e79 1ffff10016653edf ffff8801055caf80 [ 994.090566] ffffffff82a974e0 0000000000000001 0000000000400000 ffff8800b329f830 [ 994.090574] ffffffff814fc7c8 0000000041b58ab3 ffffffff82e37a10 ffffffff81427db0 [ 994.090576] Call Trace: [ 994.090591] [] dump_stack+0xc1/0x128 [ 994.090601] [] warn_alloc.cold.31+0x7f/0x9c [ 994.090610] [] ? zone_watermark_ok_safe+0x250/0x250 [ 994.090619] [] ? rcu_read_lock_sched_held+0x103/0x120 [ 994.090628] [] ? compaction_deferred+0x118/0x320 [ 994.090635] [] ? try_to_compact_pages+0x41/0x710 [ 994.090642] [] __alloc_pages_nodemask+0x628/0x1bd0 [ 994.090649] [] ? gfp_pfmemalloc_allowed+0x110/0x110 [ 994.090656] [] ? _raw_spin_unlock_irqrestore+0x6b/0x70 [ 994.090664] [] ? trace_hardirqs_on+0x10/0x10 [ 994.090672] [] ? migrate_swap_stop+0x810/0x810 [ 994.090679] [] ? mark_held_locks+0xc7/0x130 [ 994.090689] [] ? mutex_lock_interruptible_nested+0x7f3/0x9c0 [ 994.090696] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 994.090703] [] kmalloc_order+0x2a/0x70 [ 994.090710] [] kmalloc_order_trace+0x1f/0x190 [ 994.090719] [] __kmalloc+0x1ae/0x310 [ 994.090729] [] ? avc_has_extended_perms+0x56a/0xd90 [ 994.090736] [] ? avc_has_extended_perms+0xde/0xd90 [ 994.090746] [] input_mt_init_slots+0xcb/0x400 [ 994.090755] [] uinput_ioctl_handler.isra.4+0x161d/0x1980 [ 994.090762] [] ? avc_ss_reset+0x110/0x110 [ 994.090770] [] ? uinput_ff_upload_from_user+0x350/0x350 [ 994.090777] [] ? __lock_acquire+0x654/0x4a10 [ 994.090786] [] uinput_ioctl+0x4c/0x60 [ 994.090793] [] ? uinput_compat_ioctl+0x80/0x80 [ 994.090802] [] do_vfs_ioctl+0x1ac/0x11a0 [ 994.090810] [] ? ioctl_preallocate+0x220/0x220 [ 994.090819] [] ? selinux_parse_skb.constprop.42+0x1a90/0x1a90 [ 994.090827] [] ? check_preemption_disabled+0x3b/0x200 [ 994.090834] [] ? __fget+0x214/0x3d0 [ 994.090842] [] ? __fget+0x23b/0x3d0 [ 994.090848] [] ? __fget+0x47/0x3d0 [ 994.090855] [] ? security_file_ioctl+0x8f/0xc0 [ 994.090862] [] SyS_ioctl+0x8f/0xc0 [ 994.090869] [] ? do_vfs_ioctl+0x11a0/0x11a0 [ 994.090876] [] do_syscall_64+0x19f/0x550 [ 994.090884] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 994.090887] Mem-Info: [ 994.090904] active_anon:789179 inactive_anon:64326 isolated_anon:0 [ 994.090904] active_file:1459 inactive_file:564 isolated_file:0 [ 994.090904] unevictable:4 dirty:110 writeback:0 unstable:0 [ 994.090904] slab_reclaimable:9943 slab_unreclaimable:90086 [ 994.090904] mapped:71294 shmem:175170 pagetables:31025 bounce:0 [ 994.090904] free:33598 free_pcp:62 free_cma:0 [ 994.090917] Node 0 active_anon:3156716kB inactive_anon:257304kB active_file:5836kB inactive_file:2256kB unevictable:16kB isolated(anon):0kB isolated(file):0kB mapped:285176kB dirty:440kB writeback:0kB shmem:700680kB writeback_tmp:0kB unstable:0kB pages_scanned:0 all_unreclaimable? no [ 994.090935] DMA32 free:125048kB min:4696kB low:7712kB high:10728kB active_anon:525148kB inactive_anon:26932kB active_file:2820kB inactive_file:1820kB unevictable:0kB writepending:176kB present:3145324kB managed:3020132kB mlocked:0kB slab_reclaimable:9012kB slab_unreclaimable:147812kB kernel_stack:15968kB pagetables:35168kB bounce:0kB free_pcp:4kB local_pcp:4kB free_cma:0kB lowmem_reserve[]: 0 3505 3505 [ 994.090960] Normal free:9344kB min:5580kB low:9168kB high:12756kB active_anon:2631568kB inactive_anon:230372kB active_file:2980kB inactive_file:536kB unevictable:16kB writepending:264kB present:4718592kB managed:3589316kB mlocked:16kB slab_reclaimable:30760kB slab_unreclaimable:212532kB kernel_stack:26112kB pagetables:88932kB bounce:0kB free_pcp:244kB local_pcp:124kB free_cma:0kB lowmem_reserve[]: 0 0 0 [ 994.091007] DMA32: 51*4kB (UME) 58*8kB (UME) 139*16kB (UME) 47*32kB (UME) 363*64kB (UME) 208*128kB (UME) 133*256kB (UM) 70*512kB (U) 1*1024kB (M) 0*2048kB 0*4096kB = 125164kB Normal: 342*4kB (ME) 245*8kB (UE) 23*16kB (UME) 76*32kB (UME) 37*64kB (UM) 6*128kB (UME) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 9264kB 177238 total pagecache pages [ 994.091050] 0 pages in swap cache [ 994.091053] Swap cache stats: add 0, delete 0, find 0/0 [ 994.091055] Free swap = 0kB [ 994.091057] Total swap = 0kB [ 994.091060] 1965979 pages RAM [ 994.091062] 0 pages HighMem/MovableOnly [ 994.091064] 313617 pages reserved [ 994.103376] input: syz0 as /devices/virtual/input/input22953 [ 994.112074] syz-executor.3: page allocation failure: order:9, mode:0x240c0c0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO) [ 994.112082] CPU: 0 PID: 734 Comm: syz-executor.3 Not tainted 4.9.141+ #1 [ 994.112095] ffff880024ec76e8 ffffffff81b42e79 1ffff100049d8edf ffff8801058cc740 [ 994.112104] ffffffff82a974e0 0000000000000001 0000000000400000 ffff880024ec7830 [ 994.112114] ffffffff814fc7c8 0000000041b58ab3 ffffffff82e37a10 ffffffff81427db0 [ 994.112116] Call Trace: [ 994.112130] [] dump_stack+0xc1/0x128 [ 994.112140] [] warn_alloc.cold.31+0x7f/0x9c [ 994.112150] [] ? zone_watermark_ok_safe+0x250/0x250 [ 994.112158] [] ? rcu_read_lock_sched_held+0x103/0x120 [ 994.112168] [] ? compaction_deferred+0x118/0x320 [ 994.112176] [] ? try_to_compact_pages+0x41/0x710 [ 994.112184] [] __alloc_pages_nodemask+0x628/0x1bd0 [ 994.112193] [] ? gfp_pfmemalloc_allowed+0x110/0x110 [ 994.112201] [] ? _raw_spin_unlock_irqrestore+0x6b/0x70 [ 994.112209] [] ? trace_hardirqs_on+0x10/0x10 [ 994.112217] [] ? migrate_swap_stop+0x810/0x810 [ 994.112224] [] ? mark_held_locks+0xc7/0x130 [ 994.112234] [] ? mutex_lock_interruptible_nested+0x7f3/0x9c0 [ 994.112241] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 994.112248] [] kmalloc_order+0x2a/0x70 [ 994.112255] [] kmalloc_order_trace+0x1f/0x190 [ 994.112263] [] __kmalloc+0x1ae/0x310 [ 994.112273] [] ? avc_has_extended_perms+0x56a/0xd90 [ 994.112280] [] ? avc_has_extended_perms+0xde/0xd90 [ 994.112290] [] input_mt_init_slots+0xcb/0x400 [ 994.112299] [] uinput_ioctl_handler.isra.4+0x161d/0x1980 [ 994.112306] [] ? avc_ss_reset+0x110/0x110 [ 994.112313] [] ? uinput_ff_upload_from_user+0x350/0x350 [ 994.112320] [] ? __lock_acquire+0x654/0x4a10 [ 994.112328] [] uinput_ioctl+0x4c/0x60 [ 994.112336] [] ? uinput_compat_ioctl+0x80/0x80 [ 994.112345] [] do_vfs_ioctl+0x1ac/0x11a0 [ 994.112352] [] ? ioctl_preallocate+0x220/0x220 [ 994.112361] [] ? selinux_parse_skb.constprop.42+0x1a90/0x1a90 [ 994.112369] [] ? check_preemption_disabled+0x3b/0x200 [ 994.112376] [] ? __fget+0x214/0x3d0 [ 994.112383] [] ? __fget+0x23b/0x3d0 [ 994.112389] [] ? __fget+0x47/0x3d0 [ 994.112397] [] ? security_file_ioctl+0x8f/0xc0 [ 994.112404] [] SyS_ioctl+0x8f/0xc0 [ 994.112411] [] ? do_vfs_ioctl+0x11a0/0x11a0 [ 994.112418] [] do_syscall_64+0x19f/0x550 [ 994.112426] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 994.112429] Mem-Info: [ 994.112445] active_anon:789204 inactive_anon:64326 isolated_anon:0 [ 994.112445] active_file:1471 inactive_file:564 isolated_file:32 [ 994.112445] unevictable:4 dirty:110 writeback:0 unstable:0 [ 994.112445] slab_reclaimable:9943 slab_unreclaimable:90086 [ 994.112445] mapped:71344 shmem:175170 pagetables:31025 bounce:0 [ 994.112445] free:33524 free_pcp:0 free_cma:0 [ 994.112459] Node 0 active_anon:3156816kB inactive_anon:257304kB active_file:5884kB inactive_file:2256kB unevictable:16kB isolated(anon):0kB isolated(file):128kB mapped:285376kB dirty:440kB writeback:0kB shmem:700680kB writeback_tmp:0kB unstable:0kB pages_scanned:0 all_unreclaimable? no [ 994.112478] DMA32 free:124740kB min:4696kB low:7712kB high:10728kB active_anon:525248kB inactive_anon:26932kB active_file:2920kB inactive_file:1820kB unevictable:0kB writepending:176kB present:3145324kB managed:3020132kB mlocked:0kB slab_reclaimable:9012kB slab_unreclaimable:147812kB kernel_stack:16000kB pagetables:35168kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 3505 3505 [ 994.112503] Normal free:9356kB min:5580kB low:9168kB high:12756kB active_anon:2631568kB inactive_anon:230372kB active_file:2980kB inactive_file:396kB unevictable:16kB writepending:264kB present:4718592kB managed:3589316kB mlocked:16kB slab_reclaimable:30760kB slab_unreclaimable:212532kB kernel_stack:26112kB pagetables:88932kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 0 0 [ 994.112553] DMA32: 47*4kB (UME) 49*8kB (UME) 135*16kB (UE) 47*32kB (UME) 360*64kB (UME) 208*128kB (UME) 133*256kB (UM) 70*512kB (U) 1*1024kB (M) 0*2048kB 0*4096kB = 124820kB Normal: 354*4kB (UME) 254*8kB (UME) 29*16kB (UME) 75*32kB (UME) 37*64kB (UM) 6*128kB (UME) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 9448kB 177238 total pagecache pages [ 994.112596] 0 pages in swap cache [ 994.112599] Swap cache stats: add 0, delete 0, find 0/0 [ 994.112601] Free swap = 0kB [ 994.112604] Total swap = 0kB [ 994.112606] 1965979 pages RAM [ 994.112608] 0 pages HighMem/MovableOnly [ 994.112610] 313617 pages reserved [ 994.114108] syz-executor.0: page allocation failure: order:9, mode:0x240c0c0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO) [ 994.114116] CPU: 1 PID: 722 Comm: syz-executor.0 Not tainted 4.9.141+ #1 [ 994.114128] ffff8800b329f6e8 ffffffff81b42e79 1ffff10016653edf ffff8801055caf80 [ 994.114137] ffffffff82a974e0 0000000000000001 0000000000400000 ffff8800b329f830 [ 994.114146] ffffffff814fc7c8 0000000041b58ab3 ffffffff82e37a10 ffffffff81427db0 [ 994.114148] Call Trace: [ 994.114159] [] dump_stack+0xc1/0x128 [ 994.114168] [] warn_alloc.cold.31+0x7f/0x9c [ 994.114177] [] ? zone_watermark_ok_safe+0x250/0x250 [ 994.114184] [] ? rcu_read_lock_sched_held+0x103/0x120 [ 994.114193] [] ? compaction_deferred+0x118/0x320 [ 994.114200] [] ? try_to_compact_pages+0x41/0x710 [ 994.114213] [] __alloc_pages_nodemask+0x628/0x1bd0 [ 994.114222] [] ? gfp_pfmemalloc_allowed+0x110/0x110 [ 994.114230] [] ? _raw_spin_unlock_irqrestore+0x6b/0x70 [ 994.114237] [] ? trace_hardirqs_on+0x10/0x10 [ 994.114244] [] ? migrate_swap_stop+0x810/0x810 [ 994.114251] [] ? mark_held_locks+0xc7/0x130 [ 994.114259] [] ? mutex_lock_interruptible_nested+0x7f3/0x9c0 [ 994.114266] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 994.114273] [] kmalloc_order+0x2a/0x70 [ 994.114281] [] kmalloc_order_trace+0x1f/0x190 [ 994.114288] [] __kmalloc+0x1ae/0x310 [ 994.114298] [] ? avc_has_extended_perms+0x56a/0xd90 [ 994.114305] [] ? avc_has_extended_perms+0xde/0xd90 [ 994.114314] [] input_mt_init_slots+0xcb/0x400 [ 994.114322] [] uinput_ioctl_handler.isra.4+0x161d/0x1980 [ 994.114329] [] ? avc_ss_reset+0x110/0x110 [ 994.114337] [] ? uinput_ff_upload_from_user+0x350/0x350 [ 994.114344] [] ? __lock_acquire+0x654/0x4a10 [ 994.114352] [] uinput_ioctl+0x4c/0x60 [ 994.114365] [] ? uinput_compat_ioctl+0x80/0x80 [ 994.114373] [] do_vfs_ioctl+0x1ac/0x11a0 [ 994.114380] [] ? ioctl_preallocate+0x220/0x220 [ 994.114388] [] ? selinux_parse_skb.constprop.42+0x1a90/0x1a90 [ 994.114395] [] ? check_preemption_disabled+0x3b/0x200 [ 994.114402] [] ? __fget+0x214/0x3d0 [ 994.114409] [] ? __fget+0x23b/0x3d0 [ 994.114415] [] ? __fget+0x47/0x3d0 [ 994.114422] [] ? security_file_ioctl+0x8f/0xc0 [ 994.114429] [] SyS_ioctl+0x8f/0xc0 [ 994.114435] [] ? do_vfs_ioctl+0x11a0/0x11a0 [ 994.114442] [] do_syscall_64+0x19f/0x550 [ 994.114449] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 994.114479] Mem-Info: [ 994.114494] active_anon:789204 inactive_anon:64326 isolated_anon:0 [ 994.114494] active_file:1471 inactive_file:564 isolated_file:32 [ 994.114494] unevictable:4 dirty:110 writeback:0 unstable:0 [ 994.114494] slab_reclaimable:9943 slab_unreclaimable:90086 [ 994.114494] mapped:71294 shmem:175170 pagetables:31025 bounce:0 [ 994.114494] free:33440 free_pcp:111 free_cma:0 [ 994.114507] Node 0 active_anon:3156816kB inactive_anon:257304kB active_file:5884kB inactive_file:2256kB unevictable:16kB isolated(anon):0kB isolated(file):128kB mapped:285176kB dirty:440kB writeback:0kB shmem:700680kB writeback_tmp:0kB unstable:0kB pages_scanned:0 all_unreclaimable? no [ 994.114525] DMA32 free:124592kB min:4696kB low:7712kB high:10728kB active_anon:525248kB inactive_anon:26932kB active_file:2920kB inactive_file:1820kB unevictable:0kB writepending:176kB present:3145324kB managed:3020132kB mlocked:0kB slab_reclaimable:9012kB slab_unreclaimable:147812kB kernel_stack:16000kB pagetables:35168kB bounce:0kB free_pcp:204kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 3505 3505 [ 994.114550] Normal free:9168kB min:5580kB low:9168kB high:12756kB active_anon:2631568kB inactive_anon:230372kB active_file:2980kB inactive_file:396kB unevictable:16kB writepending:264kB present:4718592kB managed:3589316kB mlocked:16kB slab_reclaimable:30760kB slab_unreclaimable:212532kB kernel_stack:26112kB pagetables:88932kB bounce:0kB free_pcp:240kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 0 0 [ 994.114597] DMA32: 15*4kB (UE) 51*8kB (UME) 135*16kB (UE) 45*32kB (UE) 360*64kB (UME) 208*128kB (UME) 133*256kB (UM) 70*512kB (U) 1*1024kB (M) 0*2048kB 0*4096kB = 124644kB Normal: 341*4kB (E) 245*8kB (ME) 22*16kB (UE) 75*32kB (UME) 37*64kB (UM) 6*128kB (UME) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 9212kB 177238 total pagecache pages [ 994.114640] 0 pages in swap cache [ 994.114644] Swap cache stats: add 0, delete 0, find 0/0 [ 994.114646] Free swap = 0kB [ 994.114648] Total swap = 0kB [ 994.114650] 1965979 pages RAM [ 994.114652] 0 pages HighMem/MovableOnly [ 994.114654] 313617 pages reserved [ 994.117452] input: syz0 as /devices/virtual/input/input22956 [ 994.121782] syz-executor.3: page allocation failure: order:9, mode:0x240c0c0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO) [ 994.121790] CPU: 0 PID: 734 Comm: syz-executor.3 Not tainted 4.9.141+ #1 [ 994.121801] ffff880024ec76e8 ffffffff81b42e79 1ffff100049d8edf ffff8801058cc740 [ 994.121811] ffffffff82a974e0 0000000000000001 0000000000400000 ffff880024ec7830 [ 994.121821] ffffffff814fc7c8 0000000041b58ab3 ffffffff82e37a10 ffffffff81427db0 [ 994.121822] Call Trace: [ 994.121833] [] dump_stack+0xc1/0x128 [ 994.121842] [] warn_alloc.cold.31+0x7f/0x9c [ 994.121851] [] ? zone_watermark_ok_safe+0x250/0x250 [ 994.121865] [] ? rcu_read_lock_sched_held+0x103/0x120 [ 994.121874] [] ? compaction_deferred+0x118/0x320 [ 994.121881] [] ? try_to_compact_pages+0x41/0x710 [ 994.121890] [] __alloc_pages_nodemask+0x628/0x1bd0 [ 994.121899] [] ? gfp_pfmemalloc_allowed+0x110/0x110 [ 994.121906] [] ? _raw_spin_unlock_irqrestore+0x6b/0x70 [ 994.121914] [] ? trace_hardirqs_on+0x10/0x10 [ 994.121922] [] ? migrate_swap_stop+0x810/0x810 [ 994.121929] [] ? mark_held_locks+0xc7/0x130 [ 994.121938] [] ? mutex_lock_interruptible_nested+0x7f3/0x9c0 [ 994.121945] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 994.121952] [] kmalloc_order+0x2a/0x70 [ 994.121959] [] kmalloc_order_trace+0x1f/0x190 [ 994.121968] [] __kmalloc+0x1ae/0x310 [ 994.121977] [] ? avc_has_extended_perms+0x56a/0xd90 [ 994.121984] [] ? avc_has_extended_perms+0xde/0xd90 [ 994.121994] [] input_mt_init_slots+0xcb/0x400 [ 994.122003] [] uinput_ioctl_handler.isra.4+0x161d/0x1980 [ 994.122010] [] ? avc_ss_reset+0x110/0x110 [ 994.122018] [] ? uinput_ff_upload_from_user+0x350/0x350 [ 994.122025] [] ? __lock_acquire+0x654/0x4a10 [ 994.122033] [] uinput_ioctl+0x4c/0x60 [ 994.122041] [] ? uinput_compat_ioctl+0x80/0x80 [ 994.122049] [] do_vfs_ioctl+0x1ac/0x11a0 [ 994.122057] [] ? ioctl_preallocate+0x220/0x220 [ 994.122065] [] ? selinux_parse_skb.constprop.42+0x1a90/0x1a90 [ 994.122073] [] ? check_preemption_disabled+0x3b/0x200 [ 994.122081] [] ? __fget+0x214/0x3d0 [ 994.122088] [] ? __fget+0x23b/0x3d0 [ 994.122094] [] ? __fget+0x47/0x3d0 [ 994.122101] [] ? security_file_ioctl+0x8f/0xc0 [ 994.122109] [] SyS_ioctl+0x8f/0xc0 [ 994.122116] [] ? do_vfs_ioctl+0x11a0/0x11a0 [ 994.122122] [] do_syscall_64+0x19f/0x550 [ 994.122130] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 994.122133] Mem-Info: [ 994.122149] active_anon:789204 inactive_anon:64326 isolated_anon:0 [ 994.122149] active_file:1471 inactive_file:564 isolated_file:32 [ 994.122149] unevictable:4 dirty:110 writeback:0 unstable:0 [ 994.122149] slab_reclaimable:9943 slab_unreclaimable:90111 [ 994.122149] mapped:71344 shmem:175170 pagetables:31025 bounce:0 [ 994.122149] free:33489 free_pcp:0 free_cma:0 [ 994.122163] Node 0 active_anon:3156816kB inactive_anon:257304kB active_file:5884kB inactive_file:2256kB unevictable:16kB isolated(anon):0kB isolated(file):128kB mapped:285376kB dirty:440kB writeback:0kB shmem:700680kB writeback_tmp:0kB unstable:0kB pages_scanned:0 all_unreclaimable? no [ 994.122181] DMA32 free:124588kB min:4696kB low:7712kB high:10728kB active_anon:525248kB inactive_anon:26932kB active_file:2920kB inactive_file:1820kB unevictable:0kB writepending:176kB present:3145324kB managed:3020132kB mlocked:0kB slab_reclaimable:9012kB slab_unreclaimable:147912kB kernel_stack:16000kB pagetables:35168kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 3505 3505 [ 994.122206] Normal free:9368kB min:5580kB low:9168kB high:12756kB active_anon:2631568kB inactive_anon:230372kB active_file:2980kB inactive_file:396kB unevictable:16kB writepending:264kB present:4718592kB managed:3589316kB mlocked:16kB slab_reclaimable:30760kB slab_unreclaimable:212532kB kernel_stack:26112kB pagetables:88932kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 0 0 [ 994.122257] DMA32: 15*4kB (UE) 51*8kB (UME) 136*16kB (UME) 45*32kB (UE) 359*64kB (UME) 208*128kB (UME) 133*256kB (UM) 70*512kB (U) 1*1024kB (M) 0*2048kB 0*4096kB = 124596kB Normal: 351*4kB (UME) 256*8kB (UME) 29*16kB (UME) 75*32kB (UME) 37*64kB (UM) 6*128kB (UME) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 9452kB 177238 total pagecache pages [ 994.122301] 0 pages in swap cache [ 994.122305] Swap cache stats: add 0, delete 0, find 0/0 [ 994.122307] Free swap = 0kB [ 994.122309] Total swap = 0kB [ 994.122311] 1965979 pages RAM [ 994.122313] 0 pages HighMem/MovableOnly [ 994.122315] 313617 pages reserved [ 994.125103] syz-executor.4: page allocation failure: order:9, mode:0x240c0c0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO) [ 994.125110] CPU: 1 PID: 738 Comm: syz-executor.4 Not tainted 4.9.141+ #1 [ 994.125121] ffff8800352d76e8 ffffffff81b42e79 1ffff10006a5aedf ffff880101eeaf80 [ 994.125130] ffffffff82a974e0 0000000000000001 0000000000400000 ffff8800352d7830 [ 994.125139] ffffffff814fc7c8 0000000041b58ab3 ffffffff82e37a10 ffffffff81427db0 [ 994.125141] Call Trace: [ 994.125151] [] dump_stack+0xc1/0x128 [ 994.125159] [] warn_alloc.cold.31+0x7f/0x9c [ 994.125167] [] ? zone_watermark_ok_safe+0x250/0x250 [ 994.125174] [] ? rcu_read_lock_sched_held+0x103/0x120 [ 994.125183] [] ? compaction_deferred+0x118/0x320 [ 994.125194] [] ? try_to_compact_pages+0x41/0x710 [ 994.125203] [] __alloc_pages_nodemask+0x628/0x1bd0 [ 994.125211] [] ? gfp_pfmemalloc_allowed+0x110/0x110 [ 994.125218] [] ? _raw_spin_unlock_irqrestore+0x6b/0x70 [ 994.125225] [] ? trace_hardirqs_on+0x10/0x10 [ 994.125232] [] ? migrate_swap_stop+0x810/0x810 [ 994.125238] [] ? mark_held_locks+0xc7/0x130 [ 994.125246] [] ? mutex_lock_interruptible_nested+0x7f3/0x9c0 [ 994.125253] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 994.125259] [] kmalloc_order+0x2a/0x70 [ 994.125266] [] kmalloc_order_trace+0x1f/0x190 [ 994.125273] [] __kmalloc+0x1ae/0x310 [ 994.125281] [] ? avc_has_extended_perms+0x56a/0xd90 [ 994.125288] [] ? avc_has_extended_perms+0xde/0xd90 [ 994.125296] [] input_mt_init_slots+0xcb/0x400 [ 994.125304] [] uinput_ioctl_handler.isra.4+0x161d/0x1980 [ 994.125310] [] ? avc_ss_reset+0x110/0x110 [ 994.125318] [] ? uinput_ff_upload_from_user+0x350/0x350 [ 994.125324] [] ? __lock_acquire+0x654/0x4a10 [ 994.125332] [] uinput_ioctl+0x4c/0x60 [ 994.125340] [] ? uinput_compat_ioctl+0x80/0x80 [ 994.125346] [] do_vfs_ioctl+0x1ac/0x11a0 [ 994.125353] [] ? ioctl_preallocate+0x220/0x220 [ 994.125366] [] ? selinux_parse_skb.constprop.42+0x1a90/0x1a90 [ 994.125374] [] ? check_preemption_disabled+0x3b/0x200 [ 994.125380] [] ? __fget+0x214/0x3d0 [ 994.125387] [] ? __fget+0x23b/0x3d0 [ 994.125393] [] ? __fget+0x47/0x3d0 [ 994.125400] [] ? security_file_ioctl+0x8f/0xc0 [ 994.125406] [] SyS_ioctl+0x8f/0xc0 [ 994.125413] [] ? do_vfs_ioctl+0x11a0/0x11a0 [ 994.125419] [] do_syscall_64+0x19f/0x550 [ 994.125426] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 994.125452] Mem-Info: [ 994.125468] active_anon:789204 inactive_anon:64326 isolated_anon:0 [ 994.125468] active_file:1471 inactive_file:564 isolated_file:32 [ 994.125468] unevictable:4 dirty:110 writeback:0 unstable:0 [ 994.125468] slab_reclaimable:9943 slab_unreclaimable:90111 [ 994.125468] mapped:71344 shmem:175170 pagetables:31025 bounce:0 [ 994.125468] free:33489 free_pcp:0 free_cma:0 [ 994.125480] Node 0 active_anon:3156816kB inactive_anon:257304kB active_file:5884kB inactive_file:2256kB unevictable:16kB isolated(anon):0kB isolated(file):128kB mapped:285376kB dirty:440kB writeback:0kB shmem:700680kB writeback_tmp:0kB unstable:0kB pages_scanned:0 all_unreclaimable? no [ 994.125498] DMA32 free:124588kB min:4696kB low:7712kB high:10728kB active_anon:525248kB inactive_anon:26932kB active_file:2920kB inactive_file:1820kB unevictable:0kB writepending:176kB present:3145324kB managed:3020132kB mlocked:0kB slab_reclaimable:9012kB slab_unreclaimable:147912kB kernel_stack:16000kB pagetables:35168kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 3505 3505 [ 994.125522] Normal free:9368kB min:5580kB low:9168kB high:12756kB active_anon:2631568kB inactive_anon:230372kB active_file:2980kB inactive_file:396kB unevictable:16kB writepending:264kB present:4718592kB managed:3589316kB mlocked:16kB slab_reclaimable:30760kB slab_unreclaimable:212532kB kernel_stack:26112kB pagetables:88932kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 0 0 [ 994.125569] DMA32: 15*4kB (UE) 51*8kB (UME) 136*16kB (UME) 45*32kB (UE) 359*64kB (UME) 208*128kB (UME) 133*256kB (UM) 70*512kB (U) 1*1024kB (M) 0*2048kB 0*4096kB = 124596kB Normal: 351*4kB (UME) 256*8kB (UME) 29*16kB (UME) 75*32kB (UME) 37*64kB (UM) 6*128kB (UME) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 9452kB 177238 total pagecache pages [ 994.125608] 0 pages in swap cache [ 994.125611] Swap cache stats: add 0, delete 0, find 0/0 [ 994.125613] Free swap = 0kB [ 994.125615] Total swap = 0kB [ 994.125617] 1965979 pages RAM [ 994.125619] 0 pages HighMem/MovableOnly [ 994.125621] 313617 pages reserved [ 994.132079] syz-executor.4: page allocation failure: order:9, mode:0x240c0c0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO) [ 994.132086] CPU: 1 PID: 738 Comm: syz-executor.4 Not tainted 4.9.141+ #1 [ 994.132098] ffff8800352d76e8 ffffffff81b42e79 1ffff10006a5aedf ffff880101eeaf80 [ 994.132107] ffffffff82a974e0 0000000000000001 0000000000400000 ffff8800352d7830 [ 994.132120] ffffffff814fc7c8 0000000041b58ab3 ffffffff82e37a10 ffffffff81427db0 [ 994.132122] Call Trace: [ 994.132132] [] dump_stack+0xc1/0x128 [ 994.132139] [] warn_alloc.cold.31+0x7f/0x9c [ 994.132148] [] ? zone_watermark_ok_safe+0x250/0x250 [ 994.132155] [] ? rcu_read_lock_sched_held+0x103/0x120 [ 994.132163] [] ? compaction_deferred+0x118/0x320 [ 994.132170] [] ? try_to_compact_pages+0x41/0x710 [ 994.132178] [] __alloc_pages_nodemask+0x628/0x1bd0 [ 994.132186] [] ? gfp_pfmemalloc_allowed+0x110/0x110 [ 994.132193] [] ? _raw_spin_unlock_irqrestore+0x6b/0x70 [ 994.132200] [] ? trace_hardirqs_on+0x10/0x10 [ 994.132206] [] ? migrate_swap_stop+0x810/0x810 [ 994.132213] [] ? mark_held_locks+0xc7/0x130 [ 994.132222] [] ? mutex_lock_interruptible_nested+0x7f3/0x9c0 [ 994.132228] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 994.132235] [] kmalloc_order+0x2a/0x70 [ 994.132241] [] kmalloc_order_trace+0x1f/0x190 [ 994.132249] [] __kmalloc+0x1ae/0x310 [ 994.132257] [] ? avc_has_extended_perms+0x56a/0xd90 [ 994.132264] [] ? avc_has_extended_perms+0xde/0xd90 [ 994.132272] [] input_mt_init_slots+0xcb/0x400 [ 994.132280] [] uinput_ioctl_handler.isra.4+0x161d/0x1980 [ 994.132286] [] ? avc_ss_reset+0x110/0x110 [ 994.132294] [] ? uinput_ff_upload_from_user+0x350/0x350 [ 994.132300] [] ? __lock_acquire+0x654/0x4a10 [ 994.132308] [] uinput_ioctl+0x4c/0x60 [ 994.132315] [] ? uinput_compat_ioctl+0x80/0x80 [ 994.132322] [] do_vfs_ioctl+0x1ac/0x11a0 [ 994.132329] [] ? ioctl_preallocate+0x220/0x220 [ 994.132337] [] ? selinux_parse_skb.constprop.42+0x1a90/0x1a90 [ 994.132345] [] ? check_preemption_disabled+0x3b/0x200 [ 994.132352] [] ? __fget+0x214/0x3d0 [ 994.132364] [] ? __fget+0x23b/0x3d0 [ 994.132370] [] ? __fget+0x47/0x3d0 [ 994.132377] [] ? security_file_ioctl+0x8f/0xc0 [ 994.132384] [] SyS_ioctl+0x8f/0xc0 [ 994.132391] [] ? do_vfs_ioctl+0x11a0/0x11a0 [ 994.132398] [] do_syscall_64+0x19f/0x550 [ 994.132405] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 994.134861] Mem-Info: [ 994.134879] active_anon:789254 inactive_anon:64326 isolated_anon:0 [ 994.134879] active_file:1471 inactive_file:564 isolated_file:32 [ 994.134879] unevictable:4 dirty:110 writeback:0 unstable:0 [ 994.134879] slab_reclaimable:9943 slab_unreclaimable:90111 [ 994.134879] mapped:71394 shmem:175170 pagetables:31025 bounce:0 [ 994.134879] free:33395 free_pcp:79 free_cma:0 [ 994.134891] Node 0 active_anon:3157016kB inactive_anon:257304kB active_file:5884kB inactive_file:2256kB unevictable:16kB isolated(anon):0kB isolated(file):128kB mapped:285576kB dirty:440kB writeback:0kB shmem:700680kB writeback_tmp:0kB unstable:0kB pages_scanned:0 all_unreclaimable? no [ 994.134907] DMA32 free:124424kB min:4696kB low:7712kB high:10728kB active_anon:525348kB inactive_anon:26932kB active_file:2920kB inactive_file:1820kB unevictable:0kB writepending:176kB present:3145324kB managed:3020132kB mlocked:0kB slab_reclaimable:9012kB slab_unreclaimable:147912kB kernel_stack:16000kB pagetables:35168kB bounce:0kB free_pcp:108kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 3505 3505 [ 994.134934] Normal free:9156kB min:5580kB low:9168kB high:12756kB active_anon:2631568kB inactive_anon:230372kB active_file:2980kB inactive_file:396kB unevictable:16kB writepending:264kB present:4718592kB managed:3589316kB mlocked:16kB slab_reclaimable:30760kB slab_unreclaimable:212532kB kernel_stack:26112kB pagetables:88932kB bounce:0kB free_pcp:208kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: [ 994.135972] syz-executor.3: page allocation failure: order:9, mode:0x240c0c0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO) [ 994.135981] CPU: 0 PID: 729 Comm: syz-executor.3 Not tainted 4.9.141+ #1 [ 994.135995] ffff8800b3b7f6e8 ffffffff81b42e79 1ffff1001676fedf ffff8800b2fa17c0 [ 994.136008] ffffffff82a974e0 0000000000000001 0000000000400000 ffff8800b3b7f830 [ 994.136020] ffffffff814fc7c8 0000000041b58ab3 ffffffff82e37a10 ffffffff81427db0 [ 994.136022] Call Trace: [ 994.136034] [] dump_stack+0xc1/0x128 [ 994.136043] [] warn_alloc.cold.31+0x7f/0x9c [ 994.136052] [] ? zone_watermark_ok_safe+0x250/0x250 [ 994.136061] [] ? rcu_read_lock_sched_held+0x103/0x120 [ 994.136069] [] ? compaction_deferred+0x118/0x320 [ 994.136078] [] ? try_to_compact_pages+0x41/0x710 [ 994.136087] [] __alloc_pages_nodemask+0x628/0x1bd0 [ 994.136097] [] ? gfp_pfmemalloc_allowed+0x110/0x110 [ 994.136106] [] ? drop_futex_key_refs.isra.2+0x56/0xd0 [ 994.136114] [] ? trace_hardirqs_on+0x10/0x10 [ 994.136122] [] ? futex_wait_setup+0x330/0x330 [ 994.136130] [] ? mark_held_locks+0xc7/0x130 [ 994.136139] [] ? mutex_lock_interruptible_nested+0x7f3/0x9c0 [ 994.136147] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 994.136154] [] kmalloc_order+0x2a/0x70 [ 994.136162] [] kmalloc_order_trace+0x1f/0x190 [ 994.136170] [] __kmalloc+0x1ae/0x310 [ 994.136179] [] ? avc_has_extended_perms+0x56a/0xd90 [ 994.136187] [] ? avc_has_extended_perms+0xde/0xd90 [ 994.136196] [] input_mt_init_slots+0xcb/0x400 [ 994.136205] [] uinput_ioctl_handler.isra.4+0x161d/0x1980 [ 994.136212] [] ? avc_ss_reset+0x110/0x110 [ 994.136221] [] ? uinput_ff_upload_from_user+0x350/0x350 [ 994.136228] [] ? __lock_acquire+0x654/0x4a10 [ 994.136237] [] uinput_ioctl+0x4c/0x60 [ 994.136246] [] ? uinput_compat_ioctl+0x80/0x80 [ 994.136254] [] do_vfs_ioctl+0x1ac/0x11a0 [ 994.136262] [] ? ioctl_preallocate+0x220/0x220 [ 994.136271] [] ? selinux_parse_skb.constprop.42+0x1a90/0x1a90 [ 994.136279] [] ? check_preemption_disabled+0x3b/0x200 [ 994.136287] [] ? __fget+0x214/0x3d0 [ 994.136294] [] ? __fget+0x23b/0x3d0 [ 994.136301] [] ? __fget+0x47/0x3d0 [ 994.136310] [] ? security_file_ioctl+0x8f/0xc0 [ 994.136317] [] SyS_ioctl+0x8f/0xc0 [ 994.136324] [] ? do_vfs_ioctl+0x11a0/0x11a0 [ 994.136330] [] do_syscall_64+0x19f/0x550 [ 994.136336] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 994.136338] Mem-Info: [ 994.136357] active_anon:789254 inactive_anon:64326 isolated_anon:0 [ 994.136357] active_file:1471 inactive_file:564 isolated_file:32 [ 994.136357] unevictable:4 dirty:110 writeback:0 unstable:0 [ 994.136357] slab_reclaimable:9943 slab_unreclaimable:90111 [ 994.136357] mapped:71394 shmem:175170 pagetables:31025 bounce:0 [ 994.136357] free:33470 free_pcp:0 free_cma:0 [ 994.136371] Node 0 active_anon:3157016kB inactive_anon:257304kB active_file:5884kB inactive_file:2256kB unevictable:16kB isolated(anon):0kB isolated(file):128kB mapped:285576kB dirty:440kB writeback:0kB shmem:700680kB writeback_tmp:0kB unstable:0kB pages_scanned:0 all_unreclaimable? no [ 994.136391] DMA32 free:124524kB min:4696kB low:7712kB high:10728kB active_anon:525348kB inactive_anon:26932kB active_file:2920kB inactive_file:1820kB unevictable:0kB writepending:176kB present:3145324kB managed:3020132kB mlocked:0kB slab_reclaimable:9012kB slab_unreclaimable:147912kB kernel_stack:16000kB pagetables:35168kB bounce:0kB free_pcp:4kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 3505 3505 [ 994.136417] Normal free:9356kB min:5580kB low:9168kB high:12756kB active_anon:2631568kB inactive_anon:230372kB active_file:2980kB inactive_file:396kB unevictable:16kB writepending:264kB present:4718592kB managed:3589316kB mlocked:16kB slab_reclaimable:30760kB slab_unreclaimable:212532kB kernel_stack:26112kB pagetables:88932kB bounce:0kB free_pcp:8kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 0 0 [ 994.136471] DMA32: 12*4kB (E) 48*8kB (UE) 136*16kB (UME) 45*32kB (UE) 359*64kB (UME) 208*128kB (UME) 133*256kB (UM) 70*512kB (U) 1*1024kB (M) 0*2048kB 0*4096kB = 124560kB Normal: 346*4kB (UME) 251*8kB (UME) 29*16kB (UME) 75*32kB (UME) 37*64kB (UM) 6*128kB (UME) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 9392kB 177238 total pagecache pages [ 994.136517] 0 pages in swap cache [ 994.136521] Swap cache stats: add 0, delete 0, find 0/0 [ 994.136523] Free swap = 0kB [ 994.136526] Total swap = 0kB [ 994.136528] 1965979 pages RAM [ 994.136530] 0 pages HighMem/MovableOnly [ 994.136532] 313617 pages reserved [ 994.139251] 0 0 0 DMA32: 14*4kB (UME) 34*8kB (UE) 135*16kB (UME) 47*32kB (UE) 357*64kB (UE) 208*128kB (UME) 133*256kB (UM) 70*512kB (U) 1*1024kB (M) 0*2048kB 0*4096kB = 124376kB Normal: 342*4kB (UE) 244*8kB (E) 22*16kB (UME) 74*32kB (UME) 37*64kB (UM) 6*128kB (UME) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 9176kB 177275 total pagecache pages [ 994.139367] 0 pages in swap cache [ 994.139371] Swap cache stats: add 0, delete 0, find 0/0 [ 994.139374] Free swap = 0kB [ 994.139375] Total swap = 0kB [ 994.139378] 1965979 pages RAM [ 994.139380] 0 pages HighMem/MovableOnly [ 994.139382] 313617 pages reserved [ 994.140954] syz-executor.4: page allocation failure: order:9, mode:0x240c0c0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO) [ 994.140961] CPU: 1 PID: 738 Comm: syz-executor.4 Not tainted 4.9.141+ #1 [ 994.140974] ffff8800352d76e8 ffffffff81b42e79 1ffff10006a5aedf ffff880101eeaf80 [ 994.140984] ffffffff82a974e0 0000000000000001 0000000000400000 ffff8800352d7830 [ 994.140994] ffffffff814fc7c8 0000000041b58ab3 ffffffff82e37a10 ffffffff81427db0 [ 994.140995] Call Trace: [ 994.141005] [] dump_stack+0xc1/0x128 [ 994.141013] [] warn_alloc.cold.31+0x7f/0x9c [ 994.141022] [] ? zone_watermark_ok_safe+0x250/0x250 [ 994.141030] [] ? rcu_read_lock_sched_held+0x103/0x120 [ 994.141038] [] ? compaction_deferred+0x118/0x320 [ 994.141046] [] ? try_to_compact_pages+0x41/0x710 [ 994.141054] [] __alloc_pages_nodemask+0x628/0x1bd0 [ 994.141067] [] ? gfp_pfmemalloc_allowed+0x110/0x110 [ 994.141075] [] ? _raw_spin_unlock_irqrestore+0x6b/0x70 [ 994.141082] [] ? trace_hardirqs_on+0x10/0x10 [ 994.141089] [] ? migrate_swap_stop+0x810/0x810 [ 994.141096] [] ? mark_held_locks+0xc7/0x130 [ 994.141105] [] ? mutex_lock_interruptible_nested+0x7f3/0x9c0 [ 994.141112] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 994.141119] [] kmalloc_order+0x2a/0x70 [ 994.141127] [] kmalloc_order_trace+0x1f/0x190 [ 994.141134] [] __kmalloc+0x1ae/0x310 [ 994.141142] [] ? avc_has_extended_perms+0x56a/0xd90 [ 994.141149] [] ? avc_has_extended_perms+0xde/0xd90 [ 994.141157] [] input_mt_init_slots+0xcb/0x400 [ 994.141166] [] uinput_ioctl_handler.isra.4+0x161d/0x1980 [ 994.141173] [] ? avc_ss_reset+0x110/0x110 [ 994.141181] [] ? uinput_ff_upload_from_user+0x350/0x350 [ 994.141187] [] ? __lock_acquire+0x654/0x4a10 [ 994.141196] [] uinput_ioctl+0x4c/0x60 [ 994.141203] [] ? uinput_compat_ioctl+0x80/0x80 [ 994.141211] [] do_vfs_ioctl+0x1ac/0x11a0 [ 994.141218] [] ? ioctl_preallocate+0x220/0x220 [ 994.141227] [] ? selinux_parse_skb.constprop.42+0x1a90/0x1a90 [ 994.141235] [] ? check_preemption_disabled+0x3b/0x200 [ 994.141242] [] ? __fget+0x214/0x3d0 [ 994.141248] [] ? __fget+0x23b/0x3d0 [ 994.141255] [] ? __fget+0x47/0x3d0 [ 994.141262] [] ? security_file_ioctl+0x8f/0xc0 [ 994.141270] [] SyS_ioctl+0x8f/0xc0 [ 994.141277] [] ? do_vfs_ioctl+0x11a0/0x11a0 [ 994.141283] [] do_syscall_64+0x19f/0x550 [ 994.141290] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 994.141307] Mem-Info: [ 994.141322] active_anon:789254 inactive_anon:64326 isolated_anon:0 [ 994.141322] active_file:1471 inactive_file:564 isolated_file:32 [ 994.141322] unevictable:4 dirty:110 writeback:0 unstable:0 [ 994.141322] slab_reclaimable:9943 slab_unreclaimable:90111 [ 994.141322] mapped:71394 shmem:175170 pagetables:31025 bounce:0 [ 994.141322] free:33458 free_pcp:28 free_cma:0 [ 994.141334] Node 0 active_anon:3157016kB inactive_anon:257304kB active_file:5884kB inactive_file:2256kB unevictable:16kB isolated(anon):0kB isolated(file):128kB mapped:285576kB dirty:440kB writeback:0kB shmem:700680kB writeback_tmp:0kB unstable:0kB pages_scanned:0 all_unreclaimable? no [ 994.141351] DMA32 free:124616kB min:4696kB low:7712kB high:10728kB active_anon:525448kB inactive_anon:26932kB active_file:2920kB inactive_file:1820kB unevictable:0kB writepending:176kB present:3145324kB managed:3020132kB mlocked:0kB slab_reclaimable:9012kB slab_unreclaimable:147912kB kernel_stack:15936kB pagetables:35168kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 3505 3505 [ 994.141380] Normal free:9216kB min:5580kB low:9168kB high:12756kB active_anon:2631568kB inactive_anon:230372kB active_file:2980kB inactive_file:396kB unevictable:16kB writepending:264kB present:4718592kB managed:3589316kB mlocked:16kB slab_reclaimable:30760kB slab_unreclaimable:212532kB kernel_stack:26112kB pagetables:88932kB bounce:0kB free_pcp:112kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 0 0 [ 994.141442] DMA32: 63*4kB (UME) 42*8kB (UME) 136*16kB (UME) 48*32kB (UME) 358*64kB (UME) 208*128kB (UME) 133*256kB (UM) 70*512kB (U) 1*1024kB (M) 0*2048kB 0*4096kB = 124748kB Normal: 344*4kB (ME) 245*8kB (ME) 22*16kB (UME) 74*32kB (UME) 37*64kB (UM) 6*128kB (UME) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 9192kB 177275 total pagecache pages [ 994.141482] 0 pages in swap cache [ 994.141486] Swap cache stats: add 0, delete 0, find 0/0 [ 994.141488] Free swap = 0kB [ 994.141489] Total swap = 0kB [ 994.141491] 1965979 pages RAM [ 994.141493] 0 pages HighMem/MovableOnly [ 994.141495] 313617 pages reserved [ 994.144734] syz-executor.2: page allocation failure: order:9, mode:0x240c0c0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO) [ 994.144740] CPU: 0 PID: 737 Comm: syz-executor.2 Not tainted 4.9.141+ #1 [ 994.144751] ffff880040aaf6e8 ffffffff81b42e79 1ffff10008155edf ffff8801cbf20000 [ 994.144760] ffffffff82a974e0 0000000000000001 0000000000400000 ffff880040aaf830 [ 994.144770] ffffffff814fc7c8 0000000041b58ab3 ffffffff82e37a10 ffffffff81427db0 [ 994.144771] Call Trace: [ 994.144781] [] dump_stack+0xc1/0x128 [ 994.144789] [] warn_alloc.cold.31+0x7f/0x9c [ 994.144797] [] ? zone_watermark_ok_safe+0x250/0x250 [ 994.144805] [] ? rcu_read_lock_sched_held+0x103/0x120 [ 994.144813] [] ? compaction_deferred+0x118/0x320 [ 994.144821] [] ? try_to_compact_pages+0x41/0x710 [ 994.144829] [] __alloc_pages_nodemask+0x628/0x1bd0 [ 994.144838] [] ? gfp_pfmemalloc_allowed+0x110/0x110 [ 994.144844] [] ? _raw_spin_unlock_irqrestore+0x6b/0x70 [ 994.144852] [] ? trace_hardirqs_on+0x10/0x10 [ 994.144866] [] ? migrate_swap_stop+0x810/0x810 [ 994.144874] [] ? mark_held_locks+0xc7/0x130 [ 994.144882] [] ? mutex_lock_interruptible_nested+0x7f3/0x9c0 [ 994.144889] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 994.144896] [] kmalloc_order+0x2a/0x70 [ 994.144902] [] kmalloc_order_trace+0x1f/0x190 [ 994.144910] [] __kmalloc+0x1ae/0x310 [ 994.144918] [] ? avc_has_extended_perms+0x56a/0xd90 [ 994.144924] [] ? avc_has_extended_perms+0xde/0xd90 [ 994.144933] [] input_mt_init_slots+0xcb/0x400 [ 994.144941] [] uinput_ioctl_handler.isra.4+0x161d/0x1980 [ 994.144946] [] ? avc_ss_reset+0x110/0x110 [ 994.144958] [] ? uinput_ff_upload_from_user+0x350/0x350 [ 994.144964] [] ? __lock_acquire+0x654/0x4a10 [ 994.144971] [] uinput_ioctl+0x4c/0x60 [ 994.144977] [] ? uinput_compat_ioctl+0x80/0x80 [ 994.144984] [] do_vfs_ioctl+0x1ac/0x11a0 [ 994.144992] [] ? ioctl_preallocate+0x220/0x220 [ 994.144999] [] ? selinux_parse_skb.constprop.42+0x1a90/0x1a90 [ 994.145006] [] ? check_preemption_disabled+0x3b/0x200 [ 994.145013] [] ? __fget+0x214/0x3d0 [ 994.145019] [] ? __fget+0x23b/0x3d0 [ 994.145025] [] ? __fget+0x47/0x3d0 [ 994.145032] [] ? security_file_ioctl+0x8f/0xc0 [ 994.145039] [] SyS_ioctl+0x8f/0xc0 [ 994.145047] [] ? do_vfs_ioctl+0x11a0/0x11a0 [ 994.145053] [] do_syscall_64+0x19f/0x550 [ 994.145061] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 994.152491] Mem-Info: [ 994.152509] active_anon:789229 inactive_anon:64326 isolated_anon:0 [ 994.152509] active_file:1471 inactive_file:564 isolated_file:32 [ 994.152509] unevictable:4 dirty:110 writeback:0 unstable:0 [ 994.152509] slab_reclaimable:9943 slab_unreclaimable:90111 [ 994.152509] mapped:71394 shmem:175170 pagetables:30988 bounce:0 [ 994.152509] free:33440 free_pcp:214 free_cma:0 [ 994.152522] Node 0 active_anon:3156916kB inactive_anon:257304kB active_file:5884kB inactive_file:2256kB unevictable:16kB isolated(anon):0kB isolated(file):128kB mapped:285576kB dirty:440kB writeback:0kB shmem:700680kB writeback_tmp:0kB unstable:0kB pages_scanned:0 all_unreclaimable? no [ 994.152542] DMA32 free:124740kB min:4696kB low:7712kB high:10728kB active_anon:525448kB inactive_anon:26932kB active_file:2920kB inactive_file:1820kB unevictable:0kB writepending:176kB present:3145324kB managed:3020132kB mlocked:0kB slab_reclaimable:9012kB slab_unreclaimable:147912kB kernel_stack:15872kB pagetables:35020kB bounce:0kB free_pcp:520kB local_pcp:268kB free_cma:0kB lowmem_reserve[]: 0 3505 3505 [ 994.152567] Normal free:9020kB min:5580kB low:9168kB high:12756kB active_anon:2631568kB inactive_anon:230372kB active_file:2980kB inactive_file:396kB unevictable:16kB writepending:264kB present:4718592kB managed:3589316kB mlocked:16kB slab_reclaimable:30760kB slab_unreclaimable:212532kB kernel_stack:26112kB pagetables:88932kB bounce:0kB free_pcp:336kB local_pcp:96kB free_cma:0kB lowmem_reserve[]: 0 0 0 [ 994.152686] DMA32: 14*4kB (UME) 44*8kB (UME) 135*16kB (UE) 52*32kB (UME) 358*64kB (UME) 208*128kB (UME) 133*256kB (UM) 70*512kB (U) 1*1024kB (M) 0*2048kB 0*4096kB = 124680kB Normal: 343*4kB (UME) 245*8kB (UE) 20*16kB (E) 72*32kB (UME) 37*64kB (UM) 6*128kB (UME) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 9092kB 177275 total pagecache pages [ 994.152730] 0 pages in swap cache [ 994.152734] Swap cache stats: add 0, delete 0, find 0/0 [ 994.152736] Free swap = 0kB [ 994.152738] Total swap = 0kB [ 994.152740] 1965979 pages RAM [ 994.152742] 0 pages HighMem/MovableOnly [ 994.152744] 313617 pages reserved [ 994.168373] uinput: write device info first [ 994.170262] syz-executor.1: page allocation failure: order:9, mode:0x240c0c0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO) [ 994.170271] CPU: 0 PID: 732 Comm: syz-executor.1 Not tainted 4.9.141+ #1 [ 994.170285] ffff88006fbef6e8 ffffffff81b42e79 1ffff1000df7dedf ffff8801cbf24740 [ 994.170295] ffffffff82a974e0 0000000000000001 0000000000400000 ffff88006fbef830 [ 994.170305] ffffffff814fc7c8 0000000041b58ab3 ffffffff82e37a10 ffffffff81427db0 [ 994.170306] Call Trace: [ 994.170321] [] dump_stack+0xc1/0x128 [ 994.170331] [] warn_alloc.cold.31+0x7f/0x9c [ 994.170340] [] ? zone_watermark_ok_safe+0x250/0x250 [ 994.170349] [] ? rcu_read_lock_sched_held+0x103/0x120 [ 994.170359] [] ? compaction_deferred+0x118/0x320 [ 994.170367] [] ? try_to_compact_pages+0x41/0x710 [ 994.170376] [] __alloc_pages_nodemask+0x628/0x1bd0 [ 994.170385] [] ? gfp_pfmemalloc_allowed+0x110/0x110 [ 994.170394] [] ? drop_futex_key_refs.isra.2+0x56/0xd0 [ 994.170402] [] ? trace_hardirqs_on+0x10/0x10 [ 994.170409] [] ? futex_wait_setup+0x330/0x330 [ 994.170416] [] ? mark_held_locks+0xc7/0x130 [ 994.170426] [] ? mutex_lock_interruptible_nested+0x7f3/0x9c0 [ 994.170433] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 994.170441] [] kmalloc_order+0x2a/0x70 [ 994.170448] [] kmalloc_order_trace+0x1f/0x190 [ 994.170456] [] __kmalloc+0x1ae/0x310 [ 994.170466] [] ? avc_has_extended_perms+0x56a/0xd90 [ 994.170473] [] ? avc_has_extended_perms+0xde/0xd90 [ 994.170484] [] input_mt_init_slots+0xcb/0x400 [ 994.170493] [] uinput_ioctl_handler.isra.4+0x161d/0x1980 [ 994.170500] [] ? avc_ss_reset+0x110/0x110 [ 994.170508] [] ? uinput_ff_upload_from_user+0x350/0x350 [ 994.170515] [] ? __lock_acquire+0x654/0x4a10 [ 994.170524] [] uinput_ioctl+0x4c/0x60 [ 994.170531] [] ? uinput_compat_ioctl+0x80/0x80 [ 994.170540] [] do_vfs_ioctl+0x1ac/0x11a0 [ 994.170547] [] ? ioctl_preallocate+0x220/0x220 [ 994.170556] [] ? selinux_parse_skb.constprop.42+0x1a90/0x1a90 [ 994.170565] [] ? check_preemption_disabled+0x3b/0x200 [ 994.170572] [] ? __fget+0x214/0x3d0 [ 994.170579] [] ? __fget+0x23b/0x3d0 [ 994.170586] [] ? __fget+0x47/0x3d0 [ 994.170593] [] ? security_file_ioctl+0x8f/0xc0 [ 994.170600] [] SyS_ioctl+0x8f/0xc0 [ 994.170607] [] ? do_vfs_ioctl+0x11a0/0x11a0 [ 994.170614] [] do_syscall_64+0x19f/0x550 [ 994.170622] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 994.170625] Mem-Info: [ 994.170642] active_anon:789179 inactive_anon:64326 isolated_anon:0 [ 994.170642] active_file:1496 inactive_file:564 isolated_file:32 [ 994.170642] unevictable:4 dirty:110 writeback:0 unstable:0 [ 994.170642] slab_reclaimable:9943 slab_unreclaimable:90111 [ 994.170642] mapped:71394 shmem:175170 pagetables:30914 bounce:0 [ 994.170642] free:33711 free_pcp:0 free_cma:0 [ 994.170656] Node 0 active_anon:3156716kB inactive_anon:257304kB active_file:5984kB inactive_file:2256kB unevictable:16kB isolated(anon):0kB isolated(file):128kB mapped:285576kB dirty:440kB writeback:0kB shmem:700680kB writeback_tmp:0kB unstable:0kB pages_scanned:0 all_unreclaimable? no [ 994.170674] DMA32 free:125224kB min:4696kB low:7712kB high:10728kB active_anon:525248kB inactive_anon:26932kB active_file:2920kB inactive_file:1820kB unevictable:0kB writepending:176kB present:3145324kB managed:3020132kB mlocked:0kB slab_reclaimable:9012kB slab_unreclaimable:147912kB kernel_stack:15872kB pagetables:34872kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 3505 3505 [ 994.170700] Normal free:9620kB min:5580kB low:9168kB high:12756kB active_anon:2631568kB inactive_anon:230372kB active_file:2980kB inactive_file:396kB unevictable:16kB writepending:264kB present:4718592kB managed:3589316kB mlocked:16kB slab_reclaimable:30760kB slab_unreclaimable:212532kB kernel_stack:26112kB pagetables:88784kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 0 0 [ 994.170751] DMA32: 92*4kB (UME) 67*8kB (UME) 144*16kB (UME) 53*32kB (UME) 358*64kB (UME) 208*128kB (UME) 133*256kB (UM) 70*512kB (U) 1*1024kB (M) 0*2048kB 0*4096kB = 125352kB Normal: 402*4kB (UME) 259*8kB (UME) 27*16kB (UME) 75*32kB (UME) 37*64kB (UM) 6*128kB (UME) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 9648kB 177275 total pagecache pages [ 994.170795] 0 pages in swap cache [ 994.170799] Swap cache stats: add 0, delete 0, find 0/0 [ 994.170801] Free swap = 0kB [ 994.170803] Total swap = 0kB [ 994.170805] 1965979 pages RAM [ 994.170807] 0 pages HighMem/MovableOnly [ 994.170809] 313617 pages reserved [ 994.277564] input: syz0 as /devices/virtual/input/input22969 [ 994.291917] uinput: write device info first [ 994.317725] input: syz0 as /devices/virtual/input/input22980 [ 994.365696] input: syz0 as /devices/virtual/input/input22985 [ 994.378570] input: syz0 as /devices/virtual/input/input22986 [ 994.429327] uinput: write device info first [ 994.530416] input: syz0 as /devices/virtual/input/input23000 [ 994.584730] input: syz0 as /devices/virtual/input/input23002 [ 994.606895] uinput: write device info first [ 994.620430] input: syz0 as /devices/virtual/input/input23013 [ 994.635919] input: syz0 as /devices/virtual/input/input23006 [ 994.720251] input: syz0 as /devices/virtual/input/input23020 [ 994.819640] input: syz0 as /devices/virtual/input/input23028 [ 994.824635] uinput: write device info first [ 994.887523] input: syz0 as /devices/virtual/input/input23034 [ 994.917925] input: syz0 as /devices/virtual/input/input23036 [ 994.948052] uinput: write device info first [ 994.987405] input: syz0 as /devices/virtual/input/input23049 [ 995.046912] input: syz0 as /devices/virtual/input/input23050 [ 995.098239] uinput: write device info first [ 995.105820] input: syz0 as /devices/virtual/input/input23058 [ 995.184229] input: syz0 as /devices/virtual/input/input23066 [ 995.245817] input: syz0 as /devices/virtual/input/input23069 [ 995.317665] input: syz0 as /devices/virtual/input/input23077 [ 995.330312] uinput: write device info first [ 995.374292] input: syz0 as /devices/virtual/input/input23081 [ 995.479702] input: syz0 as /devices/virtual/input/input23087 [ 995.502415] input: syz0 as /devices/virtual/input/input23092 [ 995.536824] input: syz0 as /devices/virtual/input/input23098 [ 995.545941] uinput: write device info first [ 995.803242] uinput: write device info first [ 995.838752] input: syz0 as /devices/virtual/input/input23113 [ 995.947004] input: syz0 as /devices/virtual/input/input23120 [ 996.027013] input: syz0 as /devices/virtual/input/input23127 [ 996.034788] input: syz0 as /devices/virtual/input/input23124 [ 996.046077] uinput: write device info first [ 996.129486] input: syz0 as /devices/virtual/input/input23136 [ 996.164885] uinput: write device info first [ 996.286424] input: syz0 as /devices/virtual/input/input23150 [ 996.294743] input: syz0 as /devices/virtual/input/input23151 [ 996.313691] input: syz0 as /devices/virtual/input/input23155 [ 996.396089] uinput: write device info first [ 996.407250] input: syz0 as /devices/virtual/input/input23161 [ 996.547967] input: syz0 as /devices/virtual/input/input23170 [ 996.583687] input: syz0 as /devices/virtual/input/input23181 [ 996.620698] input: syz0 as /devices/virtual/input/input23182 [ 996.683744] uinput: write device info first [ 996.777893] input: syz0 as /devices/virtual/input/input23198 [ 996.803081] input: syz0 as /devices/virtual/input/input23201 [ 996.877943] uinput: write device info first [ 996.879874] input: syz0 as /devices/virtual/input/input23206 [ 996.963127] input: syz0 as /devices/virtual/input/input23216 [ 997.032386] input: syz0 as /devices/virtual/input/input23219 [ 997.061087] input: syz0 as /devices/virtual/input/input23225 [ 997.092060] input: syz0 as /devices/virtual/input/input23226 [ 997.136435] uinput: write device info first [ 997.249197] input: syz0 as /devices/virtual/input/input23240 [ 997.257425] uinput: write device info first [ 997.265774] input: syz0 as /devices/virtual/input/input23244 [ 997.287003] input: syz0 as /devices/virtual/input/input23251 [ 997.432437] input: syz0 as /devices/virtual/input/input23259 [ 997.453209] uinput: write device info first [ 997.572569] input: syz0 as /devices/virtual/input/input23268 [ 997.600658] uinput: write device info first [ 997.608236] input: syz0 as /devices/virtual/input/input23279 [ 997.660454] input: syz0 as /devices/virtual/input/input23282 [ 997.770987] input: syz0 as /devices/virtual/input/input23288 [ 997.780667] input: syz0 as /devices/virtual/input/input23289 [ 997.799041] uinput: write device info first [ 997.809283] input: syz0 as /devices/virtual/input/input23302 [ 997.911365] selinux_nlmsg_perm: 133 callbacks suppressed [ 997.911374] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=311 sclass=netlink_route_socket pig=1240 comm=syz-executor.2 [ 997.922722] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=311 sclass=netlink_route_socket pig=1244 comm=syz-executor.5 [ 997.940085] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=311 sclass=netlink_route_socket pig=1246 comm=syz-executor.1 [ 997.944291] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=311 sclass=netlink_route_socket pig=1247 comm=syz-executor.4 [ 997.976157] input: syz0 as /devices/virtual/input/input23306 [ 997.992936] uinput: write device info first [ 998.000387] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=311 sclass=netlink_route_socket pig=1254 comm=syz-executor.3 [ 998.040785] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=311 sclass=netlink_route_socket pig=1260 comm=syz-executor.0 [ 998.071785] input: syz0 as /devices/virtual/input/input23319 [ 998.087774] input: syz0 as /devices/virtual/input/input23322 [ 998.163296] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=311 sclass=netlink_route_socket pig=1272 comm=syz-executor.5 [ 998.163377] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=311 sclass=netlink_route_socket pig=1274 comm=syz-executor.3 [ 998.168807] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=311 sclass=netlink_route_socket pig=1270 comm=syz-executor.2 [ 998.173711] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=311 sclass=netlink_route_socket pig=1275 comm=syz-executor.1 [ 998.192319] uinput: write device info first [ 998.209406] input: syz0 as /devices/virtual/input/input23330 [ 998.329846] input: syz0 as /devices/virtual/input/input23338 [ 998.369918] input: syz0 as /devices/virtual/input/input23345 [ 998.398723] uinput: write device info first [ 998.449228] input: syz0 as /devices/virtual/input/input23353 [ 998.593795] input: syz0 as /devices/virtual/input/input23364 [ 998.665415] uinput: write device info first [ 998.689647] input: syz0 as /devices/virtual/input/input23370 [ 998.764427] input: syz0 as /devices/virtual/input/input23377 [ 998.765891] uinput: write device info first [ 998.923814] uinput: write device info first [ 998.979593] input: syz0 as /devices/virtual/input/input23396 [ 998.984283] input: syz0 as /devices/virtual/input/input23397 [ 999.076999] uinput: write device info first [ 999.096991] warn_alloc: 341 callbacks suppressed [ 999.097009] syz-executor.3: page allocation failure: order:9, mode:0x240c0c0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO) [ 999.097019] CPU: 0 PID: 1406 Comm: syz-executor.3 Not tainted 4.9.141+ #1 [ 999.097034] ffff8800b87676e8 ffffffff81b42e79 1ffff100170ecedf ffff8801006bc740 [ 999.097046] ffffffff82a974e0 0000000000000001 0000000000400000 ffff8800b8767830 [ 999.097059] ffffffff814fc7c8 0000000041b58ab3 ffffffff82e37a10 ffffffff81427db0 [ 999.097060] Call Trace: [ 999.097075] [] dump_stack+0xc1/0x128 [ 999.097088] [] warn_alloc.cold.31+0x7f/0x9c [ 999.097099] [] ? zone_watermark_ok_safe+0x250/0x250 [ 999.097106] [] ? rcu_read_lock_sched_held+0x103/0x120 [ 999.097115] [] ? compaction_deferred+0x118/0x320 [ 999.097122] [] ? try_to_compact_pages+0x41/0x710 [ 999.097130] [] __alloc_pages_nodemask+0x628/0x1bd0 [ 999.097139] [] ? gfp_pfmemalloc_allowed+0x110/0x110 [ 999.097147] [] ? drop_futex_key_refs.isra.2+0x56/0xd0 [ 999.097154] [] ? trace_hardirqs_on+0x10/0x10 [ 999.097161] [] ? futex_wait_setup+0x330/0x330 [ 999.097168] [] ? mark_held_locks+0xc7/0x130 [ 999.097177] [] ? mutex_lock_interruptible_nested+0x7f3/0x9c0 [ 999.097184] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 999.097190] [] kmalloc_order+0x2a/0x70 [ 999.097197] [] kmalloc_order_trace+0x1f/0x190 [ 999.097204] [] __kmalloc+0x1ae/0x310 [ 999.097212] [] ? avc_has_extended_perms+0x56a/0xd90 [ 999.097219] [] ? avc_has_extended_perms+0xde/0xd90 [ 999.097228] [] input_mt_init_slots+0xcb/0x400 [ 999.097237] [] uinput_ioctl_handler.isra.4+0x161d/0x1980 [ 999.097243] [] ? avc_ss_reset+0x110/0x110 [ 999.097259] [] ? uinput_ff_upload_from_user+0x350/0x350 [ 999.097267] [] ? __lock_acquire+0x654/0x4a10 [ 999.097278] [] uinput_ioctl+0x4c/0x60 [ 999.097286] [] ? uinput_compat_ioctl+0x80/0x80 [ 999.097294] [] do_vfs_ioctl+0x1ac/0x11a0 [ 999.097301] [] ? ioctl_preallocate+0x220/0x220 [ 999.097309] [] ? selinux_parse_skb.constprop.42+0x1a90/0x1a90 [ 999.097317] [] ? check_preemption_disabled+0x3b/0x200 [ 999.097323] [] ? __fget+0x214/0x3d0 [ 999.097330] [] ? __fget+0x23b/0x3d0 [ 999.097336] [] ? __fget+0x47/0x3d0 [ 999.097343] [] ? security_file_ioctl+0x8f/0xc0 [ 999.097350] [] SyS_ioctl+0x8f/0xc0 [ 999.097356] [] ? do_vfs_ioctl+0x11a0/0x11a0 [ 999.097362] [] do_syscall_64+0x19f/0x550 [ 999.097370] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 999.097372] Mem-Info: [ 999.097393] active_anon:789692 inactive_anon:64333 isolated_anon:13 [ 999.097393] active_file:1245 inactive_file:356 isolated_file:32 [ 999.097393] unevictable:4 dirty:135 writeback:0 unstable:0 [ 999.097393] slab_reclaimable:9935 slab_unreclaimable:89993 [ 999.097393] mapped:71074 shmem:175177 pagetables:31442 bounce:0 [ 999.097393] free:32934 free_pcp:0 free_cma:0 [ 999.097406] Node 0 active_anon:3158768kB inactive_anon:257332kB active_file:4980kB inactive_file:1424kB unevictable:16kB isolated(anon):52kB isolated(file):128kB mapped:284296kB dirty:540kB writeback:0kB shmem:700708kB writeback_tmp:0kB unstable:0kB pages_scanned:0 all_unreclaimable? no [ 999.097423] DMA32 free:122380kB min:4696kB low:7712kB high:10728kB active_anon:526548kB inactive_anon:26944kB active_file:2160kB inactive_file:1044kB unevictable:0kB writepending:156kB present:3145324kB managed:3020132kB mlocked:0kB slab_reclaimable:8996kB slab_unreclaimable:148444kB kernel_stack:16256kB pagetables:36700kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 3505 3505 [ 999.097448] Normal free:9356kB min:5580kB low:9168kB high:12756kB active_anon:2632220kB inactive_anon:230388kB active_file:2820kB inactive_file:380kB unevictable:16kB writepending:384kB present:4718592kB managed:3589316kB mlocked:16kB slab_reclaimable:30744kB slab_unreclaimable:211528kB kernel_stack:26368kB pagetables:89068kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 0 0 [ 999.097505] DMA32: 54*4kB (UME) 49*8kB (UME) 132*16kB (UME) 55*32kB (UME) 320*64kB (UME) 208*128kB (UME) 133*256kB (UM) 70*512kB (U) 1*1024kB (M) 0*2048kB 0*4096kB = 122496kB Normal: 398*4kB (UME) 264*8kB (UME) 29*16kB (UME) 59*32kB (UME) 41*64kB (UM) 6*128kB (UME) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 9448kB 176841 total pagecache pages [ 999.097546] 0 pages in swap cache [ 999.097550] Swap cache stats: add 0, delete 0, find 0/0 [ 999.097552] Free swap = 0kB [ 999.097554] Total swap = 0kB [ 999.097555] 1965979 pages RAM [ 999.097557] 0 pages HighMem/MovableOnly [ 999.097559] 313617 pages reserved [ 999.100093] syz-executor.0: page allocation failure: order:9, mode:0x240c0c0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO) [ 999.100101] CPU: 1 PID: 1390 Comm: syz-executor.0 Not tainted 4.9.141+ #1 [ 999.100113] ffff88008e79f6e8 ffffffff81b42e79 1ffff10011cf3edf ffff88008e5baf80 [ 999.100128] ffffffff82a974e0 0000000000000001 0000000000400000 ffff88008e79f830 [ 999.100138] ffffffff814fc7c8 0000000041b58ab3 ffffffff82e37a10 ffffffff81427db0 [ 999.100140] Call Trace: [ 999.100152] [] dump_stack+0xc1/0x128 [ 999.100161] [] warn_alloc.cold.31+0x7f/0x9c [ 999.100170] [] ? zone_watermark_ok_safe+0x250/0x250 [ 999.100178] [] ? rcu_read_lock_sched_held+0x103/0x120 [ 999.100188] [] ? compaction_deferred+0x118/0x320 [ 999.100196] [] ? try_to_compact_pages+0x41/0x710 [ 999.100204] [] __alloc_pages_nodemask+0x628/0x1bd0 [ 999.100213] [] ? gfp_pfmemalloc_allowed+0x110/0x110 [ 999.100221] [] ? _raw_spin_unlock_irqrestore+0x6b/0x70 [ 999.100228] [] ? trace_hardirqs_on+0x10/0x10 [ 999.100236] [] ? migrate_swap_stop+0x810/0x810 [ 999.100243] [] ? mark_held_locks+0xc7/0x130 [ 999.100251] [] ? mutex_lock_interruptible_nested+0x7f3/0x9c0 [ 999.100257] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 999.100264] [] kmalloc_order+0x2a/0x70 [ 999.100272] [] kmalloc_order_trace+0x1f/0x190 [ 999.100280] [] __kmalloc+0x1ae/0x310 [ 999.100289] [] ? avc_has_extended_perms+0x56a/0xd90 [ 999.100296] [] ? avc_has_extended_perms+0xde/0xd90 [ 999.100305] [] input_mt_init_slots+0xcb/0x400 [ 999.100314] [] uinput_ioctl_handler.isra.4+0x161d/0x1980 [ 999.100320] [] ? avc_ss_reset+0x110/0x110 [ 999.100328] [] ? uinput_ff_upload_from_user+0x350/0x350 [ 999.100335] [] ? __lock_acquire+0x654/0x4a10 [ 999.100344] [] uinput_ioctl+0x4c/0x60 [ 999.100351] [] ? uinput_compat_ioctl+0x80/0x80 [ 999.100359] [] do_vfs_ioctl+0x1ac/0x11a0 [ 999.100367] [] ? ioctl_preallocate+0x220/0x220 [ 999.100376] [] ? selinux_parse_skb.constprop.42+0x1a90/0x1a90 [ 999.100384] [] ? check_preemption_disabled+0x3b/0x200 [ 999.100391] [] ? __fget+0x214/0x3d0 [ 999.100398] [] ? __fget+0x23b/0x3d0 [ 999.100404] [] ? __fget+0x47/0x3d0 [ 999.100411] [] ? security_file_ioctl+0x8f/0xc0 [ 999.100419] [] SyS_ioctl+0x8f/0xc0 [ 999.100426] [] ? do_vfs_ioctl+0x11a0/0x11a0 [ 999.100433] [] do_syscall_64+0x19f/0x550 [ 999.100441] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 999.100470] Mem-Info: [ 999.100486] active_anon:789667 inactive_anon:64333 isolated_anon:13 [ 999.100486] active_file:1245 inactive_file:356 isolated_file:32 [ 999.100486] unevictable:4 dirty:135 writeback:0 unstable:0 [ 999.100486] slab_reclaimable:9935 slab_unreclaimable:89993 [ 999.100486] mapped:71074 shmem:175177 pagetables:31442 bounce:0 [ 999.100486] free:32929 free_pcp:27 free_cma:0 [ 999.100500] Node 0 active_anon:3158668kB inactive_anon:257332kB active_file:4980kB inactive_file:1424kB unevictable:16kB isolated(anon):52kB isolated(file):128kB mapped:284296kB dirty:540kB writeback:0kB shmem:700708kB writeback_tmp:0kB unstable:0kB pages_scanned:0 all_unreclaimable? no [ 999.100517] DMA32 free:122480kB min:4696kB low:7712kB high:10728kB active_anon:526448kB inactive_anon:26944kB active_file:2160kB inactive_file:1044kB unevictable:0kB writepending:156kB present:3145324kB managed:3020132kB mlocked:0kB slab_reclaimable:8996kB slab_unreclaimable:148444kB kernel_stack:16192kB pagetables:36700kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 3505 3505 [ 999.100541] Normal free:9236kB min:5580kB low:9168kB high:12756kB active_anon:2632220kB inactive_anon:230388kB active_file:2820kB inactive_file:380kB unevictable:16kB writepending:384kB present:4718592kB managed:3589316kB mlocked:16kB slab_reclaimable:30744kB slab_unreclaimable:211528kB kernel_stack:26368kB pagetables:89068kB bounce:0kB free_pcp:108kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 0 0 [ 999.100586] DMA32: 65*4kB (UME) 52*8kB (UME) 132*16kB (UME) 57*32kB (UME) 320*64kB (UME) 208*128kB (UME) 133*256kB (UM) 70*512kB (U) 1*1024kB (M) 0*2048kB 0*4096kB = 122628kB Normal: 360*4kB (ME) 264*8kB (UME) 29*16kB (UME) 59*32kB (UME) 41*64kB (UM) 6*128kB (UME) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 9296kB 176841 total pagecache pages [ 999.100624] 0 pages in swap cache [ 999.100628] Swap cache stats: add 0, delete 0, find 0/0 [ 999.100629] Free swap = 0kB [ 999.100631] Total swap = 0kB [ 999.100633] 1965979 pages RAM [ 999.100634] 0 pages HighMem/MovableOnly [ 999.100636] 313617 pages reserved [ 999.103078] syz-executor.4: page allocation failure: order:9, mode:0x240c0c0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO) [ 999.103085] CPU: 0 PID: 1399 Comm: syz-executor.4 Not tainted 4.9.141+ #1 [ 999.103098] ffff88007393f6e8 ffffffff81b42e79 1ffff1000e727edf ffff8800b68117c0 [ 999.103108] ffffffff82a974e0 0000000000000001 0000000000400000 ffff88007393f830 [ 999.103118] ffffffff814fc7c8 0000000041b58ab3 ffffffff82e37a10 ffffffff81427db0 [ 999.103120] Call Trace: [ 999.103132] [] dump_stack+0xc1/0x128 [ 999.103141] [] warn_alloc.cold.31+0x7f/0x9c [ 999.103150] [] ? zone_watermark_ok_safe+0x250/0x250 [ 999.103158] [] ? rcu_read_lock_sched_held+0x103/0x120 [ 999.103167] [] ? compaction_deferred+0x118/0x320 [ 999.103176] [] ? try_to_compact_pages+0x41/0x710 [ 999.103185] [] __alloc_pages_nodemask+0x628/0x1bd0 [ 999.103194] [] ? gfp_pfmemalloc_allowed+0x110/0x110 [ 999.103202] [] ? _raw_spin_unlock_irqrestore+0x6b/0x70 [ 999.103210] [] ? trace_hardirqs_on+0x10/0x10 [ 999.103223] [] ? migrate_swap_stop+0x810/0x810 [ 999.103230] [] ? mark_held_locks+0xc7/0x130 [ 999.103238] [] ? mutex_lock_interruptible_nested+0x7f3/0x9c0 [ 999.103244] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 999.103257] [] kmalloc_order+0x2a/0x70 [ 999.103264] [] kmalloc_order_trace+0x1f/0x190 [ 999.103272] [] __kmalloc+0x1ae/0x310 [ 999.103279] [] ? avc_has_extended_perms+0x56a/0xd90 [ 999.103286] [] ? avc_has_extended_perms+0xde/0xd90 [ 999.103294] [] input_mt_init_slots+0xcb/0x400 [ 999.103302] [] uinput_ioctl_handler.isra.4+0x161d/0x1980 [ 999.103308] [] ? avc_ss_reset+0x110/0x110 [ 999.103316] [] ? uinput_ff_upload_from_user+0x350/0x350 [ 999.103323] [] ? __lock_acquire+0x654/0x4a10 [ 999.103331] [] uinput_ioctl+0x4c/0x60 [ 999.103339] [] ? uinput_compat_ioctl+0x80/0x80 [ 999.103347] [] do_vfs_ioctl+0x1ac/0x11a0 [ 999.103354] [] ? ioctl_preallocate+0x220/0x220 [ 999.103362] [] ? selinux_parse_skb.constprop.42+0x1a90/0x1a90 [ 999.103370] [] ? check_preemption_disabled+0x3b/0x200 [ 999.103377] [] ? __fget+0x214/0x3d0 [ 999.103384] [] ? __fget+0x23b/0x3d0 [ 999.103391] [] ? __fget+0x47/0x3d0 [ 999.103398] [] ? security_file_ioctl+0x8f/0xc0 [ 999.103405] [] SyS_ioctl+0x8f/0xc0 [ 999.103412] [] ? do_vfs_ioctl+0x11a0/0x11a0 [ 999.103419] [] do_syscall_64+0x19f/0x550 [ 999.103427] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 999.103446] Mem-Info: [ 999.103462] active_anon:789667 inactive_anon:64333 isolated_anon:13 [ 999.103462] active_file:1245 inactive_file:356 isolated_file:32 [ 999.103462] unevictable:4 dirty:135 writeback:0 unstable:0 [ 999.103462] slab_reclaimable:9935 slab_unreclaimable:89993 [ 999.103462] mapped:71074 shmem:175177 pagetables:31368 bounce:0 [ 999.103462] free:33054 free_pcp:0 free_cma:0 [ 999.103475] Node 0 active_anon:3158668kB inactive_anon:257332kB active_file:4980kB inactive_file:1424kB unevictable:16kB isolated(anon):52kB isolated(file):128kB mapped:284296kB dirty:540kB writeback:0kB shmem:700708kB writeback_tmp:0kB unstable:0kB pages_scanned:0 all_unreclaimable? no [ 999.103492] DMA32 free:122880kB min:4696kB low:7712kB high:10728kB active_anon:526448kB inactive_anon:26944kB active_file:2160kB inactive_file:1044kB unevictable:0kB writepending:156kB present:3145324kB managed:3020132kB mlocked:0kB slab_reclaimable:8996kB slab_unreclaimable:148444kB kernel_stack:16160kB pagetables:36404kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 3505 3505 [ 999.103516] Normal free:9336kB min:5580kB low:9168kB high:12756kB active_anon:2632220kB inactive_anon:230388kB active_file:2820kB inactive_file:380kB unevictable:16kB writepending:384kB present:4718592kB managed:3589316kB mlocked:16kB slab_reclaimable:30744kB slab_unreclaimable:211528kB kernel_stack:26368kB pagetables:89068kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 0 0 [ 999.103565] DMA32: 101*4kB (UME) 52*8kB (UME) 134*16kB (UME) 63*32kB (UME) 320*64kB (UME) 208*128kB (UME) 133*256kB (UM) 70*512kB (U) 1*1024kB (M) 0*2048kB 0*4096kB = 122996kB Normal: 406*4kB (UME) 264*8kB (UME) 29*16kB (UME) 59*32kB (UME) 41*64kB (UM) 6*128kB (UME) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 9480kB 176841 total pagecache pages [ 999.103607] 0 pages in swap cache [ 999.103611] Swap cache stats: add 0, delete 0, find 0/0 [ 999.103613] Free swap = 0kB [ 999.103615] Total swap = 0kB [ 999.103617] 1965979 pages RAM [ 999.103619] 0 pages HighMem/MovableOnly [ 999.103621] 313617 pages reserved [ 999.104431] input: syz0 as /devices/virtual/input/input23412 [ 999.163821] syz-executor.2: page allocation failure: order:9, mode:0x240c0c0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO) [ 999.163831] CPU: 1 PID: 1408 Comm: syz-executor.2 Not tainted 4.9.141+ #1 [ 999.163847] ffff88006e93f6e8 ffffffff81b42e79 1ffff1000dd27edf ffff880029645f00 [ 999.163858] ffffffff82a974e0 0000000000000001 0000000000400000 ffff88006e93f830 [ 999.163869] ffffffff814fc7c8 0000000041b58ab3 ffffffff82e37a10 ffffffff81427db0 [ 999.163872] Call Trace: [ 999.163885] [] dump_stack+0xc1/0x128 [ 999.163895] [] warn_alloc.cold.31+0x7f/0x9c [ 999.163907] [] ? zone_watermark_ok_safe+0x250/0x250 [ 999.163916] [] ? try_to_compact_pages+0x41/0x710 [ 999.163925] [] __alloc_pages_nodemask+0x628/0x1bd0 [ 999.163934] [] ? gfp_pfmemalloc_allowed+0x110/0x110 [ 999.163943] [] ? drop_futex_key_refs.isra.2+0x56/0xd0 [ 999.163951] [] ? trace_hardirqs_on+0x10/0x10 [ 999.163959] [] ? futex_wait_setup+0x330/0x330 [ 999.163967] [] ? mark_held_locks+0xc7/0x130 [ 999.163977] [] ? mutex_lock_interruptible_nested+0x7f3/0x9c0 [ 999.163985] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 999.163993] [] kmalloc_order+0x2a/0x70 [ 999.164001] [] kmalloc_order_trace+0x1f/0x190 [ 999.164010] [] __kmalloc+0x1ae/0x310 [ 999.164020] [] ? avc_has_extended_perms+0x56a/0xd90 [ 999.164028] [] ? avc_has_extended_perms+0xde/0xd90 [ 999.164038] [] input_mt_init_slots+0xcb/0x400 [ 999.164047] [] uinput_ioctl_handler.isra.4+0x161d/0x1980 [ 999.164055] [] ? avc_ss_reset+0x110/0x110 [ 999.164063] [] ? uinput_ff_upload_from_user+0x350/0x350 [ 999.164071] [] ? __lock_acquire+0x654/0x4a10 [ 999.164081] [] uinput_ioctl+0x4c/0x60 [ 999.164090] [] ? uinput_compat_ioctl+0x80/0x80 [ 999.164098] [] do_vfs_ioctl+0x1ac/0x11a0 [ 999.164107] [] ? ioctl_preallocate+0x220/0x220 [ 999.164116] [] ? selinux_parse_skb.constprop.42+0x1a90/0x1a90 [ 999.164125] [] ? check_preemption_disabled+0x3b/0x200 [ 999.164133] [] ? __fget+0x214/0x3d0 [ 999.164140] [] ? __fget+0x23b/0x3d0 [ 999.164147] [] ? __fget+0x47/0x3d0 [ 999.164154] [] ? security_file_ioctl+0x8f/0xc0 [ 999.164162] [] SyS_ioctl+0x8f/0xc0 [ 999.164171] [] ? do_vfs_ioctl+0x11a0/0x11a0 [ 999.164180] [] do_syscall_64+0x19f/0x550 [ 999.164188] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 999.164191] Mem-Info: [ 999.164209] active_anon:789642 inactive_anon:64333 isolated_anon:13 [ 999.164209] active_file:1245 inactive_file:356 isolated_file:32 [ 999.164209] unevictable:4 dirty:135 writeback:0 unstable:0 [ 999.164209] slab_reclaimable:9935 slab_unreclaimable:89929 [ 999.164209] mapped:71099 shmem:175177 pagetables:31405 bounce:0 [ 999.164209] free:32944 free_pcp:292 free_cma:0 [ 999.164223] Node 0 active_anon:3158568kB inactive_anon:257332kB active_file:4980kB inactive_file:1424kB unevictable:16kB isolated(anon):52kB isolated(file):128kB mapped:284396kB dirty:540kB writeback:0kB shmem:700708kB writeback_tmp:0kB unstable:0kB pages_scanned:0 all_unreclaimable? no [ 999.164243] DMA32 free:122724kB min:4696kB low:7712kB high:10728kB active_anon:526348kB inactive_anon:26944kB active_file:2160kB inactive_file:1144kB unevictable:0kB writepending:156kB present:3145324kB managed:3020132kB mlocked:0kB slab_reclaimable:8996kB slab_unreclaimable:148316kB kernel_stack:16064kB pagetables:36404kB bounce:0kB free_pcp:632kB local_pcp:104kB free_cma:0kB lowmem_reserve[]: 0 3505 3505 [ 999.164269] Normal free:9052kB min:5580kB low:9168kB high:12756kB active_anon:2632220kB inactive_anon:230388kB active_file:2820kB inactive_file:380kB unevictable:16kB writepending:384kB present:4718592kB managed:3589316kB mlocked:16kB slab_reclaimable:30744kB slab_unreclaimable:211400kB kernel_stack:26272kB pagetables:89216kB bounce:0kB free_pcp:528kB local_pcp:164kB free_cma:0kB lowmem_reserve[]: 0 0 0 [ 999.164614] DMA32: 13*4kB (ME) 42*8kB (ME) 132*16kB (UME) 69*32kB (UME) 321*64kB (UME) 208*128kB (UME) 133*256kB (UM) 70*512kB (U) 1*1024kB (M) 0*2048kB 0*4096kB = 122788kB Normal: 343*4kB (UME) 246*8kB (UME) 21*16kB (UE) 63*32kB (UME) 41*64kB (UM) 6*128kB (UME) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 9084kB 176878 total pagecache pages [ 999.164662] 0 pages in swap cache [ 999.164667] Swap cache stats: add 0, delete 0, find 0/0 [ 999.164669] Free swap = 0kB [ 999.164671] Total swap = 0kB [ 999.164674] 1965979 pages RAM [ 999.164676] 0 pages HighMem/MovableOnly [ 999.164678] 313617 pages reserved [ 999.210880] syz-executor.4: page allocation failure: order:9, mode:0x240c0c0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO) [ 999.210888] CPU: 0 PID: 1428 Comm: syz-executor.4 Not tainted 4.9.141+ #1 [ 999.210901] ffff8800b87676e8 ffffffff81b42e79 1ffff100170ecedf ffff8800978d8000 [ 999.210911] ffffffff82a974e0 0000000000000001 0000000000400000 ffff8800b8767830 [ 999.210921] ffffffff814fc7c8 0000000041b58ab3 ffffffff82e37a10 ffffffff81427db0 [ 999.210922] Call Trace: [ 999.210937] [] dump_stack+0xc1/0x128 [ 999.210947] [] warn_alloc.cold.31+0x7f/0x9c [ 999.210956] [] ? zone_watermark_ok_safe+0x250/0x250 [ 999.210970] [] ? rcu_read_lock_sched_held+0x103/0x120 [ 999.210980] [] ? compaction_deferred+0x118/0x320 [ 999.210988] [] ? try_to_compact_pages+0x41/0x710 [ 999.210996] [] __alloc_pages_nodemask+0x628/0x1bd0 [ 999.211005] [] ? gfp_pfmemalloc_allowed+0x110/0x110 [ 999.211014] [] ? _raw_spin_unlock_irqrestore+0x6b/0x70 [ 999.211022] [] ? trace_hardirqs_on+0x10/0x10 [ 999.211029] [] ? migrate_swap_stop+0x810/0x810 [ 999.211036] [] ? mark_held_locks+0xc7/0x130 [ 999.211046] [] ? mutex_lock_interruptible_nested+0x7f3/0x9c0 [ 999.211053] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 999.211059] [] kmalloc_order+0x2a/0x70 [ 999.211067] [] kmalloc_order_trace+0x1f/0x190 [ 999.211075] [] __kmalloc+0x1ae/0x310 [ 999.211085] [] ? avc_has_extended_perms+0x56a/0xd90 [ 999.211092] [] ? avc_has_extended_perms+0xde/0xd90 [ 999.211102] [] input_mt_init_slots+0xcb/0x400 [ 999.211112] [] uinput_ioctl_handler.isra.4+0x161d/0x1980 [ 999.211118] [] ? avc_ss_reset+0x110/0x110 [ 999.211126] [] ? uinput_ff_upload_from_user+0x350/0x350 [ 999.211133] [] ? __lock_acquire+0x654/0x4a10 [ 999.211141] [] uinput_ioctl+0x4c/0x60 [ 999.211149] [] ? uinput_compat_ioctl+0x80/0x80 [ 999.211157] [] do_vfs_ioctl+0x1ac/0x11a0 [ 999.211165] [] ? ioctl_preallocate+0x220/0x220 [ 999.211174] [] ? selinux_parse_skb.constprop.42+0x1a90/0x1a90 [ 999.211182] [] ? check_preemption_disabled+0x3b/0x200 [ 999.211190] [] ? __fget+0x214/0x3d0 [ 999.211196] [] ? __fget+0x23b/0x3d0 [ 999.211202] [] ? __fget+0x47/0x3d0 [ 999.211210] [] ? security_file_ioctl+0x8f/0xc0 [ 999.211217] [] SyS_ioctl+0x8f/0xc0 [ 999.211225] [] ? do_vfs_ioctl+0x11a0/0x11a0 [ 999.211231] [] do_syscall_64+0x19f/0x550 [ 999.211239] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 999.212408] syz-executor.3: page allocation failure: order:9, mode:0x240c0c0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO) [ 999.212415] CPU: 0 PID: 1427 Comm: syz-executor.3 Not tainted 4.9.141+ #1 [ 999.212427] ffff88008e79f6e8 ffffffff81b42e79 1ffff10011cf3edf ffff88003ef2df00 [ 999.212437] ffffffff82a974e0 0000000000000001 0000000000400000 ffff88008e79f830 [ 999.212447] ffffffff814fc7c8 0000000041b58ab3 ffffffff82e37a10 ffffffff81427db0 [ 999.212449] Call Trace: [ 999.212460] [] dump_stack+0xc1/0x128 [ 999.212469] [] warn_alloc.cold.31+0x7f/0x9c [ 999.212479] [] ? zone_watermark_ok_safe+0x250/0x250 [ 999.212486] [] ? rcu_read_lock_sched_held+0x103/0x120 [ 999.212495] [] ? compaction_deferred+0x118/0x320 [ 999.212503] [] ? try_to_compact_pages+0x41/0x710 [ 999.212512] [] __alloc_pages_nodemask+0x628/0x1bd0 [ 999.212520] [] ? gfp_pfmemalloc_allowed+0x110/0x110 [ 999.212528] [] ? _raw_spin_unlock_irqrestore+0x6b/0x70 [ 999.212535] [] ? trace_hardirqs_on+0x10/0x10 [ 999.212542] [] ? migrate_swap_stop+0x810/0x810 [ 999.212549] [] ? mark_held_locks+0xc7/0x130 [ 999.212559] [] ? mutex_lock_interruptible_nested+0x7f3/0x9c0 [ 999.212565] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 999.212573] [] kmalloc_order+0x2a/0x70 [ 999.212580] [] kmalloc_order_trace+0x1f/0x190 [ 999.212588] [] __kmalloc+0x1ae/0x310 [ 999.212597] [] ? avc_has_extended_perms+0x56a/0xd90 [ 999.212604] [] ? avc_has_extended_perms+0xde/0xd90 [ 999.212612] [] input_mt_init_slots+0xcb/0x400 [ 999.212622] [] uinput_ioctl_handler.isra.4+0x161d/0x1980 [ 999.212629] [] ? avc_ss_reset+0x110/0x110 [ 999.212637] [] ? uinput_ff_upload_from_user+0x350/0x350 [ 999.212644] [] ? __lock_acquire+0x654/0x4a10 [ 999.212652] [] uinput_ioctl+0x4c/0x60 [ 999.212660] [] ? uinput_compat_ioctl+0x80/0x80 [ 999.212668] [] do_vfs_ioctl+0x1ac/0x11a0 [ 999.212675] [] ? ioctl_preallocate+0x220/0x220 [ 999.212684] [] ? selinux_parse_skb.constprop.42+0x1a90/0x1a90 [ 999.212692] [] ? check_preemption_disabled+0x3b/0x200 [ 999.212699] [] ? __fget+0x214/0x3d0 [ 999.212706] [] ? __fget+0x23b/0x3d0 [ 999.212713] [] ? __fget+0x47/0x3d0 [ 999.212720] [] ? security_file_ioctl+0x8f/0xc0 [ 999.212728] [] SyS_ioctl+0x8f/0xc0 [ 999.212735] [] ? do_vfs_ioctl+0x11a0/0x11a0 [ 999.212742] [] do_syscall_64+0x19f/0x550 [ 999.212749] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 999.212752] Mem-Info: [ 999.213386] active_anon:789617 inactive_anon:64333 isolated_anon:13 [ 999.213386] active_file:1270 inactive_file:356 isolated_file:32 [ 999.213386] unevictable:4 dirty:135 writeback:0 unstable:0 [ 999.213386] slab_reclaimable:9935 slab_unreclaimable:89958 [ 999.213386] mapped:71099 shmem:175177 pagetables:31368 bounce:0 [ 999.213386] free:33115 free_pcp:0 free_cma:0 [ 999.213399] Node 0 active_anon:3158468kB inactive_anon:257332kB active_file:5080kB inactive_file:1424kB unevictable:16kB isolated(anon):52kB isolated(file):128kB mapped:284396kB dirty:540kB writeback:0kB shmem:700708kB writeback_tmp:0kB unstable:0kB pages_scanned:0 all_unreclaimable? no [ 999.213417] DMA32 free:122820kB min:4696kB low:7712kB high:10728kB active_anon:526348kB inactive_anon:26944kB active_file:2160kB inactive_file:1144kB unevictable:0kB writepending:156kB present:3145324kB managed:3020132kB mlocked:0kB slab_reclaimable:8996kB slab_unreclaimable:148432kB kernel_stack:16096kB pagetables:36404kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 3505 3505 [ 999.213443] Normal free:9640kB min:5580kB low:9168kB high:12756kB active_anon:2632220kB inactive_anon:230388kB active_file:2920kB inactive_file:380kB unevictable:16kB writepending:384kB present:4718592kB managed:3589316kB mlocked:16kB slab_reclaimable:30744kB slab_unreclaimable:211400kB kernel_stack:26272kB pagetables:89068kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 0 0 [ 999.213496] DMA32: 112*4kB (UME) 55*8kB (UME) 135*16kB (UME) 54*32kB (UME) 321*64kB (UME) 208*128kB (UME) 133*256kB (UM) 70*512kB (U) 1*1024kB (M) 0*2048kB 0*4096kB = 122856kB Normal: 407*4kB (UME) 263*8kB (UME) 29*16kB (UME) 66*32kB (UME) 41*64kB (UM) 6*128kB (UME) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 9700kB 176878 total pagecache pages [ 999.213540] 0 pages in swap cache [ 999.213544] Swap cache stats: add 0, delete 0, find 0/0 [ 999.213546] Free swap = 0kB [ 999.213548] Total swap = 0kB [ 999.213551] 1965979 pages RAM [ 999.213553] 0 pages HighMem/MovableOnly [ 999.213555] 313617 pages reserved [ 999.213621] Mem-Info: [ 999.213638] active_anon:789617 inactive_anon:64333 isolated_anon:13 [ 999.213638] active_file:1270 inactive_file:356 isolated_file:32 [ 999.213638] unevictable:4 dirty:135 writeback:0 unstable:0 [ 999.213638] slab_reclaimable:9935 slab_unreclaimable:89958 [ 999.213638] mapped:71099 shmem:175177 pagetables:31368 bounce:0 [ 999.213638] free:33115 free_pcp:0 free_cma:0 [ 999.213651] Node 0 active_anon:3158468kB inactive_anon:257332kB active_file:5080kB inactive_file:1424kB unevictable:16kB isolated(anon):52kB isolated(file):128kB mapped:284396kB dirty:540kB writeback:0kB shmem:700708kB writeback_tmp:0kB unstable:0kB pages_scanned:0 all_unreclaimable? no [ 999.213668] DMA32 free:122820kB min:4696kB low:7712kB high:10728kB active_anon:526348kB inactive_anon:26944kB active_file:2160kB inactive_file:1144kB unevictable:0kB writepending:156kB present:3145324kB managed:3020132kB mlocked:0kB slab_reclaimable:8996kB slab_unreclaimable:148432kB kernel_stack:16096kB pagetables:36404kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 3505 3505 [ 999.213693] Normal free:9640kB min:5580kB low:9168kB high:12756kB active_anon:2632220kB inactive_anon:230388kB active_file:2920kB inactive_file:380kB unevictable:16kB writepending:384kB present:4718592kB managed:3589316kB mlocked:16kB slab_reclaimable:30744kB slab_unreclaimable:211400kB kernel_stack:26272kB pagetables:89068kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 0 0 [ 999.213743] DMA32: 112*4kB (UME) 55*8kB (UME) 135*16kB (UME) 54*32kB (UME) 321*64kB (UME) 208*128kB (UME) 133*256kB (UM) 70*512kB (U) 1*1024kB (M) 0*2048kB 0*4096kB = 122856kB Normal: 407*4kB (UME) 263*8kB (UME) 29*16kB (UME) 66*32kB (UME) 41*64kB (UM) 6*128kB (UME) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 9700kB 176878 total pagecache pages [ 999.213785] 0 pages in swap cache [ 999.213789] Swap cache stats: add 0, delete 0, find 0/0 [ 999.213791] Free swap = 0kB [ 999.213793] Total swap = 0kB [ 999.213795] 1965979 pages RAM [ 999.213797] 0 pages HighMem/MovableOnly [ 999.213799] 313617 pages reserved [ 999.215187] syz-executor.3: page allocation failure: order:9, mode:0x240c0c0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO) [ 999.215194] CPU: 0 PID: 1427 Comm: syz-executor.3 Not tainted 4.9.141+ #1 [ 999.215207] ffff88008e79f6e8 ffffffff81b42e79 1ffff10011cf3edf ffff88003ef2df00 [ 999.215217] ffffffff82a974e0 0000000000000001 0000000000400000 ffff88008e79f830 [ 999.215227] ffffffff814fc7c8 0000000041b58ab3 ffffffff82e37a10 ffffffff81427db0 [ 999.215228] Call Trace: [ 999.215245] [] dump_stack+0xc1/0x128 [ 999.215254] [] warn_alloc.cold.31+0x7f/0x9c [ 999.215263] [] ? zone_watermark_ok_safe+0x250/0x250 [ 999.215271] [] ? rcu_read_lock_sched_held+0x103/0x120 [ 999.215279] [] ? compaction_deferred+0x118/0x320 [ 999.215287] [] ? try_to_compact_pages+0x41/0x710 [ 999.215296] [] __alloc_pages_nodemask+0x628/0x1bd0 [ 999.215304] [] ? gfp_pfmemalloc_allowed+0x110/0x110 [ 999.215311] [] ? _raw_spin_unlock_irqrestore+0x6b/0x70 [ 999.215319] [] ? trace_hardirqs_on+0x10/0x10 [ 999.215326] [] ? migrate_swap_stop+0x810/0x810 [ 999.215333] [] ? mark_held_locks+0xc7/0x130 [ 999.215342] [] ? mutex_lock_interruptible_nested+0x7f3/0x9c0 [ 999.215349] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 999.215356] [] kmalloc_order+0x2a/0x70 [ 999.215363] [] kmalloc_order_trace+0x1f/0x190 [ 999.215371] [] __kmalloc+0x1ae/0x310 [ 999.215380] [] ? avc_has_extended_perms+0x56a/0xd90 [ 999.215387] [] ? avc_has_extended_perms+0xde/0xd90 [ 999.215395] [] input_mt_init_slots+0xcb/0x400 [ 999.215404] [] uinput_ioctl_handler.isra.4+0x161d/0x1980 [ 999.215410] [] ? avc_ss_reset+0x110/0x110 [ 999.215418] [] ? uinput_ff_upload_from_user+0x350/0x350 [ 999.215425] [] ? __lock_acquire+0x654/0x4a10 [ 999.215434] [] uinput_ioctl+0x4c/0x60 [ 999.215441] [] ? uinput_compat_ioctl+0x80/0x80 [ 999.215449] [] do_vfs_ioctl+0x1ac/0x11a0 [ 999.215457] [] ? ioctl_preallocate+0x220/0x220 [ 999.215465] [] ? selinux_parse_skb.constprop.42+0x1a90/0x1a90 [ 999.215473] [] ? check_preemption_disabled+0x3b/0x200 [ 999.215480] [] ? __fget+0x214/0x3d0 [ 999.215487] [] ? __fget+0x23b/0x3d0 [ 999.215494] [] ? __fget+0x47/0x3d0 [ 999.215501] [] ? security_file_ioctl+0x8f/0xc0 [ 999.215509] [] SyS_ioctl+0x8f/0xc0 [ 999.215516] [] ? do_vfs_ioctl+0x11a0/0x11a0 [ 999.215523] [] do_syscall_64+0x19f/0x550 [ 999.215530] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 999.215533] Mem-Info: [ 999.215550] active_anon:789617 inactive_anon:64333 isolated_anon:13 [ 999.215550] active_file:1270 inactive_file:356 isolated_file:32 [ 999.215550] unevictable:4 dirty:135 writeback:0 unstable:0 [ 999.215550] slab_reclaimable:9935 slab_unreclaimable:89958 [ 999.215550] mapped:71099 shmem:175177 pagetables:31368 bounce:0 [ 999.215550] free:33107 free_pcp:0 free_cma:0 [ 999.215563] Node 0 active_anon:3158468kB inactive_anon:257332kB active_file:5080kB inactive_file:1424kB unevictable:16kB isolated(anon):52kB isolated(file):128kB mapped:284396kB dirty:540kB writeback:0kB shmem:700708kB writeback_tmp:0kB unstable:0kB pages_scanned:0 all_unreclaimable? no [ 999.215581] DMA32 free:122820kB min:4696kB low:7712kB high:10728kB active_anon:526348kB inactive_anon:26944kB active_file:2160kB inactive_file:1144kB unevictable:0kB writepending:156kB present:3145324kB managed:3020132kB mlocked:0kB slab_reclaimable:8996kB slab_unreclaimable:148432kB kernel_stack:16096kB pagetables:36404kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 3505 3505 [ 999.215606] Normal free:9608kB min:5580kB low:9168kB high:12756kB active_anon:2632220kB inactive_anon:230388kB active_file:2920kB inactive_file:380kB unevictable:16kB writepending:384kB present:4718592kB managed:3589316kB mlocked:16kB slab_reclaimable:30744kB slab_unreclaimable:211400kB kernel_stack:26272kB pagetables:89068kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 0 0 [ 999.215657] DMA32: 112*4kB (UME) 55*8kB (UME) 135*16kB (UME) 54*32kB (UME) 321*64kB (UME) 208*128kB (UME) 133*256kB (UM) 70*512kB (U) 1*1024kB (M) 0*2048kB 0*4096kB = 122856kB Normal: 402*4kB (UME) 263*8kB (UME) 29*16kB (UME) 66*32kB (UME) 41*64kB (UM) 6*128kB (UME) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 9680kB 176878 total pagecache pages [ 999.215700] 0 pages in swap cache [ 999.215704] Swap cache stats: add 0, delete 0, find 0/0 [ 999.215706] Free swap = 0kB [ 999.215708] Total swap = 0kB [ 999.215710] 1965979 pages RAM [ 999.215712] 0 pages HighMem/MovableOnly [ 999.215715] 313617 pages reserved [ 999.216913] syz-executor.4: page allocation failure: order:9, mode:0x240c0c0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO) [ 999.216919] CPU: 0 PID: 1428 Comm: syz-executor.4 Not tainted 4.9.141+ #1 [ 999.216931] ffff8800b87676e8 ffffffff81b42e79 1ffff100170ecedf ffff8800978d8000 [ 999.216940] ffffffff82a974e0 0000000000000001 0000000000400000 ffff8800b8767830 [ 999.216948] ffffffff814fc7c8 0000000041b58ab3 ffffffff82e37a10 ffffffff81427db0 [ 999.216949] Call Trace: [ 999.216958] [] dump_stack+0xc1/0x128 [ 999.216964] [] warn_alloc.cold.31+0x7f/0x9c [ 999.216971] [] ? zone_watermark_ok_safe+0x250/0x250 [ 999.216977] [] ? rcu_read_lock_sched_held+0x103/0x120 [ 999.216984] [] ? compaction_deferred+0x118/0x320 [ 999.216990] [] ? try_to_compact_pages+0x41/0x710 [ 999.216997] [] __alloc_pages_nodemask+0x628/0x1bd0 [ 999.217005] [] ? gfp_pfmemalloc_allowed+0x110/0x110 [ 999.217010] [] ? _raw_spin_unlock_irqrestore+0x6b/0x70 [ 999.217016] [] ? trace_hardirqs_on+0x10/0x10 [ 999.217021] [] ? migrate_swap_stop+0x810/0x810 [ 999.217027] [] ? mark_held_locks+0xc7/0x130 [ 999.217034] [] ? mutex_lock_interruptible_nested+0x7f3/0x9c0 [ 999.217040] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 999.217046] [] kmalloc_order+0x2a/0x70 [ 999.217052] [] kmalloc_order_trace+0x1f/0x190 [ 999.217058] [] __kmalloc+0x1ae/0x310 [ 999.217065] [] ? avc_has_extended_perms+0x56a/0xd90 [ 999.217071] [] ? avc_has_extended_perms+0xde/0xd90 [ 999.217077] [] input_mt_init_slots+0xcb/0x400 [ 999.217085] [] uinput_ioctl_handler.isra.4+0x161d/0x1980 [ 999.217091] [] ? avc_ss_reset+0x110/0x110 [ 999.217097] [] ? uinput_ff_upload_from_user+0x350/0x350 [ 999.217103] [] ? __lock_acquire+0x654/0x4a10 [ 999.217110] [] uinput_ioctl+0x4c/0x60 [ 999.217116] [] ? uinput_compat_ioctl+0x80/0x80 [ 999.217122] [] do_vfs_ioctl+0x1ac/0x11a0 [ 999.217128] [] ? ioctl_preallocate+0x220/0x220 [ 999.217135] [] ? selinux_parse_skb.constprop.42+0x1a90/0x1a90 [ 999.217142] [] ? check_preemption_disabled+0x3b/0x200 [ 999.217147] [] ? __fget+0x214/0x3d0 [ 999.217153] [] ? __fget+0x23b/0x3d0 [ 999.217158] [] ? __fget+0x47/0x3d0 [ 999.217164] [] ? security_file_ioctl+0x8f/0xc0 [ 999.217170] [] SyS_ioctl+0x8f/0xc0 [ 999.217176] [] ? do_vfs_ioctl+0x11a0/0x11a0 [ 999.217182] [] do_syscall_64+0x19f/0x550 [ 999.217188] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 999.217191] Mem-Info: [ 999.217204] active_anon:789617 inactive_anon:64333 isolated_anon:13 [ 999.217204] active_file:1270 inactive_file:356 isolated_file:32 [ 999.217204] unevictable:4 dirty:135 writeback:0 unstable:0 [ 999.217204] slab_reclaimable:9935 slab_unreclaimable:89958 [ 999.217204] mapped:71099 shmem:175177 pagetables:31368 bounce:0 [ 999.217204] free:33107 free_pcp:0 free_cma:0 [ 999.217215] Node 0 active_anon:3158468kB inactive_anon:257332kB active_file:5080kB inactive_file:1424kB unevictable:16kB isolated(anon):52kB isolated(file):128kB mapped:284396kB dirty:540kB writeback:0kB shmem:700708kB writeback_tmp:0kB unstable:0kB pages_scanned:0 all_unreclaimable? no [ 999.217236] DMA32 free:122820kB min:4696kB low:7712kB high:10728kB active_anon:526348kB inactive_anon:26944kB active_file:2160kB inactive_file:1144kB unevictable:0kB writepending:156kB present:3145324kB managed:3020132kB mlocked:0kB slab_reclaimable:8996kB slab_unreclaimable:148432kB kernel_stack:16096kB pagetables:36404kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 3505 3505 [ 999.217869] Normal free:9608kB min:5580kB low:9168kB high:12756kB active_anon:2632220kB inactive_anon:230388kB active_file:2920kB inactive_file:380kB unevictable:16kB writepending:384kB present:4718592kB managed:3589316kB mlocked:16kB slab_reclaimable:30744kB slab_unreclaimable:211400kB kernel_stack:26272kB pagetables:89068kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 0 0 [ 999.217920] DMA32: 112*4kB (UME) 55*8kB (UME) 135*16kB (UME) 54*32kB (UME) 321*64kB (UME) 208*128kB (UME) 133*256kB (UM) 70*512kB (U) 1*1024kB (M) 0*2048kB 0*4096kB = 122856kB Normal: 401*4kB (UME) 263*8kB (UME) 29*16kB (UME) 66*32kB (UME) 41*64kB (UM) 6*128kB (UME) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 9676kB 176878 total pagecache pages [ 999.217962] 0 pages in swap cache [ 999.217966] Swap cache stats: add 0, delete 0, find 0/0 [ 999.217968] Free swap = 0kB [ 999.217970] Total swap = 0kB [ 999.217972] 1965979 pages RAM [ 999.217975] 0 pages HighMem/MovableOnly [ 999.217977] 313617 pages reserved [ 999.220829] syz-executor.3: page allocation failure: order:9, mode:0x240c0c0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO) [ 999.220839] CPU: 0 PID: 1425 Comm: syz-executor.3 Not tainted 4.9.141+ #1 [ 999.220853] ffff880044b076e8 ffffffff81b42e79 1ffff10008960edf ffff8801c6682f80 [ 999.220865] ffffffff82a974e0 0000000000000001 0000000000400000 ffff880044b07830 [ 999.220876] ffffffff814fc7c8 0000000041b58ab3 ffffffff82e37a10 ffffffff81427db0 [ 999.220877] Call Trace: [ 999.220892] [] dump_stack+0xc1/0x128 [ 999.220903] [] warn_alloc.cold.31+0x7f/0x9c [ 999.220915] [] ? zone_watermark_ok_safe+0x250/0x250 [ 999.220923] [] ? rcu_read_lock_sched_held+0x103/0x120 [ 999.220931] [] ? compaction_deferred+0x118/0x320 [ 999.220938] [] ? try_to_compact_pages+0x41/0x710 [ 999.220947] [] __alloc_pages_nodemask+0x628/0x1bd0 [ 999.220955] [] ? gfp_pfmemalloc_allowed+0x110/0x110 [ 999.220963] [] ? drop_futex_key_refs.isra.2+0x56/0xd0 [ 999.220970] [] ? trace_hardirqs_on+0x10/0x10 [ 999.220977] [] ? futex_wait_setup+0x330/0x330 [ 999.220984] [] ? mark_held_locks+0xc7/0x130 [ 999.220993] [] ? mutex_lock_interruptible_nested+0x7f3/0x9c0 [ 999.221000] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 999.221008] [] kmalloc_order+0x2a/0x70 [ 999.221015] [] kmalloc_order_trace+0x1f/0x190 [ 999.221022] [] __kmalloc+0x1ae/0x310 [ 999.221030] [] ? avc_has_extended_perms+0x56a/0xd90 [ 999.221039] [] ? avc_has_extended_perms+0xde/0xd90 [ 999.221048] [] input_mt_init_slots+0xcb/0x400 [ 999.221057] [] uinput_ioctl_handler.isra.4+0x161d/0x1980 [ 999.221064] [] ? avc_ss_reset+0x110/0x110 [ 999.221073] [] ? uinput_ff_upload_from_user+0x350/0x350 [ 999.221080] [] ? __lock_acquire+0x654/0x4a10 [ 999.221089] [] uinput_ioctl+0x4c/0x60 [ 999.221097] [] ? uinput_compat_ioctl+0x80/0x80 [ 999.221105] [] do_vfs_ioctl+0x1ac/0x11a0 [ 999.221113] [] ? ioctl_preallocate+0x220/0x220 [ 999.221123] [] ? selinux_parse_skb.constprop.42+0x1a90/0x1a90 [ 999.221131] [] ? check_preemption_disabled+0x3b/0x200 [ 999.221139] [] ? __fget+0x214/0x3d0 [ 999.221146] [] ? __fget+0x23b/0x3d0 [ 999.221153] [] ? __fget+0x47/0x3d0 [ 999.221159] [] ? security_file_ioctl+0x8f/0xc0 [ 999.221166] [] SyS_ioctl+0x8f/0xc0 [ 999.221179] [] ? do_vfs_ioctl+0x11a0/0x11a0 [ 999.221187] [] do_syscall_64+0x19f/0x550 [ 999.221197] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 999.221217] Mem-Info: [ 999.221238] active_anon:789617 inactive_anon:64333 isolated_anon:13 [ 999.221238] active_file:1270 inactive_file:356 isolated_file:32 [ 999.221238] unevictable:4 dirty:135 writeback:0 unstable:0 [ 999.221238] slab_reclaimable:9935 slab_unreclaimable:89958 [ 999.221238] mapped:71099 shmem:175177 pagetables:31368 bounce:0 [ 999.221238] free:33094 free_pcp:0 free_cma:0 [ 999.221262] Node 0 active_anon:3158468kB inactive_anon:257332kB active_file:5080kB inactive_file:1424kB unevictable:16kB isolated(anon):52kB isolated(file):128kB mapped:284396kB dirty:540kB writeback:0kB shmem:700708kB writeback_tmp:0kB unstable:0kB pages_scanned:0 all_unreclaimable? no [ 999.221282] DMA32 free:122820kB min:4696kB low:7712kB high:10728kB active_anon:526348kB inactive_anon:26944kB active_file:2160kB inactive_file:1144kB unevictable:0kB writepending:156kB present:3145324kB managed:3020132kB mlocked:0kB slab_reclaimable:8996kB slab_unreclaimable:148432kB kernel_stack:16096kB pagetables:36404kB bounce:0kB free_pcp:40kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 3505 3505 [ 999.221308] Normal free:9556kB min:5580kB low:9168kB high:12756kB active_anon:2632220kB inactive_anon:230388kB active_file:2920kB inactive_file:380kB unevictable:16kB writepending:384kB present:4718592kB managed:3589316kB mlocked:16kB slab_reclaimable:30744kB slab_unreclaimable:211400kB kernel_stack:26304kB pagetables:89068kB bounce:0kB free_pcp:4kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 0 0 [ 999.221360] DMA32: 112*4kB (UME) 55*8kB (UME) 135*16kB (UME) 54*32kB (UME) 321*64kB (UME) 208*128kB (UME) 133*256kB (UM) 70*512kB (U) 1*1024kB (M) 0*2048kB 0*4096kB = 122856kB Normal: 398*4kB (UME) 263*8kB (UME) 29*16kB (UME) 65*32kB (UME) 41*64kB (UM) 6*128kB (UME) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 9632kB 176878 total pagecache pages [ 999.221405] 0 pages in swap cache [ 999.221409] Swap cache stats: add 0, delete 0, find 0/0 [ 999.221411] Free swap = 0kB [ 999.221413] Total swap = 0kB [ 999.221415] 1965979 pages RAM [ 999.221417] 0 pages HighMem/MovableOnly [ 999.221419] 313617 pages reserved [ 999.229454] syz-executor.4: page allocation failure: order:9, mode:0x240c0c0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO) [ 999.229465] CPU: 0 PID: 1428 Comm: syz-executor.4 Not tainted 4.9.141+ #1 [ 999.229479] ffff8800b87676e8 ffffffff81b42e79 1ffff100170ecedf ffff8800978d8000 [ 999.229489] ffffffff82a974e0 0000000000000001 0000000000400000 ffff8800b8767830 [ 999.229498] ffffffff814fc7c8 0000000041b58ab3 ffffffff82e37a10 ffffffff81427db0 [ 999.229500] Call Trace: [ 999.229513] [] dump_stack+0xc1/0x128 [ 999.229522] [] warn_alloc.cold.31+0x7f/0x9c [ 999.229531] [] ? zone_watermark_ok_safe+0x250/0x250 [ 999.229538] [] ? rcu_read_lock_sched_held+0x103/0x120 [ 999.229547] [] ? compaction_deferred+0x118/0x320 [ 999.229555] [] ? try_to_compact_pages+0x41/0x710 [ 999.229563] [] __alloc_pages_nodemask+0x628/0x1bd0 [ 999.229572] [] ? gfp_pfmemalloc_allowed+0x110/0x110 [ 999.229580] [] ? _raw_spin_unlock_irqrestore+0x6b/0x70 [ 999.229588] [] ? trace_hardirqs_on+0x10/0x10 [ 999.229595] [] ? migrate_swap_stop+0x810/0x810 [ 999.229602] [] ? mark_held_locks+0xc7/0x130 [ 999.229612] [] ? mutex_lock_interruptible_nested+0x7f3/0x9c0 [ 999.229619] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 999.229626] [] kmalloc_order+0x2a/0x70 [ 999.229633] [] kmalloc_order_trace+0x1f/0x190 [ 999.229641] [] __kmalloc+0x1ae/0x310 [ 999.229650] [] ? avc_has_extended_perms+0x56a/0xd90 [ 999.229657] [] ? avc_has_extended_perms+0xde/0xd90 [ 999.229666] [] input_mt_init_slots+0xcb/0x400 [ 999.229675] [] uinput_ioctl_handler.isra.4+0x161d/0x1980 [ 999.229682] [] ? avc_ss_reset+0x110/0x110 [ 999.229690] [] ? uinput_ff_upload_from_user+0x350/0x350 [ 999.229697] [] ? __lock_acquire+0x654/0x4a10 [ 999.229705] [] uinput_ioctl+0x4c/0x60 [ 999.229713] [] ? uinput_compat_ioctl+0x80/0x80 [ 999.229721] [] do_vfs_ioctl+0x1ac/0x11a0 [ 999.229728] [] ? ioctl_preallocate+0x220/0x220 [ 999.229737] [] ? selinux_parse_skb.constprop.42+0x1a90/0x1a90 [ 999.229744] [] ? check_preemption_disabled+0x3b/0x200 [ 999.229752] [] ? __fget+0x214/0x3d0 [ 999.229759] [] ? __fget+0x23b/0x3d0 [ 999.229766] [] ? __fget+0x47/0x3d0 [ 999.229773] [] ? security_file_ioctl+0x8f/0xc0 [ 999.229780] [] SyS_ioctl+0x8f/0xc0 [ 999.229787] [] ? do_vfs_ioctl+0x11a0/0x11a0 [ 999.229794] [] do_syscall_64+0x19f/0x550 [ 999.229802] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 999.230085] Mem-Info: [ 999.230101] active_anon:789617 inactive_anon:64333 isolated_anon:13 [ 999.230101] active_file:1270 inactive_file:356 isolated_file:32 [ 999.230101] unevictable:4 dirty:135 writeback:0 unstable:0 [ 999.230101] slab_reclaimable:9935 slab_unreclaimable:89958 [ 999.230101] mapped:71099 shmem:175177 pagetables:31331 bounce:0 [ 999.230101] free:33249 free_pcp:0 free_cma:0 [ 999.230114] Node 0 active_anon:3158468kB inactive_anon:257332kB active_file:5080kB inactive_file:1424kB unevictable:16kB isolated(anon):52kB isolated(file):128kB mapped:284396kB dirty:540kB writeback:0kB shmem:700708kB writeback_tmp:0kB unstable:0kB pages_scanned:0 all_unreclaimable? no [ 999.230133] DMA32 free:123440kB min:4696kB low:7712kB high:10728kB active_anon:526348kB inactive_anon:26944kB active_file:2160kB inactive_file:1144kB unevictable:0kB writepending:156kB present:3145324kB managed:3020132kB mlocked:0kB slab_reclaimable:8996kB slab_unreclaimable:148432kB kernel_stack:16000kB pagetables:36256kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 3505 3505 [ 999.230159] Normal free:9556kB min:5580kB low:9168kB high:12756kB active_anon:2632220kB inactive_anon:230388kB active_file:2920kB inactive_file:380kB unevictable:16kB writepending:384kB present:4718592kB managed:3589316kB mlocked:16kB slab_reclaimable:30744kB slab_unreclaimable:211400kB kernel_stack:26304kB pagetables:89068kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 0 0 [ 999.230204] DMA32: 155*4kB (UME) 64*8kB (UME) 139*16kB (UME) 65*32kB (UME) 321*64kB (UME) 208*128kB (UME) 133*256kB (UM) 70*512kB (U) 1*1024kB (M) 0*2048kB 0*4096kB = 123516kB Normal: 382*4kB (UME) 263*8kB (UME) 29*16kB (UME) 65*32kB (UME) 41*64kB (UM) 6*128kB (UME) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 9568kB 176878 total pagecache pages [ 999.230626] 0 pages in swap cache [ 999.230629] Swap cache stats: add 0, delete 0, find 0/0 [ 999.230631] Free swap = 0kB [ 999.230632] Total swap = 0kB [ 999.230634] 1965979 pages RAM [ 999.230636] 0 pages HighMem/MovableOnly [ 999.230638] 313617 pages reserved [ 999.273071] input: syz0 as /devices/virtual/input/input23419 [ 999.377371] input: syz0 as /devices/virtual/input/input23423 [ 999.390642] uinput: write device info first [ 999.417149] input: syz0 as /devices/virtual/input/input23435 [ 999.477600] input: syz0 as /devices/virtual/input/input23436 [ 999.564664] uinput: write device info first [ 999.662927] input: syz0 as /devices/virtual/input/input23450 [ 999.677990] input: syz0 as /devices/virtual/input/input23454 [ 999.720112] uinput: write device info first [ 999.745356] input: syz0 as /devices/virtual/input/input23462 [ 1000.727198] input: syz0 as /devices/virtual/input/input23469 [ 1000.745680] uinput: write device info first [ 1000.779615] input: syz0 as /devices/virtual/input/input23476 [ 1000.921935] input: syz0 as /devices/virtual/input/input23488 [ 1000.962098] input: syz0 as /devices/virtual/input/input23493 [ 1001.005556] uinput: write device info first [ 1001.014316] input: syz0 as /devices/virtual/input/input23502 [ 1001.178592] uinput: write device info first [ 1001.261447] input: syz0 as /devices/virtual/input/input23515 [ 1001.284251] input: syz0 as /devices/virtual/input/input23521 [ 1001.325937] input: syz0 as /devices/virtual/input/input23524 [ 1001.363830] uinput: write device info first [ 1001.515406] input: syz0 as /devices/virtual/input/input23540 [ 1001.546809] uinput: write device info first [ 1001.550848] input: syz0 as /devices/virtual/input/input23547 [ 1001.599262] input: syz0 as /devices/virtual/input/input23549 [ 1001.762164] uinput: write device info first [ 1001.816803] input: syz0 as /devices/virtual/input/input23565 [ 1001.850314] input: syz0 as /devices/virtual/input/input23568 [ 1001.888348] input: syz0 as /devices/virtual/input/input23572 [ 1002.021411] uinput: write device info first [ 1002.107850] input: syz0 as /devices/virtual/input/input23585 [ 1002.116367] input: syz0 as /devices/virtual/input/input23588 [ 1002.152921] input: syz0 as /devices/virtual/input/input23597 [ 1002.310299] input: syz0 as /devices/virtual/input/input23604 [ 1002.339191] input: syz0 as /devices/virtual/input/input23609 [ 1002.349938] uinput: write device info first [ 1002.358860] input: syz0 as /devices/virtual/input/input23610 [ 1002.508036] uinput: write device info first [ 1002.606021] uinput: write device info first [ 1002.614773] input: syz0 as /devices/virtual/input/input23629 [ 1002.637056] input: syz0 as /devices/virtual/input/input23636 [ 1002.656073] input: syz0 as /devices/virtual/input/input23637 [ 1002.801238] input: syz0 as /devices/virtual/input/input23642 [ 1002.866824] INFO: task init:12277 blocked for more than 140 seconds. [ 1002.866829] Not tainted 4.9.141+ #1 [ 1002.866831] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1002.866851] init D28888 12277 1 0x00000000 [ 1002.866863] ffff8801ccee17c0 ffff8800669bac00 ffff880098b75280 ffff8801c8de97c0 [ 1002.866873] ffff8801db721018 ffff88003fc37580 ffffffff828075c2 ffff8801ccee2070 [ 1002.866887] 000000000000015b 0000000000000000 0000000000000000 ffff8801db7218f0 [ 1002.866888] Call Trace: [ 1002.866903] [] ? __schedule+0x662/0x1b10 [ 1002.866911] [] ? __down+0x15a/0x2b0 [ 1002.866918] [] schedule+0x7f/0x1b0 [ 1002.866925] [] schedule_timeout+0x735/0xe20 [ 1002.866931] [] ? usleep_range+0x140/0x140 [ 1002.866940] [] ? do_dentry_open+0x3ef/0xc90 [ 1002.866947] [] ? path_openat+0x542/0x2790 [ 1002.866954] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1002.866965] [] ? mark_held_locks+0xc7/0x130 [ 1002.866971] [] ? _raw_spin_unlock_irq+0x27/0x50 [ 1002.866977] [] ? __down+0x15a/0x2b0 [ 1002.866983] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 1002.866990] [] ? __down+0x15a/0x2b0 [ 1002.866997] [] __down+0x191/0x2b0 [ 1002.867004] [] ? ww_mutex_unlock+0x300/0x300 [ 1002.867012] [] down+0x5e/0x80 [ 1002.867020] [] console_lock+0x2c/0x80 [ 1002.867028] [] ? kmem_cache_alloc_trace+0x117/0x2e0 [ 1002.867033] [] console_device+0x1c/0xc0 [ 1002.867042] [] tty_open+0x6f5/0xdf0 [ 1002.867049] [] ? tty_init_dev+0x430/0x430 [ 1002.867057] [] ? chrdev_open+0xc7/0x5c0 [ 1002.867062] [] ? tty_init_dev+0x430/0x430 [ 1002.867069] [] chrdev_open+0x22d/0x5c0 [ 1002.867079] [] ? cdev_put.part.0+0x50/0x50 [ 1002.867087] [] do_dentry_open+0x3ef/0xc90 [ 1002.867094] [] ? cdev_put.part.0+0x50/0x50 [ 1002.867102] [] vfs_open+0x11c/0x210 [ 1002.867108] [] ? may_open.isra.20+0x14f/0x2a0 [ 1002.867115] [] path_openat+0x542/0x2790 [ 1002.867122] [] ? path_mountpoint+0x6c0/0x6c0 [ 1002.867129] [] ? trace_hardirqs_on+0x10/0x10 [ 1002.867138] [] ? expand_files.part.3+0x3a9/0x6d0 [ 1002.867144] [] do_filp_open+0x197/0x270 [ 1002.867151] [] ? may_open_dev+0xe0/0xe0 [ 1002.867158] [] ? _raw_spin_unlock+0x2c/0x50 [ 1002.867164] [] ? __alloc_fd+0x1d7/0x4a0 [ 1002.867176] [] do_sys_open+0x30d/0x5c0 [ 1002.867183] [] ? filp_open+0x70/0x70 [ 1002.867189] [] ? _raw_write_unlock_irq+0x27/0x50 [ 1002.867197] [] SyS_open+0x2d/0x40 [ 1002.867204] [] ? do_sys_open+0x5c0/0x5c0 [ 1002.867210] [] do_syscall_64+0x19f/0x550 [ 1002.867217] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 1002.867220] [ 1002.867220] Showing all locks held in the system: [ 1002.867228] 2 locks held by khungtaskd/24: [ 1002.867245] #0: (rcu_read_lock){......}, at: [] watchdog+0x11c/0xa20 [ 1002.867258] #1: (tasklist_lock){.+.+..}, at: [] debug_show_all_locks+0x79/0x218 [ 1002.867272] 1 lock held by rsyslogd/1900: [ 1002.867283] #0: (&f->f_pos_lock){+.+.+.}, at: [] __fdget_pos+0xac/0xd0 [ 1002.867287] 2 locks held by getty/2027: [ 1002.867300] #0: (&tty->ldisc_sem){++++++}, at: [] ldsem_down_read+0x32/0x40 [ 1002.867313] #1: (&ldata->atomic_read_lock){+.+...}, at: [] n_tty_read+0x202/0x16e0 [ 1002.867429] 1 lock held by init/12277: [ 1002.867442] #0: (tty_mutex){+.+.+.}, at: [] tty_open+0x476/0xdf0 [ 1002.867446] 1 lock held by init/12278: [ 1002.867463] #0: (tty_mutex){+.+.+.}, at: [] tty_open+0x476/0xdf0 [ 1002.867466] 1 lock held by init/12279: [ 1002.867478] #0: (tty_mutex){+.+.+.}, at: [] tty_open+0x476/0xdf0 [ 1002.867481] 1 lock held by init/12281: [ 1002.867492] #0: (tty_mutex){+.+.+.}, at: [] tty_open+0x476/0xdf0 [ 1002.867504] 1 lock held by init/13170: [ 1002.867516] #0: (tty_mutex){+.+.+.}, at: [] tty_open+0x476/0xdf0 [ 1002.867519] 1 lock held by init/13171: [ 1002.867530] #0: (tty_mutex){+.+.+.}, at: [] tty_open+0x476/0xdf0 [ 1002.867573] [ 1002.867575] ============================================= [ 1002.867575] [ 1002.867579] NMI backtrace for cpu 1 [ 1002.867586] CPU: 1 PID: 24 Comm: khungtaskd Not tainted 4.9.141+ #1 [ 1002.867597] ffff8801d9907d08 ffffffff81b42e79 0000000000000000 0000000000000001 [ 1002.867606] 0000000000000001 0000000000000001 ffffffff810983b0 ffff8801d9907d40 [ 1002.867615] ffffffff81b4df89 0000000000000001 0000000000000000 0000000000000002 [ 1002.867617] Call Trace: [ 1002.867627] [] dump_stack+0xc1/0x128 [ 1002.867637] [] ? irq_force_complete_move+0x330/0x330 [ 1002.867644] [] nmi_cpu_backtrace.cold.0+0x48/0x87 [ 1002.867652] [] ? irq_force_complete_move+0x330/0x330 [ 1002.867659] [] nmi_trigger_cpumask_backtrace+0x12c/0x151 [ 1002.867667] [] arch_trigger_cpumask_backtrace+0x14/0x20 [ 1002.867674] [] watchdog+0x6ad/0xa20 [ 1002.867680] [] ? watchdog+0x11c/0xa20 [ 1002.867688] [] kthread+0x26d/0x300 [ 1002.867695] [] ? reset_hung_task_detector+0x20/0x20 [ 1002.867702] [] ? kthread_park+0xa0/0xa0 [ 1002.867709] [] ? __switch_to_asm+0x34/0x70 [ 1002.867716] [] ? kthread_park+0xa0/0xa0 [ 1002.867722] [] ? kthread_park+0xa0/0xa0 [ 1002.867728] [] ret_from_fork+0x5c/0x70 [ 1002.867734] Sending NMI from CPU 1 to CPUs 0: [ 1002.868060] NMI backtrace for cpu 0 [ 1002.868062] CPU: 0 PID: 1812 Comm: udevd Not tainted 4.9.141+ #1 [ 1002.868064] task: ffff88002a248000 task.stack: ffff880024ee0000 [ 1002.868068] RIP: 0010:[] c [] debug_check_no_obj_freed+0x0/0x890 [ 1002.868070] RSP: 0018:ffff880024ee7938 EFLAGS: 00000246 [ 1002.868073] RAX: 0000000000000007 RBX: ffff88004568f4d0 RCX: 1ffff1000544911f [ 1002.868075] RDX: 0000000000000000 RSI: 0000000000000050 RDI: ffff88004568f4d0 [ 1002.868078] RBP: ffff880024ee7968 R08: ffff88002a2488f8 R09: 0000000000000000 [ 1002.868080] R10: 0000000000000000 R11: 0000000000000000 R12: ffffea000115a3c0 [ 1002.868083] R13: ffffffff814bff1e R14: ffff8801da490000 R15: 0000000000000246 [ 1002.868086] FS: 0000000000000000(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000 [ 1002.868088] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1002.868090] CR2: 0000000000625208 CR3: 0000000033310000 CR4: 00000000001606b0 [ 1002.868093] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1002.868096] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1002.868097] Stack: [ 1002.868100] ffffffff814ef3a4c dffffc0000000000c ffff88004568f4d0c ffff88004568f4e8c [ 1002.868102] ffff88004568f310c ffff8801d4bd98c0c ffff880024ee79c8c ffffffff814bff1ec [ 1002.868105] 0000000000000000c ffff8801ce706c30c ffff88004568f4e0c ffff8801ce706ca8c [ 1002.868107] Call Trace: [ 1002.868109] [] ? kmem_cache_free+0x1a4/0x310 [ 1002.868111] [] unlink_anon_vmas+0x29e/0x840 [ 1002.868114] [] free_pgtables+0x13e/0x240 [ 1002.868116] [] ? unmap_vmas+0xa1/0xd0 [ 1002.868118] [] exit_mmap+0x1db/0x3a0 [ 1002.868121] [] ? SyS_munmap+0xa0/0xa0 [ 1002.868123] [] ? __might_sleep+0x95/0x1a0 [ 1002.868125] [] mmput+0xcd/0x360 [ 1002.868127] [] flush_old_exec+0x86c/0x1b70 [ 1002.868129] [] ? __kmalloc+0x12f/0x310 [ 1002.868131] [] load_elf_binary+0x889/0x4bc0 [ 1002.868134] [] ? trace_hardirqs_on+0x10/0x10 [ 1002.868136] [] ? audit_inode_permission+0x310/0x310 [ 1002.868138] [] ? elf_core_dump+0x4330/0x4330 [ 1002.868141] [] ? search_binary_handler+0xff/0x6f0 [ 1002.868143] [] search_binary_handler+0x14f/0x6f0 [ 1002.868146] [] do_execveat_common.isra.14+0x1139/0x1ed0 [ 1002.868148] [] ? do_execveat_common.isra.14+0x1043/0x1ed0 [ 1002.868150] [] ? prepare_bprm_creds+0x110/0x110 [ 1002.868153] [] ? getname_flags+0x229/0x550 [ 1002.868155] [] SyS_execve+0x42/0x50 [ 1002.868157] [] ? setup_new_exec+0x830/0x830 [ 1002.868159] [] do_syscall_64+0x19f/0x550 [ 1002.868162] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 1002.868169] Code: c24 c48 c8b c4c c24 c08 ce9 ca9 cfc cff cff c4c c89 cff ce8 c98 c87 c94 cff c4c c8b c04 c24 c48 c8b c4c c24 c08 ce9 cd1 cfe cff cff ce8 ca5 c87 c94 cff ce9 cf4 cfe cff cff c<48> cb9 c00 c00 c00 c00 c00 cfc cff cdf c55 c48 c89 ce5 c41 c57 c48 c8d c85 c78 cff c [ 1002.868778] Kernel panic - not syncing: hung_task: blocked tasks [ 1002.868784] CPU: 1 PID: 24 Comm: khungtaskd Not tainted 4.9.141+ #1 [ 1002.868795] ffff8801d9907cc8 ffffffff81b42e79 ffffffff82a78560 00000000ffffffff [ 1002.868803] 0000000000000000 0000000000000001 dffffc0000000000 ffff8801d9907d88 [ 1002.868811] ffffffff813f7125 0000000041b58ab3 ffffffff82e2b62b ffffffff813f6f66 [ 1002.868812] Call Trace: [ 1002.868826] [] dump_stack+0xc1/0x128 [ 1002.868832] [] panic+0x1bf/0x39f [ 1002.868839] [] ? add_taint.cold.5+0x16/0x16 [ 1002.868846] [] ? nmi_trigger_cpumask_backtrace+0x102/0x151 [ 1002.868852] [] watchdog+0x6be/0xa20 [ 1002.868858] [] ? watchdog+0x11c/0xa20 [ 1002.868866] [] kthread+0x26d/0x300 [ 1002.868872] [] ? reset_hung_task_detector+0x20/0x20 [ 1002.868878] [] ? kthread_park+0xa0/0xa0 [ 1002.868885] [] ? __switch_to_asm+0x34/0x70 [ 1002.868892] [] ? kthread_park+0xa0/0xa0 [ 1002.868898] [] ? kthread_park+0xa0/0xa0 [ 1002.868904] [] ret_from_fork+0x5c/0x70 [ 1002.869569] Kernel Offset: disabled