00711199673014c5b37ccb315ebc55680b4b9975f15cfa1f9c3a0a557b84b97b2de7d4057a7d3f4740bbf672f24c913d591f1fb83f75181864bbb61002662bca8b5bc52b8e4a231a0f27c8e24269cc3a1a87366ff35647d495a7775a74e9d7aa994f1020fef6ebb810406aab0aac79d74fd4c2cf0bea879c78292a9de1cd6ee5c4b94df39a8efdcb835075eca9f1f00a99810442a764a44f1ef392eb82ea631645f9b4cfc53f17064038d62afd9996a5c3e140c3e97ab30ec0abc3af1c086d2f86cbcb127be19e81026c35fc7212782d9ea1415703a486fb8166fa6584f43fc23e16726f4d85432a755e1b1240bfc0cc08e7c1bb0364bbe6b0b4c5908ebc7de41fac6099e6bb6c58b7decaddaca7d22eec7ff95db459b7eb33a19938b5c1782efa853fe6a9dc329144966ef80f9f6ebfd424015c040cf1f7631f00023dfc66b8868cc469750439802270bd285daf7d2df8b77c93a13e541c98c408f46b0eb48c1b7d30674dfcc99a74e6014d20f198b6fcb204120f66da7cdef854249b55b87c10783e15577c886062813e775863e1c0a6dd43cc45d1b07e36cf2716333d9ca967f067ad25e58ec38b46a091cbd9b1de2b06bb5116e696eec5a462c87cd479b0b0e8dddb5930776ac5bdc444ea3fac4017dad8a50abd6cd3d74e28018e7ed884a687698abe9f7bb216f0d22dbfc59b8a8e4a99ba73b64e7945233d323fcd8f6e0b5fac0123bc7761d7d4d7c01a72945a28d09063683042e9ceb86d4593e53e69788b71eccf2dffea215d7150a15ef9a418cb7a87e361d562b9d72e8c77a7868ace3194b16cec145c2a51b69a40d80b98f6c873a26d8dc0550c756cdfb496ea8daf1a50e3d3b5f4178963f567a0b076bfd7a4e331c4481c55d47f3b7cc1da7cc69ec0b77e9f3eae2b28c56b56713c93018b20206d9a6f84ed2c189130ed743e7d1c7c08c20678fbcf960fa179700f67a720ae605af37dca146af291258b93844b2d4b27aa58029ea72f205f7d74e6bbb99573b7e9b5e0ccff83e04bb6125915710965de6323f878f0245d3ac1f38e896215bada00ff52ee9aa5a9ec551812dbe184330a5ee99abc8eb22b5e3adbd673534f4c13858be6cb481d9b83f3d877921b25f3f31c5506b1455604a4ef681c12dd0ab9d28581561981411bc2f654d11137ca8b2ab80d369c5ac0c4e96f4c38739f628feca81618d2c510eff23556cecc2b3557525a5dd9e67823c753097796b5c6fd9868054d8b9127b922acab2928df6135078b9d1df6d960ec43673b1c309a40eaa01ccb8b8126013a28d79942d7e5198e5f999561d3efb76dd930eee06aa22724991fa9f06a858483af040c78248b73146115be57bd083f0a6c3fc227245a710d216d2701227f7d9f8344ead32d62cc21c3990f564e413f70b267a42a0419cc4e4d221444e466bfbf5b637dff9027f1627d580ff67e1669d1563bb83ec9e106e83f9421358079723324f3cb0f4587243c2d177cc6034190f5e1e06e2384c7b9f5fe98fdc9b1da98937e06235e30a0c95474448124fd082072234972cbf06baf725435ae7e5bafd17dfdf7293ccb967eef1e9110648d7abaa9f8b00ca7eb18f50bc5caca8a90b3a520911ce6feb5f02e527f7537233d65b2853a834e0a22dcf82cbf9f7f0ee36983381adfeee2a2bb68727f6189b79fed5062e0c328615e60dbe1f1f207232228fc2cdab8f585cae84141757ce35ff4721ef87906b4ccfee463180792d9f66412ecbe45e901ac93eaf941c4affc65bf4d98430ad9c617662eedfc5231336eeb3b6d4811f3551858713638470f388d30a40ccf60c4d37d6737489fc2c84b7db092815c728bc75bc3151e521fe9ec23d437a8a282a268a1bb0f2ca7f416dd6d92f2d5814197f2c748f5c11fc451cce642b20ef5ce4009b1d792b6743e7533d40387bdda6e786195a7d1efd28ca32f392aea520ccc28c2ffb02ee5cb02a41cf72fd598462dec887439f63ee8fed21fc14be609b9c570750301830ae82505068d4cbeb6de5830d82f1b5a978357679ca59b3e2a48218a1c2756322de86f1777929a550e30552619e72d89a633444c4fd109aa5cc37fe4309c3b91e5e9b97aba6ef11c2b3195242fddac50197aa3a4b0d0dfd50f202581053236e4d5a96e802b7d9bb087c11aa41cae0c8fad4d95e7a3075e92994688f0d3bfba8f95cf47f10f9312c527bbc36d4d0808ea5ba9a571200885efacfd9c34a2eba644123fbf36fb1ea341d72bf77d7586147720f040f36d1bbec26397e8e5b1f6d105441e31e8a6a15d02615a593c4f99d9d8f533cc3e6bb1fa6d69140616b73b86aeca1f66ade8afa2ad2d870087380886d45b12e28f6a1048b0cb7a369c001d3bf3ec3d71fcabd1abe47987bff8dea5a3dad77f2cb62a03957d30da27dafcc88acadcebc905e5f8457cbc284f4ac6e7bdd5213c898f7c051d44fef6f051cdf50022856bfe0ed6e084becaedd066d2e69c69e4655ee0adf7d4b3a165c4e32e42aa948cd90a12a3943a630d1a000463a7fd9f67450ae847cb6aec23789443056b0ee861af4f9d1ad5304acf740f8e76aea80bc11b3c3b40f40521cda0b2883a3bec6c02634c8f77942b72ade2e6add146d6af85d6dfabacaa6c3b94d1f5bd94dba502738331746258572c1a758b4dfe0a68174d9b1d7a65d75569c1c21f3cb9a6c12268c80c17bc1c548bc9eb9fcd627a409500e9f952d1cce75b4fb0296938e317b38c4f29cffcfd031e420d02295349030d03b09"}, &(0x7f0000000200)=0xf84) 12:44:19 executing program 2: mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000000)='./file0\x00', 0x3, 0x0) 12:44:19 executing program 4: r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:44:19 executing program 1: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x73, 0x2) ioctl$BLKPBSZGET(r0, 0xc0185502, 0x0) 12:44:19 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x200, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000280)={0x53, 0xfffffffffffffffd, 0xdf, 0x9, @buffer={0x0, 0x9d, &(0x7f0000000040)=""/157}, &(0x7f0000000100)="76a396cfbb32c73989c8781a46f710e4ddea0f0f2251fde08fbb11247aa9a90b4a1d8778fc63a184a3add721baaa26436797dacd39b73fe3a0b1be5450aa1126c6d0e6e0646c61b1480c1636e1fd876c4db8c8e8dd3ebbc647ea59978c0f07ebc1dab28e8f4f4129acae177aaa02151f5fff23e40b9011ecc21f1a979057b39b00b29b3a666d52a4a814eca4e4ff09ff1527d728471f4c7d2c4630e4822ed190b2017bf61d4cce781b8765f49ea912436ecedaf10af89cb17c2b907982f2c61b22ce0ad84f312930dc576f5010366b994fe0f558970c5aabaf07f151e6da5e", &(0x7f0000000200)=""/26, 0x4, 0x5, 0xffffffffffffffff, &(0x7f0000000240)}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[@ANYBLOB="00000001000000000000000040", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000000001000000000000000000000048ba1dbce83ad52a"], 0x48}}, 0x0) 12:44:19 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0xe803}, 0x0) 12:44:19 executing program 1: syz_emit_ethernet(0x32, &(0x7f0000000000)={@local, @local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x200000000000011, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x1, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) [ 873.822628] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1793 sclass=netlink_route_socket pig=31088 comm=syz-executor.4 [ 873.841950] IPVS: ftp: loaded support on port[0] = 21 12:44:19 executing program 4: r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:44:19 executing program 1: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x73, 0x2) ioctl$BLKPBSZGET(r0, 0x8004550f, 0x0) [ 873.993768] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1793 sclass=netlink_route_socket pig=31098 comm=syz-executor.4 12:44:19 executing program 4: socket(0x10, 0x3, 0xc) write(0xffffffffffffffff, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:44:19 executing program 1: syz_mount_image$f2fs(&(0x7f0000000240)='f2fs\x00', &(0x7f0000000340)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f00000000c0)="1020f5f20100070009000000030073040c00000009", 0x15, 0x1400}], 0x0, 0x0) 12:44:19 executing program 4: socket(0x10, 0x3, 0xc) write(0xffffffffffffffff, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) [ 874.357127] IPVS: ftp: loaded support on port[0] = 21 12:44:20 executing program 0: ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'veth1_to_team\x00', 0x1}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x480600, 0x0) ioctl$BLKROSET(r0, 0x125d, &(0x7f00000000c0)=0x3) r1 = socket$inet_udp(0x2, 0x2, 0x0) munmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000) personality(0x4000c) ioctl$sock_inet_SIOCADDRT(r1, 0x890b, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_udp(0x2, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0, 0x0) unshare(0x60000000) syz_open_procfs(0xffffffffffffffff, &(0x7f00000004c0)='oom_score_adj\x00') r2 = syz_open_procfs(0x0, &(0x7f0000000480)='stat\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, r2, 0x0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f00000002c0)={0x0, @in6={{0xa, 0x4e23, 0xfffffffffffffff8, @dev={0xfe, 0x80, [], 0x16}, 0x4}}}, &(0x7f0000000000)=0x84) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000000500)={r3, 0xf7c, "bc295502309dd114c54818118da8c72429397212b68f2dc397a29d23bb5a6423685d13e672370c06ef56bd61c9a124dbc38cc49a59508a0547189f807a967616fe2e444e80bc2340cd63e52811905b78639429e59441c9ef1ab78d89b951c3768ebe9e2c917291f79ba0be0590aaae413268a49bc90c0ad249843be521bb1b494c20631ab6b353d6473c339ca1e8d411c2814127345abb2594e76db040f0fc07937154ffbaf176efeeb123a1a715d1192c10a51a971cb04ab1ed07527870e44675194f224ec809fce0f1611bb0b26e763190405a8071d169e17f46bbe684abbe9f0952ac2c4b2128693abbe67b71ceb7d00c2e27c4c320fc2861909af6d63e1ddfe51e375b006003bbadb18fa6c81ff6ea79239fb59774092a4c19a56d6e959d7905328f9511eaaa4179540099ce234283fa60439eea825c0c27efea3bdaac20b2e95796924bd8abfa01d78e9340255b0afbb0b782e51cd37cb34fdab727b43c6d63ac035f8e89a09875f7a3f6b232ad171adee9d51502242d9dd65e2400fa20bbbf61922a0cb8217d6d9196cc579b2d9c032d433523fd60c1c46bfc1d7501524b80a9e5c5ad2425ac34dfea0cd7d82e6cf2508af9dbca9343895cef5abc1e15add705486b4ebb6ee5b457163e5457a5b8b159c7efb0f092ea052c1a7f26b8a0707f045e553f58e343354c2070420cc2042abe8b494979cfadca4a8239eff0b65d57596fa373b9c1222bd46ed6976367aa5176ccadab2961d815f60086a2a0758ce8f2245f2b2384bc860d17044c9855f3a1fe0121bd8d7b7a57fc0de5710b684b544fa66fc8ce3500698122aca474cedafb8594b1c20c7f55fd59469933ace2845ffee15553fae11c94c5dd827f4cde76df7563928c5221433698b2fd5ad69b0b2a015020e21bf27bebff9f0048dcbdac805abae2b512ff391ced0c2d436d9a5ce151ad005963cbc3a7ec7c8d79ed65e674663e278e9c3edc39bd993bcf4e67ec0a1ee1fd8ad36533018fed9908fe507e5272cf55762105f3219979d25a9ea3c61bcb107a438638cf1ea2cd0353387b21b2a738b91064eccab0e58d106d49a034582a797cbf386781d06cf1980a081cc60371f08b53be6aaf2a7d4ddfbbded980fa73c594b7a709533930a7b3f418d105cd427295309504030242f39bb00a385e464d2b4c42e5f7b6363e777eb429dc74797b136a8fc5f796910477f9ebc154b4f833e09412c5c72d068d000fb929965ca8feb479c95c242e353a324c181cc6e3a86e0a747d37949b98373280219d59966c6ea03ba33f281a6ad63a79ac688ea60416ec06bb600c0011ab814c529e77960d98d3931c2ce07e1382a4a442b55ac89378c6cdb12f35b4d4dcb34b6e7d6581cbf4f4f6ffaf00030960b3ee9429b910dfe49ddb0d979e7284b766d06e883aa6f35f013377a448fc3a1bc04205a583fccb976de5dd361120aa9af264e89bb59284e2235447527cf1dec0c6adb61fb6f3cc4cdd3f47c1a31e0741bca13661968adac16375854a920f7f54afcd6c958951092b97b1ed13d8395022b336a7730f631dd19774c51292c200b877666e6a8733cee91e862351e8226b00db0f5d536ca52bc5e08cbe749edd230714a2af2eb57e4ecc5ee09c4e18ab3b4c3e7ee56d1067e2a98fc802f8b2eb97a51ca48c89e9ade613de6909d83f919c8d83deed7b438a2c98c7af123ab60a5a5744b4f83522d794efed278dfe497543f00523f0202b3a3ef60b521fd2736c4d86da0e220a8990831c15d612f22aec02a960fbcb51d5396b9ac652ed0dd1ba6091e4a93e08e41bf8a1605a974368efe9b6a839306b8cf8620abffb821c134ade43d6c2b24f88c0b165e0ae27ac867e80cb5acfab079e08669ba154604cb4c4b880141740d927b256eb3ba7fcbe19b0b24d570205e7b73bf942e4a816d9de891fdd33208047a7688d964e56ad2d93632ef251826e8b318aa5bf7571448d0112a0b8df96ed36d46619f1599834c8c7d70dcbbb08bb813382c1c1628f76a0511bed2fe7ef891dcc56b40df6d2aef9aee82a0e24d1cd68fe6228f97d6e2e006fd09513866fa0412f3cbd0c2dda75da67bd975a66fddd8f91cad64968b784b22c7eaf753d1d40b604d4a8496b888ab36d0ba37f06fbac7ba1f5ff2357b8153a0c95c23c220d645af8da5058a082b2fa0ee265e1de3747b69ff2b4cc357d8778c17b728d5aeaef8b331f7028d7702bb8d0e727928f443f18d153b5a55bdf5d28af90de33baeef865187dec0376aeebffbf397b1e50829f7a801b12571eb34b44ba53cc728f5da788e482d36627c2df27fa892312411cbb36d92b4ab0eb95a9291e7223f4a007a2257ffdd683ffbc33e7ab08545d5a16f784c1ae277d66dfe2c6d7462cbc98279e44d33dae59724fa34fdaa13ea0658f629880e9284c82bce540bbafa1a175933b559ccc4c4780a1c01623dad17023e3c20de75b019e98eb4e13b78bc4acfd162b930ee097342904059c5d68caeef4228b501ee67e38116d803c9f04b0c023928595288709dd8c609055cca822451b1088a8e424731807b3bd6904683aaa96d66d6a8d34e1a2f3c27bd0ed056c77b14b0b1ac572167c7bf6439e241e6d02a0b14fc9a95570ca7c6ed28714b1393e2f8540ce9e8318b35564bcbcb91fcb60c88e8b849678bc72b1b6f6b334a40a74abc0c83381478c9362aadef272d8cdfad4f46c44f68b912a5e124130a79e3d7dc44b0f402de59977d76008e8ac648968749af01f3617996324629dfb778a9383bf9d0f5580cc7f9301892981d8fa7f71c0e5d70a000e8076a22fe979a4eaa1f224e41e6ddf418bc1b8c52ec129c493b00711199673014c5b37ccb315ebc55680b4b9975f15cfa1f9c3a0a557b84b97b2de7d4057a7d3f4740bbf672f24c913d591f1fb83f75181864bbb61002662bca8b5bc52b8e4a231a0f27c8e24269cc3a1a87366ff35647d495a7775a74e9d7aa994f1020fef6ebb810406aab0aac79d74fd4c2cf0bea879c78292a9de1cd6ee5c4b94df39a8efdcb835075eca9f1f00a99810442a764a44f1ef392eb82ea631645f9b4cfc53f17064038d62afd9996a5c3e140c3e97ab30ec0abc3af1c086d2f86cbcb127be19e81026c35fc7212782d9ea1415703a486fb8166fa6584f43fc23e16726f4d85432a755e1b1240bfc0cc08e7c1bb0364bbe6b0b4c5908ebc7de41fac6099e6bb6c58b7decaddaca7d22eec7ff95db459b7eb33a19938b5c1782efa853fe6a9dc329144966ef80f9f6ebfd424015c040cf1f7631f00023dfc66b8868cc469750439802270bd285daf7d2df8b77c93a13e541c98c408f46b0eb48c1b7d30674dfcc99a74e6014d20f198b6fcb204120f66da7cdef854249b55b87c10783e15577c886062813e775863e1c0a6dd43cc45d1b07e36cf2716333d9ca967f067ad25e58ec38b46a091cbd9b1de2b06bb5116e696eec5a462c87cd479b0b0e8dddb5930776ac5bdc444ea3fac4017dad8a50abd6cd3d74e28018e7ed884a687698abe9f7bb216f0d22dbfc59b8a8e4a99ba73b64e7945233d323fcd8f6e0b5fac0123bc7761d7d4d7c01a72945a28d09063683042e9ceb86d4593e53e69788b71eccf2dffea215d7150a15ef9a418cb7a87e361d562b9d72e8c77a7868ace3194b16cec145c2a51b69a40d80b98f6c873a26d8dc0550c756cdfb496ea8daf1a50e3d3b5f4178963f567a0b076bfd7a4e331c4481c55d47f3b7cc1da7cc69ec0b77e9f3eae2b28c56b56713c93018b20206d9a6f84ed2c189130ed743e7d1c7c08c20678fbcf960fa179700f67a720ae605af37dca146af291258b93844b2d4b27aa58029ea72f205f7d74e6bbb99573b7e9b5e0ccff83e04bb6125915710965de6323f878f0245d3ac1f38e896215bada00ff52ee9aa5a9ec551812dbe184330a5ee99abc8eb22b5e3adbd673534f4c13858be6cb481d9b83f3d877921b25f3f31c5506b1455604a4ef681c12dd0ab9d28581561981411bc2f654d11137ca8b2ab80d369c5ac0c4e96f4c38739f628feca81618d2c510eff23556cecc2b3557525a5dd9e67823c753097796b5c6fd9868054d8b9127b922acab2928df6135078b9d1df6d960ec43673b1c309a40eaa01ccb8b8126013a28d79942d7e5198e5f999561d3efb76dd930eee06aa22724991fa9f06a858483af040c78248b73146115be57bd083f0a6c3fc227245a710d216d2701227f7d9f8344ead32d62cc21c3990f564e413f70b267a42a0419cc4e4d221444e466bfbf5b637dff9027f1627d580ff67e1669d1563bb83ec9e106e83f9421358079723324f3cb0f4587243c2d177cc6034190f5e1e06e2384c7b9f5fe98fdc9b1da98937e06235e30a0c95474448124fd082072234972cbf06baf725435ae7e5bafd17dfdf7293ccb967eef1e9110648d7abaa9f8b00ca7eb18f50bc5caca8a90b3a520911ce6feb5f02e527f7537233d65b2853a834e0a22dcf82cbf9f7f0ee36983381adfeee2a2bb68727f6189b79fed5062e0c328615e60dbe1f1f207232228fc2cdab8f585cae84141757ce35ff4721ef87906b4ccfee463180792d9f66412ecbe45e901ac93eaf941c4affc65bf4d98430ad9c617662eedfc5231336eeb3b6d4811f3551858713638470f388d30a40ccf60c4d37d6737489fc2c84b7db092815c728bc75bc3151e521fe9ec23d437a8a282a268a1bb0f2ca7f416dd6d92f2d5814197f2c748f5c11fc451cce642b20ef5ce4009b1d792b6743e7533d40387bdda6e786195a7d1efd28ca32f392aea520ccc28c2ffb02ee5cb02a41cf72fd598462dec887439f63ee8fed21fc14be609b9c570750301830ae82505068d4cbeb6de5830d82f1b5a978357679ca59b3e2a48218a1c2756322de86f1777929a550e30552619e72d89a633444c4fd109aa5cc37fe4309c3b91e5e9b97aba6ef11c2b3195242fddac50197aa3a4b0d0dfd50f202581053236e4d5a96e802b7d9bb087c11aa41cae0c8fad4d95e7a3075e92994688f0d3bfba8f95cf47f10f9312c527bbc36d4d0808ea5ba9a571200885efacfd9c34a2eba644123fbf36fb1ea341d72bf77d7586147720f040f36d1bbec26397e8e5b1f6d105441e31e8a6a15d02615a593c4f99d9d8f533cc3e6bb1fa6d69140616b73b86aeca1f66ade8afa2ad2d870087380886d45b12e28f6a1048b0cb7a369c001d3bf3ec3d71fcabd1abe47987bff8dea5a3dad77f2cb62a03957d30da27dafcc88acadcebc905e5f8457cbc284f4ac6e7bdd5213c898f7c051d44fef6f051cdf50022856bfe0ed6e084becaedd066d2e69c69e4655ee0adf7d4b3a165c4e32e42aa948cd90a12a3943a630d1a000463a7fd9f67450ae847cb6aec23789443056b0ee861af4f9d1ad5304acf740f8e76aea80bc11b3c3b40f40521cda0b2883a3bec6c02634c8f77942b72ade2e6add146d6af85d6dfabacaa6c3b94d1f5bd94dba502738331746258572c1a758b4dfe0a68174d9b1d7a65d75569c1c21f3cb9a6c12268c80c17bc1c548bc9eb9fcd627a409500e9f952d1cce75b4fb0296938e317b38c4f29cffcfd031e420d02295349030d03b09"}, &(0x7f0000000200)=0xf84) 12:44:20 executing program 2: unshare(0x20040600) r0 = socket$vsock_stream(0x28, 0x1, 0x0) fcntl$setstatus(r0, 0x4, 0x2402) 12:44:20 executing program 1: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x73, 0x2) ioctl$BLKPBSZGET(r0, 0x4004550c, 0x0) 12:44:20 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) r2 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r3 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x2007fff) r4 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r4, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000004b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) dup3(r3, r2, 0x0) io_setup(0x8, &(0x7f0000000240)=0x0) io_submit(r5, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r2, &(0x7f0000000000), 0x200a00}]) getsockname(r0, &(0x7f00000000c0)=@in={0x2, 0x0, @multicast1}, &(0x7f0000000140)=0x80) fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f0000000200)) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x1, 0x43, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) r6 = syz_open_dev$audion(&(0x7f00000002c0)='/dev/audio#\x00', 0x1, 0x200000) getpeername$netlink(r6, &(0x7f0000000040), &(0x7f0000000080)=0xc) splice(r0, &(0x7f0000000180), r6, &(0x7f00000001c0), 0x3e, 0x4) 12:44:20 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0xf401}, 0x0) 12:44:20 executing program 4: socket(0x10, 0x3, 0xc) write(0xffffffffffffffff, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:44:20 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, 0x0, 0x0) 12:44:20 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xe) ioctl$FS_IOC_GETFSMAP(r0, 0x5437, 0x0) [ 874.648437] IPVS: ftp: loaded support on port[0] = 21 12:44:20 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, 0x0, 0x0) 12:44:20 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, 0x0, 0x0) 12:44:20 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000400)='attr/keycreate\x00') write$apparmor_current(r1, 0x0, 0x0) 12:44:20 executing program 2: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setpriority(0x2, 0x0, 0x0) 12:44:20 executing program 0: ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'veth1_to_team\x00', 0x1}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x480600, 0x0) ioctl$BLKROSET(r0, 0x125d, &(0x7f00000000c0)=0x3) r1 = socket$inet_udp(0x2, 0x2, 0x0) munmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000) personality(0x4000c) ioctl$sock_inet_SIOCADDRT(r1, 0x890b, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_udp(0x2, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0, 0x0) unshare(0x60000000) syz_open_procfs(0xffffffffffffffff, &(0x7f00000004c0)='oom_score_adj\x00') r2 = syz_open_procfs(0x0, &(0x7f0000000480)='stat\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, r2, 0x0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f00000002c0)={0x0, @in6={{0xa, 0x4e23, 0xfffffffffffffff8, @dev={0xfe, 0x80, [], 0x16}, 0x4}}}, &(0x7f0000000000)=0x84) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000000500)={r3, 0xf7c, "bc295502309dd114c54818118da8c72429397212b68f2dc397a29d23bb5a6423685d13e672370c06ef56bd61c9a124dbc38cc49a59508a0547189f807a967616fe2e444e80bc2340cd63e52811905b78639429e59441c9ef1ab78d89b951c3768ebe9e2c917291f79ba0be0590aaae413268a49bc90c0ad249843be521bb1b494c20631ab6b353d6473c339ca1e8d411c2814127345abb2594e76db040f0fc07937154ffbaf176efeeb123a1a715d1192c10a51a971cb04ab1ed07527870e44675194f224ec809fce0f1611bb0b26e763190405a8071d169e17f46bbe684abbe9f0952ac2c4b2128693abbe67b71ceb7d00c2e27c4c320fc2861909af6d63e1ddfe51e375b006003bbadb18fa6c81ff6ea79239fb59774092a4c19a56d6e959d7905328f9511eaaa4179540099ce234283fa60439eea825c0c27efea3bdaac20b2e95796924bd8abfa01d78e9340255b0afbb0b782e51cd37cb34fdab727b43c6d63ac035f8e89a09875f7a3f6b232ad171adee9d51502242d9dd65e2400fa20bbbf61922a0cb8217d6d9196cc579b2d9c032d433523fd60c1c46bfc1d7501524b80a9e5c5ad2425ac34dfea0cd7d82e6cf2508af9dbca9343895cef5abc1e15add705486b4ebb6ee5b457163e5457a5b8b159c7efb0f092ea052c1a7f26b8a0707f045e553f58e343354c2070420cc2042abe8b494979cfadca4a8239eff0b65d57596fa373b9c1222bd46ed6976367aa5176ccadab2961d815f60086a2a0758ce8f2245f2b2384bc860d17044c9855f3a1fe0121bd8d7b7a57fc0de5710b684b544fa66fc8ce3500698122aca474cedafb8594b1c20c7f55fd59469933ace2845ffee15553fae11c94c5dd827f4cde76df7563928c5221433698b2fd5ad69b0b2a015020e21bf27bebff9f0048dcbdac805abae2b512ff391ced0c2d436d9a5ce151ad005963cbc3a7ec7c8d79ed65e674663e278e9c3edc39bd993bcf4e67ec0a1ee1fd8ad36533018fed9908fe507e5272cf55762105f3219979d25a9ea3c61bcb107a438638cf1ea2cd0353387b21b2a738b91064eccab0e58d106d49a034582a797cbf386781d06cf1980a081cc60371f08b53be6aaf2a7d4ddfbbded980fa73c594b7a709533930a7b3f418d105cd427295309504030242f39bb00a385e464d2b4c42e5f7b6363e777eb429dc74797b136a8fc5f796910477f9ebc154b4f833e09412c5c72d068d000fb929965ca8feb479c95c242e353a324c181cc6e3a86e0a747d37949b98373280219d59966c6ea03ba33f281a6ad63a79ac688ea60416ec06bb600c0011ab814c529e77960d98d3931c2ce07e1382a4a442b55ac89378c6cdb12f35b4d4dcb34b6e7d6581cbf4f4f6ffaf00030960b3ee9429b910dfe49ddb0d979e7284b766d06e883aa6f35f013377a448fc3a1bc04205a583fccb976de5dd361120aa9af264e89bb59284e2235447527cf1dec0c6adb61fb6f3cc4cdd3f47c1a31e0741bca13661968adac16375854a920f7f54afcd6c958951092b97b1ed13d8395022b336a7730f631dd19774c51292c200b877666e6a8733cee91e862351e8226b00db0f5d536ca52bc5e08cbe749edd230714a2af2eb57e4ecc5ee09c4e18ab3b4c3e7ee56d1067e2a98fc802f8b2eb97a51ca48c89e9ade613de6909d83f919c8d83deed7b438a2c98c7af123ab60a5a5744b4f83522d794efed278dfe497543f00523f0202b3a3ef60b521fd2736c4d86da0e220a8990831c15d612f22aec02a960fbcb51d5396b9ac652ed0dd1ba6091e4a93e08e41bf8a1605a974368efe9b6a839306b8cf8620abffb821c134ade43d6c2b24f88c0b165e0ae27ac867e80cb5acfab079e08669ba154604cb4c4b880141740d927b256eb3ba7fcbe19b0b24d570205e7b73bf942e4a816d9de891fdd33208047a7688d964e56ad2d93632ef251826e8b318aa5bf7571448d0112a0b8df96ed36d46619f1599834c8c7d70dcbbb08bb813382c1c1628f76a0511bed2fe7ef891dcc56b40df6d2aef9aee82a0e24d1cd68fe6228f97d6e2e006fd09513866fa0412f3cbd0c2dda75da67bd975a66fddd8f91cad64968b784b22c7eaf753d1d40b604d4a8496b888ab36d0ba37f06fbac7ba1f5ff2357b8153a0c95c23c220d645af8da5058a082b2fa0ee265e1de3747b69ff2b4cc357d8778c17b728d5aeaef8b331f7028d7702bb8d0e727928f443f18d153b5a55bdf5d28af90de33baeef865187dec0376aeebffbf397b1e50829f7a801b12571eb34b44ba53cc728f5da788e482d36627c2df27fa892312411cbb36d92b4ab0eb95a9291e7223f4a007a2257ffdd683ffbc33e7ab08545d5a16f784c1ae277d66dfe2c6d7462cbc98279e44d33dae59724fa34fdaa13ea0658f629880e9284c82bce540bbafa1a175933b559ccc4c4780a1c01623dad17023e3c20de75b019e98eb4e13b78bc4acfd162b930ee097342904059c5d68caeef4228b501ee67e38116d803c9f04b0c023928595288709dd8c609055cca822451b1088a8e424731807b3bd6904683aaa96d66d6a8d34e1a2f3c27bd0ed056c77b14b0b1ac572167c7bf6439e241e6d02a0b14fc9a95570ca7c6ed28714b1393e2f8540ce9e8318b35564bcbcb91fcb60c88e8b849678bc72b1b6f6b334a40a74abc0c83381478c9362aadef272d8cdfad4f46c44f68b912a5e124130a79e3d7dc44b0f402de59977d76008e8ac648968749af01f3617996324629dfb778a9383bf9d0f5580cc7f9301892981d8fa7f71c0e5d70a000e8076a22fe979a4eaa1f224e41e6ddf418bc1b8c52ec129c493b00711199673014c5b37ccb315ebc55680b4b9975f15cfa1f9c3a0a557b84b97b2de7d4057a7d3f4740bbf672f24c913d591f1fb83f75181864bbb61002662bca8b5bc52b8e4a231a0f27c8e24269cc3a1a87366ff35647d495a7775a74e9d7aa994f1020fef6ebb810406aab0aac79d74fd4c2cf0bea879c78292a9de1cd6ee5c4b94df39a8efdcb835075eca9f1f00a99810442a764a44f1ef392eb82ea631645f9b4cfc53f17064038d62afd9996a5c3e140c3e97ab30ec0abc3af1c086d2f86cbcb127be19e81026c35fc7212782d9ea1415703a486fb8166fa6584f43fc23e16726f4d85432a755e1b1240bfc0cc08e7c1bb0364bbe6b0b4c5908ebc7de41fac6099e6bb6c58b7decaddaca7d22eec7ff95db459b7eb33a19938b5c1782efa853fe6a9dc329144966ef80f9f6ebfd424015c040cf1f7631f00023dfc66b8868cc469750439802270bd285daf7d2df8b77c93a13e541c98c408f46b0eb48c1b7d30674dfcc99a74e6014d20f198b6fcb204120f66da7cdef854249b55b87c10783e15577c886062813e775863e1c0a6dd43cc45d1b07e36cf2716333d9ca967f067ad25e58ec38b46a091cbd9b1de2b06bb5116e696eec5a462c87cd479b0b0e8dddb5930776ac5bdc444ea3fac4017dad8a50abd6cd3d74e28018e7ed884a687698abe9f7bb216f0d22dbfc59b8a8e4a99ba73b64e7945233d323fcd8f6e0b5fac0123bc7761d7d4d7c01a72945a28d09063683042e9ceb86d4593e53e69788b71eccf2dffea215d7150a15ef9a418cb7a87e361d562b9d72e8c77a7868ace3194b16cec145c2a51b69a40d80b98f6c873a26d8dc0550c756cdfb496ea8daf1a50e3d3b5f4178963f567a0b076bfd7a4e331c4481c55d47f3b7cc1da7cc69ec0b77e9f3eae2b28c56b56713c93018b20206d9a6f84ed2c189130ed743e7d1c7c08c20678fbcf960fa179700f67a720ae605af37dca146af291258b93844b2d4b27aa58029ea72f205f7d74e6bbb99573b7e9b5e0ccff83e04bb6125915710965de6323f878f0245d3ac1f38e896215bada00ff52ee9aa5a9ec551812dbe184330a5ee99abc8eb22b5e3adbd673534f4c13858be6cb481d9b83f3d877921b25f3f31c5506b1455604a4ef681c12dd0ab9d28581561981411bc2f654d11137ca8b2ab80d369c5ac0c4e96f4c38739f628feca81618d2c510eff23556cecc2b3557525a5dd9e67823c753097796b5c6fd9868054d8b9127b922acab2928df6135078b9d1df6d960ec43673b1c309a40eaa01ccb8b8126013a28d79942d7e5198e5f999561d3efb76dd930eee06aa22724991fa9f06a858483af040c78248b73146115be57bd083f0a6c3fc227245a710d216d2701227f7d9f8344ead32d62cc21c3990f564e413f70b267a42a0419cc4e4d221444e466bfbf5b637dff9027f1627d580ff67e1669d1563bb83ec9e106e83f9421358079723324f3cb0f4587243c2d177cc6034190f5e1e06e2384c7b9f5fe98fdc9b1da98937e06235e30a0c95474448124fd082072234972cbf06baf725435ae7e5bafd17dfdf7293ccb967eef1e9110648d7abaa9f8b00ca7eb18f50bc5caca8a90b3a520911ce6feb5f02e527f7537233d65b2853a834e0a22dcf82cbf9f7f0ee36983381adfeee2a2bb68727f6189b79fed5062e0c328615e60dbe1f1f207232228fc2cdab8f585cae84141757ce35ff4721ef87906b4ccfee463180792d9f66412ecbe45e901ac93eaf941c4affc65bf4d98430ad9c617662eedfc5231336eeb3b6d4811f3551858713638470f388d30a40ccf60c4d37d6737489fc2c84b7db092815c728bc75bc3151e521fe9ec23d437a8a282a268a1bb0f2ca7f416dd6d92f2d5814197f2c748f5c11fc451cce642b20ef5ce4009b1d792b6743e7533d40387bdda6e786195a7d1efd28ca32f392aea520ccc28c2ffb02ee5cb02a41cf72fd598462dec887439f63ee8fed21fc14be609b9c570750301830ae82505068d4cbeb6de5830d82f1b5a978357679ca59b3e2a48218a1c2756322de86f1777929a550e30552619e72d89a633444c4fd109aa5cc37fe4309c3b91e5e9b97aba6ef11c2b3195242fddac50197aa3a4b0d0dfd50f202581053236e4d5a96e802b7d9bb087c11aa41cae0c8fad4d95e7a3075e92994688f0d3bfba8f95cf47f10f9312c527bbc36d4d0808ea5ba9a571200885efacfd9c34a2eba644123fbf36fb1ea341d72bf77d7586147720f040f36d1bbec26397e8e5b1f6d105441e31e8a6a15d02615a593c4f99d9d8f533cc3e6bb1fa6d69140616b73b86aeca1f66ade8afa2ad2d870087380886d45b12e28f6a1048b0cb7a369c001d3bf3ec3d71fcabd1abe47987bff8dea5a3dad77f2cb62a03957d30da27dafcc88acadcebc905e5f8457cbc284f4ac6e7bdd5213c898f7c051d44fef6f051cdf50022856bfe0ed6e084becaedd066d2e69c69e4655ee0adf7d4b3a165c4e32e42aa948cd90a12a3943a630d1a000463a7fd9f67450ae847cb6aec23789443056b0ee861af4f9d1ad5304acf740f8e76aea80bc11b3c3b40f40521cda0b2883a3bec6c02634c8f77942b72ade2e6add146d6af85d6dfabacaa6c3b94d1f5bd94dba502738331746258572c1a758b4dfe0a68174d9b1d7a65d75569c1c21f3cb9a6c12268c80c17bc1c548bc9eb9fcd627a409500e9f952d1cce75b4fb0296938e317b38c4f29cffcfd031e420d02295349030d03b09"}, &(0x7f0000000200)=0xf84) 12:44:20 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100), 0x0) 12:44:21 executing program 1: 12:44:24 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100), 0x0) 12:44:24 executing program 2: 12:44:24 executing program 1: 12:44:24 executing program 0: ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'veth1_to_team\x00', 0x1}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x480600, 0x0) ioctl$BLKROSET(r0, 0x125d, &(0x7f00000000c0)=0x3) r1 = socket$inet_udp(0x2, 0x2, 0x0) munmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000) personality(0x4000c) ioctl$sock_inet_SIOCADDRT(r1, 0x890b, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_udp(0x2, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0, 0x0) unshare(0x60000000) syz_open_procfs(0xffffffffffffffff, &(0x7f00000004c0)='oom_score_adj\x00') r2 = syz_open_procfs(0x0, &(0x7f0000000480)='stat\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, r2, 0x0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f00000002c0)={0x0, @in6={{0xa, 0x4e23, 0xfffffffffffffff8, @dev={0xfe, 0x80, [], 0x16}, 0x4}}}, &(0x7f0000000000)=0x84) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000000500)={r3, 0xf7c, "bc295502309dd114c54818118da8c72429397212b68f2dc397a29d23bb5a6423685d13e672370c06ef56bd61c9a124dbc38cc49a59508a0547189f807a967616fe2e444e80bc2340cd63e52811905b78639429e59441c9ef1ab78d89b951c3768ebe9e2c917291f79ba0be0590aaae413268a49bc90c0ad249843be521bb1b494c20631ab6b353d6473c339ca1e8d411c2814127345abb2594e76db040f0fc07937154ffbaf176efeeb123a1a715d1192c10a51a971cb04ab1ed07527870e44675194f224ec809fce0f1611bb0b26e763190405a8071d169e17f46bbe684abbe9f0952ac2c4b2128693abbe67b71ceb7d00c2e27c4c320fc2861909af6d63e1ddfe51e375b006003bbadb18fa6c81ff6ea79239fb59774092a4c19a56d6e959d7905328f9511eaaa4179540099ce234283fa60439eea825c0c27efea3bdaac20b2e95796924bd8abfa01d78e9340255b0afbb0b782e51cd37cb34fdab727b43c6d63ac035f8e89a09875f7a3f6b232ad171adee9d51502242d9dd65e2400fa20bbbf61922a0cb8217d6d9196cc579b2d9c032d433523fd60c1c46bfc1d7501524b80a9e5c5ad2425ac34dfea0cd7d82e6cf2508af9dbca9343895cef5abc1e15add705486b4ebb6ee5b457163e5457a5b8b159c7efb0f092ea052c1a7f26b8a0707f045e553f58e343354c2070420cc2042abe8b494979cfadca4a8239eff0b65d57596fa373b9c1222bd46ed6976367aa5176ccadab2961d815f60086a2a0758ce8f2245f2b2384bc860d17044c9855f3a1fe0121bd8d7b7a57fc0de5710b684b544fa66fc8ce3500698122aca474cedafb8594b1c20c7f55fd59469933ace2845ffee15553fae11c94c5dd827f4cde76df7563928c5221433698b2fd5ad69b0b2a015020e21bf27bebff9f0048dcbdac805abae2b512ff391ced0c2d436d9a5ce151ad005963cbc3a7ec7c8d79ed65e674663e278e9c3edc39bd993bcf4e67ec0a1ee1fd8ad36533018fed9908fe507e5272cf55762105f3219979d25a9ea3c61bcb107a438638cf1ea2cd0353387b21b2a738b91064eccab0e58d106d49a034582a797cbf386781d06cf1980a081cc60371f08b53be6aaf2a7d4ddfbbded980fa73c594b7a709533930a7b3f418d105cd427295309504030242f39bb00a385e464d2b4c42e5f7b6363e777eb429dc74797b136a8fc5f796910477f9ebc154b4f833e09412c5c72d068d000fb929965ca8feb479c95c242e353a324c181cc6e3a86e0a747d37949b98373280219d59966c6ea03ba33f281a6ad63a79ac688ea60416ec06bb600c0011ab814c529e77960d98d3931c2ce07e1382a4a442b55ac89378c6cdb12f35b4d4dcb34b6e7d6581cbf4f4f6ffaf00030960b3ee9429b910dfe49ddb0d979e7284b766d06e883aa6f35f013377a448fc3a1bc04205a583fccb976de5dd361120aa9af264e89bb59284e2235447527cf1dec0c6adb61fb6f3cc4cdd3f47c1a31e0741bca13661968adac16375854a920f7f54afcd6c958951092b97b1ed13d8395022b336a7730f631dd19774c51292c200b877666e6a8733cee91e862351e8226b00db0f5d536ca52bc5e08cbe749edd230714a2af2eb57e4ecc5ee09c4e18ab3b4c3e7ee56d1067e2a98fc802f8b2eb97a51ca48c89e9ade613de6909d83f919c8d83deed7b438a2c98c7af123ab60a5a5744b4f83522d794efed278dfe497543f00523f0202b3a3ef60b521fd2736c4d86da0e220a8990831c15d612f22aec02a960fbcb51d5396b9ac652ed0dd1ba6091e4a93e08e41bf8a1605a974368efe9b6a839306b8cf8620abffb821c134ade43d6c2b24f88c0b165e0ae27ac867e80cb5acfab079e08669ba154604cb4c4b880141740d927b256eb3ba7fcbe19b0b24d570205e7b73bf942e4a816d9de891fdd33208047a7688d964e56ad2d93632ef251826e8b318aa5bf7571448d0112a0b8df96ed36d46619f1599834c8c7d70dcbbb08bb813382c1c1628f76a0511bed2fe7ef891dcc56b40df6d2aef9aee82a0e24d1cd68fe6228f97d6e2e006fd09513866fa0412f3cbd0c2dda75da67bd975a66fddd8f91cad64968b784b22c7eaf753d1d40b604d4a8496b888ab36d0ba37f06fbac7ba1f5ff2357b8153a0c95c23c220d645af8da5058a082b2fa0ee265e1de3747b69ff2b4cc357d8778c17b728d5aeaef8b331f7028d7702bb8d0e727928f443f18d153b5a55bdf5d28af90de33baeef865187dec0376aeebffbf397b1e50829f7a801b12571eb34b44ba53cc728f5da788e482d36627c2df27fa892312411cbb36d92b4ab0eb95a9291e7223f4a007a2257ffdd683ffbc33e7ab08545d5a16f784c1ae277d66dfe2c6d7462cbc98279e44d33dae59724fa34fdaa13ea0658f629880e9284c82bce540bbafa1a175933b559ccc4c4780a1c01623dad17023e3c20de75b019e98eb4e13b78bc4acfd162b930ee097342904059c5d68caeef4228b501ee67e38116d803c9f04b0c023928595288709dd8c609055cca822451b1088a8e424731807b3bd6904683aaa96d66d6a8d34e1a2f3c27bd0ed056c77b14b0b1ac572167c7bf6439e241e6d02a0b14fc9a95570ca7c6ed28714b1393e2f8540ce9e8318b35564bcbcb91fcb60c88e8b849678bc72b1b6f6b334a40a74abc0c83381478c9362aadef272d8cdfad4f46c44f68b912a5e124130a79e3d7dc44b0f402de59977d76008e8ac648968749af01f3617996324629dfb778a9383bf9d0f5580cc7f9301892981d8fa7f71c0e5d70a000e8076a22fe979a4eaa1f224e41e6ddf418bc1b8c52ec129c493b00711199673014c5b37ccb315ebc55680b4b9975f15cfa1f9c3a0a557b84b97b2de7d4057a7d3f4740bbf672f24c913d591f1fb83f75181864bbb61002662bca8b5bc52b8e4a231a0f27c8e24269cc3a1a87366ff35647d495a7775a74e9d7aa994f1020fef6ebb810406aab0aac79d74fd4c2cf0bea879c78292a9de1cd6ee5c4b94df39a8efdcb835075eca9f1f00a99810442a764a44f1ef392eb82ea631645f9b4cfc53f17064038d62afd9996a5c3e140c3e97ab30ec0abc3af1c086d2f86cbcb127be19e81026c35fc7212782d9ea1415703a486fb8166fa6584f43fc23e16726f4d85432a755e1b1240bfc0cc08e7c1bb0364bbe6b0b4c5908ebc7de41fac6099e6bb6c58b7decaddaca7d22eec7ff95db459b7eb33a19938b5c1782efa853fe6a9dc329144966ef80f9f6ebfd424015c040cf1f7631f00023dfc66b8868cc469750439802270bd285daf7d2df8b77c93a13e541c98c408f46b0eb48c1b7d30674dfcc99a74e6014d20f198b6fcb204120f66da7cdef854249b55b87c10783e15577c886062813e775863e1c0a6dd43cc45d1b07e36cf2716333d9ca967f067ad25e58ec38b46a091cbd9b1de2b06bb5116e696eec5a462c87cd479b0b0e8dddb5930776ac5bdc444ea3fac4017dad8a50abd6cd3d74e28018e7ed884a687698abe9f7bb216f0d22dbfc59b8a8e4a99ba73b64e7945233d323fcd8f6e0b5fac0123bc7761d7d4d7c01a72945a28d09063683042e9ceb86d4593e53e69788b71eccf2dffea215d7150a15ef9a418cb7a87e361d562b9d72e8c77a7868ace3194b16cec145c2a51b69a40d80b98f6c873a26d8dc0550c756cdfb496ea8daf1a50e3d3b5f4178963f567a0b076bfd7a4e331c4481c55d47f3b7cc1da7cc69ec0b77e9f3eae2b28c56b56713c93018b20206d9a6f84ed2c189130ed743e7d1c7c08c20678fbcf960fa179700f67a720ae605af37dca146af291258b93844b2d4b27aa58029ea72f205f7d74e6bbb99573b7e9b5e0ccff83e04bb6125915710965de6323f878f0245d3ac1f38e896215bada00ff52ee9aa5a9ec551812dbe184330a5ee99abc8eb22b5e3adbd673534f4c13858be6cb481d9b83f3d877921b25f3f31c5506b1455604a4ef681c12dd0ab9d28581561981411bc2f654d11137ca8b2ab80d369c5ac0c4e96f4c38739f628feca81618d2c510eff23556cecc2b3557525a5dd9e67823c753097796b5c6fd9868054d8b9127b922acab2928df6135078b9d1df6d960ec43673b1c309a40eaa01ccb8b8126013a28d79942d7e5198e5f999561d3efb76dd930eee06aa22724991fa9f06a858483af040c78248b73146115be57bd083f0a6c3fc227245a710d216d2701227f7d9f8344ead32d62cc21c3990f564e413f70b267a42a0419cc4e4d221444e466bfbf5b637dff9027f1627d580ff67e1669d1563bb83ec9e106e83f9421358079723324f3cb0f4587243c2d177cc6034190f5e1e06e2384c7b9f5fe98fdc9b1da98937e06235e30a0c95474448124fd082072234972cbf06baf725435ae7e5bafd17dfdf7293ccb967eef1e9110648d7abaa9f8b00ca7eb18f50bc5caca8a90b3a520911ce6feb5f02e527f7537233d65b2853a834e0a22dcf82cbf9f7f0ee36983381adfeee2a2bb68727f6189b79fed5062e0c328615e60dbe1f1f207232228fc2cdab8f585cae84141757ce35ff4721ef87906b4ccfee463180792d9f66412ecbe45e901ac93eaf941c4affc65bf4d98430ad9c617662eedfc5231336eeb3b6d4811f3551858713638470f388d30a40ccf60c4d37d6737489fc2c84b7db092815c728bc75bc3151e521fe9ec23d437a8a282a268a1bb0f2ca7f416dd6d92f2d5814197f2c748f5c11fc451cce642b20ef5ce4009b1d792b6743e7533d40387bdda6e786195a7d1efd28ca32f392aea520ccc28c2ffb02ee5cb02a41cf72fd598462dec887439f63ee8fed21fc14be609b9c570750301830ae82505068d4cbeb6de5830d82f1b5a978357679ca59b3e2a48218a1c2756322de86f1777929a550e30552619e72d89a633444c4fd109aa5cc37fe4309c3b91e5e9b97aba6ef11c2b3195242fddac50197aa3a4b0d0dfd50f202581053236e4d5a96e802b7d9bb087c11aa41cae0c8fad4d95e7a3075e92994688f0d3bfba8f95cf47f10f9312c527bbc36d4d0808ea5ba9a571200885efacfd9c34a2eba644123fbf36fb1ea341d72bf77d7586147720f040f36d1bbec26397e8e5b1f6d105441e31e8a6a15d02615a593c4f99d9d8f533cc3e6bb1fa6d69140616b73b86aeca1f66ade8afa2ad2d870087380886d45b12e28f6a1048b0cb7a369c001d3bf3ec3d71fcabd1abe47987bff8dea5a3dad77f2cb62a03957d30da27dafcc88acadcebc905e5f8457cbc284f4ac6e7bdd5213c898f7c051d44fef6f051cdf50022856bfe0ed6e084becaedd066d2e69c69e4655ee0adf7d4b3a165c4e32e42aa948cd90a12a3943a630d1a000463a7fd9f67450ae847cb6aec23789443056b0ee861af4f9d1ad5304acf740f8e76aea80bc11b3c3b40f40521cda0b2883a3bec6c02634c8f77942b72ade2e6add146d6af85d6dfabacaa6c3b94d1f5bd94dba502738331746258572c1a758b4dfe0a68174d9b1d7a65d75569c1c21f3cb9a6c12268c80c17bc1c548bc9eb9fcd627a409500e9f952d1cce75b4fb0296938e317b38c4f29cffcfd031e420d02295349030d03b09"}, &(0x7f0000000200)=0xf84) 12:44:24 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) mprotect(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000140)=ANY=[@ANYBLOB="01000000430000000000000000000000698f964802a24bfe86a80c4fd69973230d01eece0efeec2462cea62a26d6fe0d65b53986a55f1711e738d25e42f94b6891e5c0f924c405b94fdbc8de49ad906743244c48f88daa15c25d2ba482f073cddcf77a58564fc87f62f73e6abd4893070c8830ce1827a293a8f987add6bbc01dc2564d629d7a701195c8d582967fe61161e8e0eb320610330522a2851ed5839b36afdf84e584a1507e50f4b2110654f2ce3fe2432d699e09e543ceb44c74cbb3cf7a9faea00a4cb927f8541e495142a702cf28854ee28dd52022f6d438fdc5cf0e27688fb2ce5afbdc354b06ec08c454fb70c1c5cd49bac9bd6fa4a695675fa0bf6e9d7dff1c", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="897ceda0edcc494ec0251cb5aa69d6ceeb25"], 0x48}}, 0x0) 12:44:24 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x1000000}, 0x0) 12:44:24 executing program 2: 12:44:24 executing program 1: 12:44:24 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100), 0x0) 12:44:24 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x2000000}, 0x0) 12:44:24 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) accept$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000080)=0x14) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'ip6erspan0\x00', 0x0}) connect$can_bcm(r0, &(0x7f0000000140)={0x1d, r1}, 0xffffffa0) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/avc/hash_stats\x00', 0x0, 0x0) gettid() ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r0, 0x40106614, &(0x7f0000000000)={0x0, @speck128}) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x27, &(0x7f0000002180)={@remote, @dev, 0x0}, &(0x7f00000021c0)=0xc) sendmsg$xdp(r2, &(0x7f0000002280)={&(0x7f0000002200)={0x2c, 0x4, r3, 0x1a}, 0x10, &(0x7f0000002240), 0x0, 0x0, 0x0, 0x40000}, 0x840) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r4}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x1, 0x43, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) 12:44:24 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000", 0x10) 12:44:24 executing program 1: 12:44:24 executing program 2: unshare(0x20040600) r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x73, 0x2) ioctl$BLKPBSZGET(r0, 0x80045503, 0x0) [ 878.838443] IPVS: ftp: loaded support on port[0] = 21 12:44:24 executing program 1: mq_open(&(0x7f000084dff0)='vboxnet1##\x00', 0x3f, 0x0, 0x0) 12:44:24 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x4000000}, 0x0) 12:44:24 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000", 0x10) 12:44:24 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000000)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) mmap(&(0x7f0000ff0000/0x10000)=nil, 0x10000, 0x0, 0x13012, r0, 0x0) 12:44:24 executing program 2: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0x21a, 0x1, &(0x7f0000000040)=[{&(0x7f00000003c0)="eb64c86d4f66732e66617400020441000500077008f80000d8c32d8cbe59628cf9d9ed7b2c", 0x25}], 0x0, 0x0) 12:44:24 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") mq_timedsend(0xffffffffffffffff, 0x0, 0x0, 0xfffffffffffffffc, 0x0) 12:44:25 executing program 1: r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) r2 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/policy\x00', 0x0, 0x0) getsockopt$inet6_udp_int(r2, 0x11, 0x66, &(0x7f00000000c0), &(0x7f0000000100)=0x4) ioctl$PIO_FONTRESET(r2, 0x4b6d, 0x0) connect$can_bcm(r0, &(0x7f0000000040)={0x1d, r1}, 0x10) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) r5 = socket$key(0xf, 0x3, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$VIDIOC_LOG_STATUS(r5, 0x5646, 0x0) r6 = syz_init_net_socket$x25(0x9, 0x5, 0x0) dup3(r5, r6, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000280)={&(0x7f0000000140)={0x1d, r1}, 0x10, &(0x7f0000000240)={&(0x7f00000001c0)={0x7, 0x0, 0x8, {r3, r4/1000+30000}, {0x77359400}, {0x0, 0x3, 0x4}, 0x1, @canfd={{0x1, 0x8, 0x7ff, 0x2}, 0x1b, 0x2, 0x0, 0x0, "52bfb61610d5ce8c6a83383798619b710e6c6e1471298dea25b247ad089420334e6b46af9d13a10f2784263a0c789675a33782a0ed728aea742dfaf4bc75c967"}}, 0x80}, 0x1, 0x0, 0x0, 0x4004090}, 0x0) connect$can_bcm(r0, &(0x7f0000000480), 0x10) setsockopt$inet6_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f00000002c0)=0xffffffffffffffff, 0x4) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r7}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x1, 0x43, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) [ 879.404219] FAT-fs (loop2): bread failed, FSINFO block (sector = 1) 12:44:25 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000", 0x10) [ 879.473254] FAT-fs (loop2): bread failed, FSINFO block (sector = 1) [ 879.577752] protocol 88fb is buggy, dev hsr_slave_0 [ 879.582875] protocol 88fb is buggy, dev hsr_slave_1 12:44:26 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) acct(&(0x7f0000000000)='./file0\x00') sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[@ANYBLOB="019bf6003600700000000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="00001d91bf540000000000000000000048b21dbce83ad52a"], 0x48}}, 0x0) 12:44:26 executing program 2: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x1) syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) ioctl$TIOCVHANGUP(r1, 0x5437, 0x0) write$smack_current(r0, &(0x7f0000000000)='\x00', 0x1) 12:44:26 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b000500", 0x18) 12:44:26 executing program 0: syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x1) syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:44:26 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x8000000}, 0x0) 12:44:26 executing program 1: r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) r2 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/policy\x00', 0x0, 0x0) getsockopt$inet6_udp_int(r2, 0x11, 0x66, &(0x7f00000000c0), &(0x7f0000000100)=0x4) ioctl$PIO_FONTRESET(r2, 0x4b6d, 0x0) connect$can_bcm(r0, &(0x7f0000000040)={0x1d, r1}, 0x10) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) r5 = socket$key(0xf, 0x3, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$VIDIOC_LOG_STATUS(r5, 0x5646, 0x0) r6 = syz_init_net_socket$x25(0x9, 0x5, 0x0) dup3(r5, r6, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000280)={&(0x7f0000000140)={0x1d, r1}, 0x10, &(0x7f0000000240)={&(0x7f00000001c0)={0x7, 0x0, 0x8, {r3, r4/1000+30000}, {0x77359400}, {0x0, 0x3, 0x4}, 0x1, @canfd={{0x1, 0x8, 0x7ff, 0x2}, 0x1b, 0x2, 0x0, 0x0, "52bfb61610d5ce8c6a83383798619b710e6c6e1471298dea25b247ad089420334e6b46af9d13a10f2784263a0c789675a33782a0ed728aea742dfaf4bc75c967"}}, 0x80}, 0x1, 0x0, 0x0, 0x4004090}, 0x0) connect$can_bcm(r0, &(0x7f0000000480), 0x10) setsockopt$inet6_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f00000002c0)=0xffffffffffffffff, 0x4) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r7}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x1, 0x43, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) 12:44:26 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b000500", 0x18) 12:44:26 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r2, 0x2) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x1, 0x43, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) 12:44:26 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b000500", 0x18) 12:44:26 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0xa000000}, 0x0) 12:44:26 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000280)={{{@in6=@initdev, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in6=@initdev}}, &(0x7f0000000380)=0xe8) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000003c0)={'vcan0\x00', r1}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000700)={&(0x7f0000000400)=ANY=[@ANYBLOB="010000004300000000bd73000000000072c5921b89763057deea67e6c2e1", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES32=r0, @ANYBLOB="0000000001000000000000000000000048ba1dbce83ad52ab3dde59d0a69410a0684391994d760f176f650889c7c16f900b261ccb619f2cd041616524447e07d"], 0x6}}, 0x0) r3 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) r4 = fcntl$getown(r3, 0x9) tkill(r4, 0x35) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000140)={r0, 0x10, &(0x7f0000000100)={&(0x7f0000000080)=""/103, 0x67, 0x0}}, 0x10) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000001c0)={r3, 0x10, &(0x7f0000000180)={&(0x7f0000000040)=""/33, 0x21, r5}}, 0x10) 12:44:27 executing program 1: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x1, 0x43, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x4000000) 12:44:27 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0xe000000}, 0x0) [ 883.097827] Bluetooth: hci1: command 0x1003 tx timeout [ 883.103277] Bluetooth: hci1: sending frame failed (-49) [ 883.108750] Bluetooth: hci0: command 0x1003 tx timeout [ 883.114089] Bluetooth: hci0: sending frame failed (-49) [ 885.177765] Bluetooth: hci0: command 0x1001 tx timeout [ 885.177782] Bluetooth: hci1: command 0x1001 tx timeout [ 885.183142] Bluetooth: hci0: sending frame failed (-49) [ 885.194220] Bluetooth: hci1: sending frame failed (-49) [ 887.257740] Bluetooth: hci1: command 0x1009 tx timeout [ 887.263090] Bluetooth: hci0: command 0x1009 tx timeout 12:44:37 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x1, 0x43, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0xffffff7f, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) 12:44:37 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b00050000000000", 0x1c) 12:44:37 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) accept$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000080)=0x14) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f00000000c0)={@empty, @empty, 0x0}, &(0x7f0000000100)=0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vcan0\x00', r1}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[@ANYBLOB="010000004300"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="25a742430f80000063a20fa30000000000000000000048ba"], 0x48}}, 0x0) 12:44:37 executing program 1: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) write$P9_RCREATE(r0, &(0x7f0000000100)={0x18, 0x73, 0x1, {{0x24, 0x1, 0x2}, 0x4}}, 0x18) ioctl$VIDIOC_RESERVED(r0, 0x5601, 0x0) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000180)='/proc/capi/capi20ncci\x00', 0x200, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) r2 = getpid() ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000280)=0x0) rt_tgsigqueueinfo(r2, r3, 0x36, &(0x7f00000002c0)={0xb, 0x8, 0x9}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r0, 0xc0745645, &(0x7f0000000080)={0xfffffffffffffffd, [0x2, 0x493, 0x2, 0x3, 0x8000, 0x100000001, 0x2, 0xff, 0x81, 0x6, 0x7fff, 0x0, 0x7fffffff, 0x7fffffff, 0x6, 0x5, 0x5, 0x6, 0x1, 0x401, 0x100000000, 0x400, 0x5a, 0x5, 0xffffffffffffff7f, 0x9, 0x31, 0x10001, 0x8, 0x3, 0x79, 0x5, 0x101, 0x749, 0xcb, 0x401, 0xad, 0x0, 0x6, 0x6, 0x9, 0x0, 0x7f, 0x10001, 0x7, 0xed9, 0xffff, 0x80000000], 0x3}) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f00000001c0)=""/189) r4 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0x0, 0x64fa5e61fe70f708) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r4, 0xc0045516, &(0x7f0000000140)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f00000003c0)={0x0, 0x48, &(0x7f0000000340)=[@in6={0xa, 0x4e22, 0x2, @mcast1, 0x5e}, @in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x10}}, @in6={0xa, 0x4e22, 0x2, @mcast2, 0x7}]}, &(0x7f0000000400)=0x10) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000440)={r5, 0xffffffffffffffe1}, &(0x7f0000000480)=0x8) 12:44:37 executing program 0: syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x1) syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:44:37 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x3f000000}, 0x0) 12:44:37 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b00050000000000", 0x1c) 12:44:37 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) syz_extract_tcp_res$synack(&(0x7f0000000000), 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x1, 0x43, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) 12:44:37 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000040)="0a0775db7b2803b4f0a12585675d26b0d5e383e5b3b60ced5c54dbb7295df0df", 0x20) r1 = accept$alg(r0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000004580)=[{{0x0, 0x0, &(0x7f0000001440)=[{&(0x7f0000001340)=""/239, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) 12:44:37 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0xe8030000}, 0x0) 12:44:37 executing program 1: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) write$P9_RCREATE(r0, &(0x7f0000000100)={0x18, 0x73, 0x1, {{0x24, 0x1, 0x2}, 0x4}}, 0x18) ioctl$VIDIOC_RESERVED(r0, 0x5601, 0x0) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000180)='/proc/capi/capi20ncci\x00', 0x200, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) r2 = getpid() ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000280)=0x0) rt_tgsigqueueinfo(r2, r3, 0x36, &(0x7f00000002c0)={0xb, 0x8, 0x9}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r0, 0xc0745645, &(0x7f0000000080)={0xfffffffffffffffd, [0x2, 0x493, 0x2, 0x3, 0x8000, 0x100000001, 0x2, 0xff, 0x81, 0x6, 0x7fff, 0x0, 0x7fffffff, 0x7fffffff, 0x6, 0x5, 0x5, 0x6, 0x1, 0x401, 0x100000000, 0x400, 0x5a, 0x5, 0xffffffffffffff7f, 0x9, 0x31, 0x10001, 0x8, 0x3, 0x79, 0x5, 0x101, 0x749, 0xcb, 0x401, 0xad, 0x0, 0x6, 0x6, 0x9, 0x0, 0x7f, 0x10001, 0x7, 0xed9, 0xffff, 0x80000000], 0x3}) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f00000001c0)=""/189) r4 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0x0, 0x64fa5e61fe70f708) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r4, 0xc0045516, &(0x7f0000000140)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f00000003c0)={0x0, 0x48, &(0x7f0000000340)=[@in6={0xa, 0x4e22, 0x2, @mcast1, 0x5e}, @in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x10}}, @in6={0xa, 0x4e22, 0x2, @mcast2, 0x7}]}, &(0x7f0000000400)=0x10) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000440)={r5, 0xffffffffffffffe1}, &(0x7f0000000480)=0x8) 12:44:37 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b00050000000000", 0x1c) 12:44:37 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000080)={{{@in6=@initdev, @in=@loopback}}, {{@in6=@mcast1}, 0x0, @in6=@local}}, &(0x7f0000000180)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000004c0)={{{@in6=@empty, @in6=@mcast1}}, {{@in6}, 0x0, @in6=@loopback}}, &(0x7f0000000440)=0xe8) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000008c0)={{{@in6=@mcast2, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6}}, &(0x7f00000009c0)=0xe8) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000006c0)={'vcan0\x00', r1}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[@ANYBLOB="010000004300"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="00000000013c000000"], 0x48}}, 0x0) r3 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x800000000000, 0x0) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r3, 0x6, 0x15, &(0x7f0000000040)=0x1f, 0x4) 12:44:37 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {0x0, 0xe8030000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) 12:44:37 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0xf4010000}, 0x0) 12:44:37 executing program 1: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) write$P9_RCREATE(r0, &(0x7f0000000100)={0x18, 0x73, 0x1, {{0x24, 0x1, 0x2}, 0x4}}, 0x18) ioctl$VIDIOC_RESERVED(r0, 0x5601, 0x0) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000180)='/proc/capi/capi20ncci\x00', 0x200, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) r2 = getpid() ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000280)=0x0) rt_tgsigqueueinfo(r2, r3, 0x36, &(0x7f00000002c0)={0xb, 0x8, 0x9}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r0, 0xc0745645, &(0x7f0000000080)={0xfffffffffffffffd, [0x2, 0x493, 0x2, 0x3, 0x8000, 0x100000001, 0x2, 0xff, 0x81, 0x6, 0x7fff, 0x0, 0x7fffffff, 0x7fffffff, 0x6, 0x5, 0x5, 0x6, 0x1, 0x401, 0x100000000, 0x400, 0x5a, 0x5, 0xffffffffffffff7f, 0x9, 0x31, 0x10001, 0x8, 0x3, 0x79, 0x5, 0x101, 0x749, 0xcb, 0x401, 0xad, 0x0, 0x6, 0x6, 0x9, 0x0, 0x7f, 0x10001, 0x7, 0xed9, 0xffff, 0x80000000], 0x3}) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f00000001c0)=""/189) r4 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0x0, 0x64fa5e61fe70f708) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r4, 0xc0045516, &(0x7f0000000140)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f00000003c0)={0x0, 0x48, &(0x7f0000000340)=[@in6={0xa, 0x4e22, 0x2, @mcast1, 0x5e}, @in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x10}}, @in6={0xa, 0x4e22, 0x2, @mcast2, 0x7}]}, &(0x7f0000000400)=0x10) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000440)={r5, 0xffffffffffffffe1}, &(0x7f0000000480)=0x8) [ 893.817735] Bluetooth: hci0: command 0x1003 tx timeout [ 893.823162] Bluetooth: hci0: sending frame failed (-49) [ 895.897777] Bluetooth: hci0: command 0x1001 tx timeout [ 895.903310] Bluetooth: hci0: sending frame failed (-49) [ 897.977796] Bluetooth: hci0: command 0x1009 tx timeout 12:44:47 executing program 0: syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x1) syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:44:47 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b000500000000000100", 0x1e) 12:44:47 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$RTC_WKALM_SET(r2, 0x4028700f, &(0x7f00000000c0)={0x0, 0x1, {0x24, 0x1b, 0x0, 0xf, 0x7, 0x1c99, 0x5, 0xe2, 0xffffffffffffffff}}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000000)=ANY=[@ANYBLOB="0100000043000000000000006d00000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000000001000000000000000000000048ba1dbce83ad52a"], 0x48}}, 0x0) 12:44:47 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0xffffff7f}, 0x0) 12:44:47 executing program 2 (fault-call:3 fault-nth:0): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:44:47 executing program 1: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) write$P9_RCREATE(r0, &(0x7f0000000100)={0x18, 0x73, 0x1, {{0x24, 0x1, 0x2}, 0x4}}, 0x18) ioctl$VIDIOC_RESERVED(r0, 0x5601, 0x0) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000180)='/proc/capi/capi20ncci\x00', 0x200, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) r2 = getpid() ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000280)=0x0) rt_tgsigqueueinfo(r2, r3, 0x36, &(0x7f00000002c0)={0xb, 0x8, 0x9}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r0, 0xc0745645, &(0x7f0000000080)={0xfffffffffffffffd, [0x2, 0x493, 0x2, 0x3, 0x8000, 0x100000001, 0x2, 0xff, 0x81, 0x6, 0x7fff, 0x0, 0x7fffffff, 0x7fffffff, 0x6, 0x5, 0x5, 0x6, 0x1, 0x401, 0x100000000, 0x400, 0x5a, 0x5, 0xffffffffffffff7f, 0x9, 0x31, 0x10001, 0x8, 0x3, 0x79, 0x5, 0x101, 0x749, 0xcb, 0x401, 0xad, 0x0, 0x6, 0x6, 0x9, 0x0, 0x7f, 0x10001, 0x7, 0xed9, 0xffff, 0x80000000], 0x3}) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f00000001c0)=""/189) r4 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0x0, 0x64fa5e61fe70f708) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r4, 0xc0045516, &(0x7f0000000140)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f00000003c0)={0x0, 0x48, &(0x7f0000000340)=[@in6={0xa, 0x4e22, 0x2, @mcast1, 0x5e}, @in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x10}}, @in6={0xa, 0x4e22, 0x2, @mcast2, 0x7}]}, &(0x7f0000000400)=0x10) 12:44:47 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b000500000000000100", 0x1e) 12:44:47 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000000)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[@ANYBLOB="010000004300"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="000000000100001c000000000000ae0048ba1dbce83ad52a"], 0x48}}, 0x0) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x111200, 0x0) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r2, 0x10f, 0x84, &(0x7f00000001c0), &(0x7f0000000200)=0x4) syz_open_dev$vcsn(&(0x7f0000000240)='/dev/vcs#\x00', 0x5, 0x2402) openat$md(0xffffffffffffff9c, &(0x7f0000000280)='/dev/md0\x00', 0x0, 0x0) setsockopt$inet6_group_source_req(r2, 0x29, 0x2c, &(0x7f0000000080)={0x447, {{0xa, 0x4e20, 0x9, @mcast1, 0x7338ef5d}}, {{0xa, 0x4e20, 0x3, @rand_addr="15233b5ec853a5d8e8ae1ae2f1863389", 0x4}}}, 0x108) 12:44:47 executing program 1: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) write$P9_RCREATE(r0, &(0x7f0000000100)={0x18, 0x73, 0x1, {{0x24, 0x1, 0x2}, 0x4}}, 0x18) ioctl$VIDIOC_RESERVED(r0, 0x5601, 0x0) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000180)='/proc/capi/capi20ncci\x00', 0x200, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) r2 = getpid() ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000280)=0x0) rt_tgsigqueueinfo(r2, r3, 0x36, &(0x7f00000002c0)={0xb, 0x8, 0x9}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r0, 0xc0745645, &(0x7f0000000080)={0xfffffffffffffffd, [0x2, 0x493, 0x2, 0x3, 0x8000, 0x100000001, 0x2, 0xff, 0x81, 0x6, 0x7fff, 0x0, 0x7fffffff, 0x7fffffff, 0x6, 0x5, 0x5, 0x6, 0x1, 0x401, 0x100000000, 0x400, 0x5a, 0x5, 0xffffffffffffff7f, 0x9, 0x31, 0x10001, 0x8, 0x3, 0x79, 0x5, 0x101, 0x749, 0xcb, 0x401, 0xad, 0x0, 0x6, 0x6, 0x9, 0x0, 0x7f, 0x10001, 0x7, 0xed9, 0xffff, 0x80000000], 0x3}) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f00000001c0)=""/189) r4 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0x0, 0x64fa5e61fe70f708) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r4, 0xc0045516, &(0x7f0000000140)=0x8) 12:44:47 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x100000000000000}, 0x0) 12:44:47 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b000500000000000100", 0x1e) [ 901.885523] Bluetooth: hci0: Frame reassembly failed (-84) 12:44:47 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x200000000000000}, 0x0) [ 903.897754] Bluetooth: hci0: command 0x1003 tx timeout [ 903.903242] Bluetooth: hci0: sending frame failed (-49) [ 903.977704] Bluetooth: hci1: command 0x1003 tx timeout [ 903.983169] Bluetooth: hci1: sending frame failed (-49) [ 905.977810] Bluetooth: hci0: command 0x1001 tx timeout [ 905.983320] Bluetooth: hci0: sending frame failed (-49) [ 906.057770] Bluetooth: hci1: command 0x1001 tx timeout [ 906.063306] Bluetooth: hci1: sending frame failed (-49) [ 908.057855] Bluetooth: hci0: command 0x1009 tx timeout [ 908.137798] Bluetooth: hci1: command 0x1009 tx timeout 12:44:57 executing program 0: syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x1) syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) 12:44:57 executing program 1: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) write$P9_RCREATE(r0, &(0x7f0000000100)={0x18, 0x73, 0x1, {{0x24, 0x1, 0x2}, 0x4}}, 0x18) ioctl$VIDIOC_RESERVED(r0, 0x5601, 0x0) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000180)='/proc/capi/capi20ncci\x00', 0x200, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) r2 = getpid() ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000280)=0x0) rt_tgsigqueueinfo(r2, r3, 0x36, &(0x7f00000002c0)={0xb, 0x8, 0x9}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r0, 0xc0745645, &(0x7f0000000080)={0xfffffffffffffffd, [0x2, 0x493, 0x2, 0x3, 0x8000, 0x100000001, 0x2, 0xff, 0x81, 0x6, 0x7fff, 0x0, 0x7fffffff, 0x7fffffff, 0x6, 0x5, 0x5, 0x6, 0x1, 0x401, 0x100000000, 0x400, 0x5a, 0x5, 0xffffffffffffff7f, 0x9, 0x31, 0x10001, 0x8, 0x3, 0x79, 0x5, 0x101, 0x749, 0xcb, 0x401, 0xad, 0x0, 0x6, 0x6, 0x9, 0x0, 0x7f, 0x10001, 0x7, 0xed9, 0xffff, 0x80000000], 0x3}) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f00000001c0)=""/189) syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0x0, 0x64fa5e61fe70f708) 12:44:57 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[@ANYBLOB="01000000430000000000000002000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000000001000000000000000000000048ba1dbce83ad52a"], 0x48}}, 0x0) 12:44:57 executing program 4 (fault-call:1 fault-nth:0): r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) [ 912.062256] FAULT_INJECTION: forcing a failure. [ 912.062256] name failslab, interval 1, probability 0, space 0, times 0 [ 912.077798] CPU: 0 PID: 31370 Comm: syz-executor.2 Not tainted 4.19.62 #36 [ 912.084931] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 912.094275] Call Trace: [ 912.096865] dump_stack+0x172/0x1f0 [ 912.100479] should_fail.cold+0xa/0x1b [ 912.104365] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 912.109453] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 912.114985] ? __cancel_work_timer+0x313/0x520 [ 912.119584] ? mutex_trylock+0x1e0/0x1e0 [ 912.123638] __should_failslab+0x121/0x190 [ 912.127854] should_failslab+0x9/0x14 [ 912.131637] kmem_cache_alloc_node+0x56/0x710 [ 912.136135] __alloc_skb+0xd5/0x5f0 [ 912.139750] ? skb_scrub_packet+0x490/0x490 [ 912.144059] ? lock_downgrade+0x810/0x810 [ 912.148190] ? hci_dev_open+0x220/0x220 [ 912.152197] hci_sock_dev_event+0xf3/0x580 [ 912.156426] hci_unregister_dev+0x253/0x820 [ 912.160736] hci_uart_tty_close+0x1fc/0x250 [ 912.165052] ? hci_uart_close+0x50/0x50 [ 912.169013] tty_ldisc_close.isra.0+0xaf/0xe0 [ 912.173505] tty_ldisc_kill+0x4b/0xc0 [ 912.177293] tty_ldisc_hangup+0x2d9/0x630 [ 912.181431] __tty_hangup.part.0+0x2cc/0x6f0 [ 912.185824] ? tty_read+0x2a0/0x2a0 [ 912.189436] tty_ioctl+0xefb/0x1510 [ 912.193048] ? tty_vhangup+0x30/0x30 [ 912.196752] ? mark_held_locks+0x100/0x100 [ 912.200979] ? __fget+0x340/0x540 [ 912.204423] ? __might_sleep+0x95/0x190 [ 912.208385] ? tty_vhangup+0x30/0x30 [ 912.212091] do_vfs_ioctl+0xd5f/0x1380 [ 912.215967] ? selinux_file_ioctl+0x46f/0x5e0 [ 912.220445] ? selinux_file_ioctl+0x125/0x5e0 [ 912.224923] ? ioctl_preallocate+0x210/0x210 [ 912.229313] ? selinux_file_mprotect+0x620/0x620 [ 912.234060] ? iterate_fd+0x360/0x360 [ 912.237849] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 912.243374] ? fput+0x128/0x1a0 [ 912.246640] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 912.252339] ? security_file_ioctl+0x8d/0xc0 [ 912.256738] ksys_ioctl+0xab/0xd0 [ 912.260177] __x64_sys_ioctl+0x73/0xb0 [ 912.264051] do_syscall_64+0xfd/0x620 [ 912.267854] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 912.273030] RIP: 0033:0x459829 [ 912.276217] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 912.295103] RSP: 002b:00007f49eec68c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 912.302843] RAX: ffffffffffffffda RBX: 00007f49eec68c90 RCX: 0000000000459829 12:44:57 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:44:57 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x400000000000000}, 0x0) [ 912.310148] RDX: 0000000000000000 RSI: 0000000000005437 RDI: 0000000000000003 [ 912.317416] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 912.324672] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f49eec696d4 [ 912.331930] R13: 00000000004c41f6 R14: 00000000004d8318 R15: 0000000000000004 [ 912.345153] FAULT_INJECTION: forcing a failure. [ 912.345153] name failslab, interval 1, probability 0, space 0, times 0 [ 912.363059] CPU: 1 PID: 31404 Comm: syz-executor.4 Not tainted 4.19.62 #36 [ 912.370076] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 912.379420] Call Trace: [ 912.382072] dump_stack+0x172/0x1f0 [ 912.385715] should_fail.cold+0xa/0x1b [ 912.389593] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 912.389605] ? lock_downgrade+0x810/0x810 [ 912.389626] __should_failslab+0x121/0x190 [ 912.389643] should_failslab+0x9/0x14 [ 912.406958] kmem_cache_alloc_node+0x26c/0x710 [ 912.411555] __alloc_skb+0xd5/0x5f0 [ 912.415188] ? skb_scrub_packet+0x490/0x490 [ 912.419500] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 912.419513] ? netlink_autobind.isra.0+0x228/0x310 [ 912.419525] netlink_sendmsg+0x97b/0xd70 [ 912.419539] ? netlink_unicast+0x720/0x720 [ 912.419555] ? selinux_socket_sendmsg+0x36/0x40 [ 912.419563] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 912.419572] ? security_socket_sendmsg+0x8d/0xc0 [ 912.419586] ? netlink_unicast+0x720/0x720 [ 912.434088] sock_sendmsg+0xd7/0x130 12:44:58 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x800000000000000}, 0x0) 12:44:58 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-control\x00', 0x2200, 0x0) connect$can_bcm(r0, &(0x7f0000000480), 0x10) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000002c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000180)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000380)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000240)={0x68, r3, 0x1, 0x70bd26, 0x25dfdbff, {{}, 0x0, 0x4107, 0x0, {0x4c, 0x18, {0x0, @link='syz1\x00'}}}, [""]}, 0x68}, 0x1, 0x0, 0x0, 0x20008000}, 0x20008041) sendmsg$alg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000170100000200"/24], 0x18}, 0x0) r4 = accept$alg(r2, 0x0, 0x0) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000), 0x0, &(0x7f0000000140)=[@op={0x18}], 0x18}], 0x1b5, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x8002, 0x0) ioctl$TIOCMGET(r6, 0x5415, &(0x7f0000000040)) ioctl$KVM_SET_BOOT_CPU_ID(r6, 0xae78, &(0x7f0000000000)=0x2) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r5}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x1, 0x43, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) [ 912.434100] sock_write_iter+0x27c/0x3e0 [ 912.434111] ? sock_sendmsg+0x130/0x130 [ 912.434127] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 912.434136] ? iov_iter_init+0xc6/0x1f0 [ 912.434150] __vfs_write+0x587/0x810 [ 912.434162] ? kernel_read+0x120/0x120 [ 912.457538] ? selinux_file_permission+0x92/0x550 [ 912.469267] ? security_file_permission+0x89/0x230 [ 912.469280] ? rw_verify_area+0x118/0x360 [ 912.469291] vfs_write+0x20c/0x560 [ 912.469303] ksys_write+0x14f/0x2d0 [ 912.469318] ? __ia32_sys_read+0xb0/0xb0 12:44:58 executing program 1: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) write$P9_RCREATE(r0, &(0x7f0000000100)={0x18, 0x73, 0x1, {{0x24, 0x1, 0x2}, 0x4}}, 0x18) ioctl$VIDIOC_RESERVED(r0, 0x5601, 0x0) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000180)='/proc/capi/capi20ncci\x00', 0x200, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) r2 = getpid() ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000280)=0x0) rt_tgsigqueueinfo(r2, r3, 0x36, &(0x7f00000002c0)={0xb, 0x8, 0x9}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r0, 0xc0745645, &(0x7f0000000080)={0xfffffffffffffffd, [0x2, 0x493, 0x2, 0x3, 0x8000, 0x100000001, 0x2, 0xff, 0x81, 0x6, 0x7fff, 0x0, 0x7fffffff, 0x7fffffff, 0x6, 0x5, 0x5, 0x6, 0x1, 0x401, 0x100000000, 0x400, 0x5a, 0x5, 0xffffffffffffff7f, 0x9, 0x31, 0x10001, 0x8, 0x3, 0x79, 0x5, 0x101, 0x749, 0xcb, 0x401, 0xad, 0x0, 0x6, 0x6, 0x9, 0x0, 0x7f, 0x10001, 0x7, 0xed9, 0xffff, 0x80000000], 0x3}) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f00000001c0)=""/189) syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0x0, 0x64fa5e61fe70f708) [ 912.469333] ? do_syscall_64+0x26/0x620 [ 912.469343] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 912.469350] ? do_syscall_64+0x26/0x620 [ 912.469362] __x64_sys_write+0x73/0xb0 [ 912.469372] do_syscall_64+0xfd/0x620 [ 912.469382] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 912.469390] RIP: 0033:0x459829 [ 912.469401] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 12:44:58 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0xa00000000000000}, 0x0) 12:44:58 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) fcntl$getownex(r0, 0x10, &(0x7f0000000000)={0x0, 0x0}) fcntl$lock(r0, 0x25, &(0x7f0000000040)={0x3, 0x3, 0x8001, 0x3, r1}) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x1, 0x43, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) [ 912.469414] RSP: 002b:00007fca529c0c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 912.469424] RAX: ffffffffffffffda RBX: 00007fca529c0c90 RCX: 0000000000459829 [ 912.469429] RDX: 000000000000001f RSI: 0000000020000100 RDI: 0000000000000003 [ 912.469434] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 912.469440] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fca529c16d4 [ 912.469444] R13: 00000000004c5d9f R14: 00000000004e0070 R15: 0000000000000004 12:44:58 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0xe00000000000000}, 0x0) [ 914.697792] Bluetooth: hci0: command 0x1003 tx timeout [ 914.703264] Bluetooth: hci0: sending frame failed (-49) [ 914.708821] Bluetooth: hci1: command 0x1003 tx timeout [ 914.716465] Bluetooth: hci1: sending frame failed (-49) [ 916.777810] Bluetooth: hci1: command 0x1001 tx timeout [ 916.783209] Bluetooth: hci1: sending frame failed (-49) [ 916.788678] Bluetooth: hci0: command 0x1001 tx timeout [ 916.794112] Bluetooth: hci0: sending frame failed (-49) [ 918.857726] Bluetooth: hci0: command 0x1009 tx timeout [ 918.863075] Bluetooth: hci1: command 0x1009 tx timeout 12:45:08 executing program 0: syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x1) 12:45:08 executing program 1: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) write$P9_RCREATE(r0, &(0x7f0000000100)={0x18, 0x73, 0x1, {{0x24, 0x1, 0x2}, 0x4}}, 0x18) ioctl$VIDIOC_RESERVED(r0, 0x5601, 0x0) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000180)='/proc/capi/capi20ncci\x00', 0x200, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) r2 = getpid() ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000280)=0x0) rt_tgsigqueueinfo(r2, r3, 0x36, &(0x7f00000002c0)={0xb, 0x8, 0x9}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r0, 0xc0745645, &(0x7f0000000080)={0xfffffffffffffffd, [0x2, 0x493, 0x2, 0x3, 0x8000, 0x100000001, 0x2, 0xff, 0x81, 0x6, 0x7fff, 0x0, 0x7fffffff, 0x7fffffff, 0x6, 0x5, 0x5, 0x6, 0x1, 0x401, 0x100000000, 0x400, 0x5a, 0x5, 0xffffffffffffff7f, 0x9, 0x31, 0x10001, 0x8, 0x3, 0x79, 0x5, 0x101, 0x749, 0xcb, 0x401, 0xad, 0x0, 0x6, 0x6, 0x9, 0x0, 0x7f, 0x10001, 0x7, 0xed9, 0xffff, 0x80000000], 0x3}) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f00000001c0)=""/189) 12:45:08 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) r2 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) keyctl$invalidate(0x15, r2) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x1, 0x43, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) 12:45:08 executing program 4 (fault-call:1 fault-nth:1): r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:45:08 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x3f00000000000000}, 0x0) 12:45:08 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x2, 0x0) [ 922.990577] FAULT_INJECTION: forcing a failure. [ 922.990577] name failslab, interval 1, probability 0, space 0, times 0 12:45:08 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0xe803000000000000}, 0x0) [ 923.072379] CPU: 1 PID: 31454 Comm: syz-executor.4 Not tainted 4.19.62 #36 [ 923.079437] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 923.088792] Call Trace: [ 923.088819] dump_stack+0x172/0x1f0 [ 923.088842] should_fail.cold+0xa/0x1b [ 923.088862] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 923.088883] ? lock_downgrade+0x810/0x810 [ 923.088911] __should_failslab+0x121/0x190 [ 923.088929] should_failslab+0x9/0x14 [ 923.088944] kmem_cache_alloc_node_trace+0x274/0x720 12:45:08 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) finit_module(r0, &(0x7f0000000000)='vcan0\x00', 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/avc/cache_stats\x00', 0x0, 0x0) syz_open_dev$cec(&(0x7f0000000200)='/dev/cec#\x00', 0x3, 0x2) r1 = syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x5, 0x2000) r2 = openat$cgroup_ro(r1, &(0x7f00000001c0)='cpuacct.usage_all\x00', 0x0, 0x0) ioctl$PPPIOCSNPMODE(r2, 0x4008744b, &(0x7f0000000080)={0x2b, 0x3}) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r3}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[@ANYBLOB="010000004300"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000000001000000000000000000000048ba1dbce83ad52a"], 0x48}}, 0x0) syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x99a, 0x20000) 12:45:08 executing program 1: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) write$P9_RCREATE(r0, &(0x7f0000000100)={0x18, 0x73, 0x1, {{0x24, 0x1, 0x2}, 0x4}}, 0x18) ioctl$VIDIOC_RESERVED(r0, 0x5601, 0x0) openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000180)='/proc/capi/capi20ncci\x00', 0x200, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) r1 = getpid() ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000280)=0x0) rt_tgsigqueueinfo(r1, r2, 0x36, &(0x7f00000002c0)={0xb, 0x8, 0x9}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r0, 0xc0745645, &(0x7f0000000080)={0xfffffffffffffffd, [0x2, 0x493, 0x2, 0x3, 0x8000, 0x100000001, 0x2, 0xff, 0x81, 0x6, 0x7fff, 0x0, 0x7fffffff, 0x7fffffff, 0x6, 0x5, 0x5, 0x6, 0x1, 0x401, 0x100000000, 0x400, 0x5a, 0x5, 0xffffffffffffff7f, 0x9, 0x31, 0x10001, 0x8, 0x3, 0x79, 0x5, 0x101, 0x749, 0xcb, 0x401, 0xad, 0x0, 0x6, 0x6, 0x9, 0x0, 0x7f, 0x10001, 0x7, 0xed9, 0xffff, 0x80000000], 0x3}) [ 923.088962] ? __alloc_skb+0xd5/0x5f0 [ 923.095183] __kmalloc_node_track_caller+0x3d/0x80 [ 923.095207] __kmalloc_reserve.isra.0+0x40/0xf0 [ 923.095229] __alloc_skb+0x10b/0x5f0 [ 923.095250] ? skb_scrub_packet+0x490/0x490 [ 923.095267] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 923.095283] ? netlink_autobind.isra.0+0x228/0x310 [ 923.095301] netlink_sendmsg+0x97b/0xd70 [ 923.104281] ? netlink_unicast+0x720/0x720 [ 923.104306] ? selinux_socket_sendmsg+0x36/0x40 [ 923.104322] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 923.104336] ? security_socket_sendmsg+0x8d/0xc0 [ 923.104351] ? netlink_unicast+0x720/0x720 [ 923.104370] sock_sendmsg+0xd7/0x130 [ 923.112736] sock_write_iter+0x27c/0x3e0 [ 923.121755] ? sock_sendmsg+0x130/0x130 [ 923.121787] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 923.121802] ? iov_iter_init+0xc6/0x1f0 [ 923.121822] __vfs_write+0x587/0x810 [ 923.121841] ? kernel_read+0x120/0x120 [ 923.121865] ? selinux_file_permission+0x92/0x550 [ 923.121891] ? security_file_permission+0x89/0x230 [ 923.121908] ? rw_verify_area+0x118/0x360 [ 923.130616] vfs_write+0x20c/0x560 [ 923.130637] ksys_write+0x14f/0x2d0 [ 923.130656] ? __ia32_sys_read+0xb0/0xb0 [ 923.130676] ? do_syscall_64+0x26/0x620 [ 923.130691] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 923.130703] ? do_syscall_64+0x26/0x620 [ 923.130723] __x64_sys_write+0x73/0xb0 [ 923.130741] do_syscall_64+0xfd/0x620 [ 923.130759] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 923.130771] RIP: 0033:0x459829 [ 923.130785] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 923.130797] RSP: 002b:00007fca529c0c78 EFLAGS: 00000246 [ 923.148487] Bluetooth: hci1: Frame reassembly failed (-84) [ 923.148994] ORIG_RAX: 0000000000000001 [ 923.149005] RAX: ffffffffffffffda RBX: 00007fca529c0c90 RCX: 0000000000459829 [ 923.149014] RDX: 000000000000001f RSI: 0000000020000100 RDI: 0000000000000003 [ 923.149023] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 12:45:08 executing program 4 (fault-call:1 fault-nth:2): r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:45:08 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0xf401000000000000}, 0x0) 12:45:08 executing program 1: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) write$P9_RCREATE(r0, &(0x7f0000000100)={0x18, 0x73, 0x1, {{0x24, 0x1, 0x2}, 0x4}}, 0x18) ioctl$VIDIOC_RESERVED(r0, 0x5601, 0x0) openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000180)='/proc/capi/capi20ncci\x00', 0x200, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) r1 = getpid() ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000280)=0x0) rt_tgsigqueueinfo(r1, r2, 0x36, &(0x7f00000002c0)={0xb, 0x8, 0x9}) [ 923.149032] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fca529c16d4 [ 923.149041] R13: 00000000004c5d9f R14: 00000000004e0070 R15: 0000000000000004 [ 923.347413] FAULT_INJECTION: forcing a failure. [ 923.347413] name failslab, interval 1, probability 0, space 0, times 0 [ 923.402748] CPU: 1 PID: 31474 Comm: syz-executor.4 Not tainted 4.19.62 #36 [ 923.409825] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 923.419191] Call Trace: [ 923.421802] dump_stack+0x172/0x1f0 [ 923.425449] should_fail.cold+0xa/0x1b [ 923.429354] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 923.434478] ? netlink_deliver_tap+0x146/0xc20 [ 923.439083] __should_failslab+0x121/0x190 [ 923.443332] should_failslab+0x9/0x14 [ 923.447139] kmem_cache_alloc+0x47/0x700 [ 923.451218] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 923.456765] ? check_preemption_disabled+0x48/0x290 [ 923.461789] ? lock_acquire+0x16f/0x3f0 [ 923.465772] skb_clone+0x156/0x3e0 [ 923.469327] netlink_deliver_tap+0x97b/0xc20 [ 923.473758] netlink_unicast+0x5a8/0x720 [ 923.477924] ? netlink_attachskb+0x770/0x770 [ 923.482352] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 923.487908] netlink_sendmsg+0x8ae/0xd70 [ 923.491988] ? netlink_unicast+0x720/0x720 [ 923.496244] ? selinux_socket_sendmsg+0x36/0x40 [ 923.500925] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 923.506472] ? security_socket_sendmsg+0x8d/0xc0 [ 923.511243] ? netlink_unicast+0x720/0x720 [ 923.515493] sock_sendmsg+0xd7/0x130 [ 923.519225] sock_write_iter+0x27c/0x3e0 [ 923.523302] ? sock_sendmsg+0x130/0x130 [ 923.527319] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 923.532871] ? iov_iter_init+0xc6/0x1f0 [ 923.536869] __vfs_write+0x587/0x810 [ 923.540602] ? kernel_read+0x120/0x120 [ 923.544511] ? selinux_file_permission+0x92/0x550 [ 923.549377] ? security_file_permission+0x89/0x230 [ 923.554331] ? rw_verify_area+0x118/0x360 [ 923.554354] vfs_write+0x20c/0x560 [ 923.554373] ksys_write+0x14f/0x2d0 [ 923.554390] ? __ia32_sys_read+0xb0/0xb0 [ 923.562057] ? do_syscall_64+0x26/0x620 [ 923.562073] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 923.562086] ? do_syscall_64+0x26/0x620 [ 923.562106] __x64_sys_write+0x73/0xb0 [ 923.586917] do_syscall_64+0xfd/0x620 [ 923.590732] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 923.595929] RIP: 0033:0x459829 [ 923.599126] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 923.618210] RSP: 002b:00007fca529c0c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 923.625930] RAX: ffffffffffffffda RBX: 00007fca529c0c90 RCX: 0000000000459829 [ 923.625940] RDX: 000000000000001f RSI: 0000000020000100 RDI: 0000000000000003 [ 923.625949] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 923.625958] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fca529c16d4 [ 923.625967] R13: 00000000004c5d9f R14: 00000000004e0070 R15: 0000000000000004 [ 923.650683] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 925.097741] Bluetooth: hci0: command 0x1003 tx timeout [ 925.103144] Bluetooth: hci0: sending frame failed (-49) [ 925.177746] Bluetooth: hci1: command 0x1003 tx timeout [ 925.183187] Bluetooth: hci1: sending frame failed (-49) [ 927.177819] Bluetooth: hci0: command 0x1001 tx timeout [ 927.183201] Bluetooth: hci0: sending frame failed (-49) [ 927.257880] Bluetooth: hci1: command 0x1001 tx timeout [ 927.263277] Bluetooth: hci1: sending frame failed (-49) [ 929.257762] Bluetooth: hci0: command 0x1009 tx timeout [ 929.337788] Bluetooth: hci1: command 0x1009 tx timeout 12:45:18 executing program 0: syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x1) 12:45:18 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[@ANYBLOB="010000004300"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="000000000100000000e83ad52a00"/24], 0x48}}, 0x0) 12:45:18 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0xffffff7f00000000}, 0x0) 12:45:18 executing program 1: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) write$P9_RCREATE(r0, &(0x7f0000000100)={0x18, 0x73, 0x1, {{0x24, 0x1, 0x2}, 0x4}}, 0x18) ioctl$VIDIOC_RESERVED(r0, 0x5601, 0x0) openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000180)='/proc/capi/capi20ncci\x00', 0x200, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) getpid() ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000280)) 12:45:18 executing program 4 (fault-call:1 fault-nth:3): r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:45:18 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x4b47, 0x0) [ 933.234921] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:45:18 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0xffffffff00000000}, 0x0) 12:45:18 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, 0x8, {0x7, 0x1f, 0x89e, 0x2202200, 0x1f, 0x0, 0x1, 0x2}}, 0x50) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x1, 0x43, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) [ 933.300382] FAULT_INJECTION: forcing a failure. [ 933.300382] name failslab, interval 1, probability 0, space 0, times 0 [ 933.346844] CPU: 1 PID: 31497 Comm: syz-executor.4 Not tainted 4.19.62 #36 [ 933.353900] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 933.363264] Call Trace: [ 933.365874] dump_stack+0x172/0x1f0 [ 933.369512] should_fail.cold+0xa/0x1b [ 933.369539] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 933.369555] ? lock_downgrade+0x810/0x810 [ 933.369582] __should_failslab+0x121/0x190 [ 933.369599] should_failslab+0x9/0x14 [ 933.369615] kmem_cache_alloc_node+0x26c/0x710 [ 933.378605] ? mutex_trylock+0x1e0/0x1e0 [ 933.378624] ? lock_downgrade+0x810/0x810 [ 933.378647] __alloc_skb+0xd5/0x5f0 [ 933.378665] ? skb_scrub_packet+0x490/0x490 [ 933.378679] ? __mutex_unlock_slowpath+0xf8/0x6b0 [ 933.378694] ? nfnl_acct_start+0x270/0x340 [ 933.378718] netlink_dump+0x5c5/0xbb0 [ 933.378739] __netlink_dump_start+0x508/0x700 [ 933.378751] ? nfnl_acct_new+0x930/0x930 [ 933.378775] nfnl_acct_get+0x3e8/0x4a0 [ 933.390941] ? nfnl_acct_fill_info.constprop.0+0x810/0x810 [ 933.390959] ? nfnl_acct_new+0x930/0x930 [ 933.390973] ? nfnl_acct_get+0x4a0/0x4a0 [ 933.390987] ? nfnl_acct_try_del+0x180/0x180 [ 933.391014] ? nfnl_acct_fill_info.constprop.0+0x810/0x810 [ 933.391031] nfnetlink_rcv_msg+0xd0d/0xfcf [ 933.411723] ? nfnetlink_bind+0x2d0/0x2d0 [ 933.411743] ? avc_has_extended_perms+0x10f0/0x10f0 [ 933.411774] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 933.411790] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 933.411805] ? cred_has_capability+0x193/0x320 [ 933.411821] ? selinux_ipv4_output+0x50/0x50 [ 933.411846] ? debug_smp_processor_id+0x1c/0x20 [ 933.411861] ? perf_trace_lock+0x83/0x510 [ 933.411883] netlink_rcv_skb+0x17d/0x460 [ 933.411898] ? nfnetlink_bind+0x2d0/0x2d0 [ 933.429240] ? netlink_ack+0xb30/0xb30 [ 933.429258] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 933.429277] ? ns_capable+0x23/0x30 [ 933.446868] ? __netlink_ns_capable+0x104/0x140 [ 933.446893] nfnetlink_rcv+0x1c0/0x460 [ 933.446910] ? nfnetlink_rcv_batch+0x1750/0x1750 [ 933.446925] ? netlink_deliver_tap+0x254/0xc20 [ 933.446950] netlink_unicast+0x537/0x720 12:45:19 executing program 0: syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x1) 12:45:19 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) socket$can_bcm(0x1d, 0x2, 0x2) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000000)=ANY=[@ANYBLOB="010000004300003e0beaa000003f5267ac308f4c530d6a9a36b0d38e36ae6cd9b7c498f591062e14d60b11ad730f05063ee72341d0502c5dce9ce4c56202f7f62f6901850894f98907acf13044279922a974bf0dbcd9ab9c82046ec2900520ef1afa9c120c4ab7bf5a", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000000001000000000000000000000048ba1dbce83ad52a"], 0x48}}, 0x0) [ 933.446970] ? netlink_attachskb+0x770/0x770 [ 933.455422] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 933.455445] netlink_sendmsg+0x8ae/0xd70 [ 933.455469] ? netlink_unicast+0x720/0x720 [ 933.455492] ? selinux_socket_sendmsg+0x36/0x40 [ 933.455510] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 933.485551] ? security_socket_sendmsg+0x8d/0xc0 [ 933.485571] ? netlink_unicast+0x720/0x720 [ 933.485589] sock_sendmsg+0xd7/0x130 [ 933.485607] sock_write_iter+0x27c/0x3e0 [ 933.591785] ? sock_sendmsg+0x130/0x130 12:45:19 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x2}, 0x0) 12:45:19 executing program 0: syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x1) [ 933.595789] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 933.601331] ? iov_iter_init+0xc6/0x1f0 [ 933.601351] __vfs_write+0x587/0x810 [ 933.601370] ? kernel_read+0x120/0x120 [ 933.601393] ? selinux_file_permission+0x92/0x550 [ 933.601413] ? security_file_permission+0x89/0x230 [ 933.622712] ? rw_verify_area+0x118/0x360 [ 933.626874] vfs_write+0x20c/0x560 [ 933.630429] ksys_write+0x14f/0x2d0 [ 933.634071] ? __ia32_sys_read+0xb0/0xb0 [ 933.638147] ? do_syscall_64+0x26/0x620 [ 933.642134] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 933.647505] ? do_syscall_64+0x26/0x620 [ 933.647526] __x64_sys_write+0x73/0xb0 [ 933.655367] do_syscall_64+0xfd/0x620 [ 933.659183] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 933.664375] RIP: 0033:0x459829 [ 933.664390] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 933.664401] RSP: 002b:00007fca529c0c78 EFLAGS: 00000246 [ 933.686474] ORIG_RAX: 0000000000000001 12:45:19 executing program 1: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) write$P9_RCREATE(r0, &(0x7f0000000100)={0x18, 0x73, 0x1, {{0x24, 0x1, 0x2}, 0x4}}, 0x18) ioctl$VIDIOC_RESERVED(r0, 0x5601, 0x0) openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000180)='/proc/capi/capi20ncci\x00', 0x200, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) getpid() [ 933.686486] RAX: ffffffffffffffda RBX: 00007fca529c0c90 RCX: 0000000000459829 [ 933.686495] RDX: 000000000000001f RSI: 0000000020000100 RDI: 0000000000000003 [ 933.686502] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 933.686514] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fca529c16d4 [ 933.717653] R13: 00000000004c5d9f R14: 00000000004e0070 R15: 0000000000000004 12:45:19 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x0) 12:45:19 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x30101, 0x0) getsockopt$IP6T_SO_GET_REVISION_MATCH(r2, 0x29, 0x44, &(0x7f0000000100)={'TPROXY\x00'}, &(0x7f0000000140)=0x1e) getsockopt$nfc_llcp(r2, 0x118, 0x2, &(0x7f0000000040)=""/29, 0x1d) ioctl$IOC_PR_PREEMPT(r2, 0x401870cb, &(0x7f0000000180)={0x2, 0x1000, 0x163, 0x80}) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x8, 0x10, r0, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000080)=ANY=[@ANYBLOB="01002200430000000000080000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000000001000000000000000a2bf0473795aad4703c47b9ed1cee5c5400040f866c3100000000"], 0x48}}, 0x0) 12:45:19 executing program 4 (fault-call:1 fault-nth:4): r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:45:19 executing program 0: syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x1) [ 933.845514] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 933.905113] audit: type=1400 audit(1564404319.499:79): avc: denied { map } for pid=31538 comm="syz-executor.3" path="socket:[132724]" dev="sockfs" ino=132724 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=socket permissive=1 [ 933.913532] FAULT_INJECTION: forcing a failure. [ 933.913532] name failslab, interval 1, probability 0, space 0, times 0 [ 933.957394] CPU: 1 PID: 31536 Comm: syz-executor.4 Not tainted 4.19.62 #36 [ 933.964444] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 933.973805] Call Trace: [ 933.976407] dump_stack+0x172/0x1f0 [ 933.980052] should_fail.cold+0xa/0x1b [ 933.983959] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 933.989070] ? lock_downgrade+0x810/0x810 [ 933.993239] __should_failslab+0x121/0x190 [ 933.997488] should_failslab+0x9/0x14 [ 934.001300] kmem_cache_alloc_node_trace+0x274/0x720 [ 934.006409] ? __alloc_skb+0xd5/0x5f0 [ 934.010225] __kmalloc_node_track_caller+0x3d/0x80 [ 934.015170] __kmalloc_reserve.isra.0+0x40/0xf0 [ 934.019855] __alloc_skb+0x10b/0x5f0 [ 934.023584] ? skb_scrub_packet+0x490/0x490 [ 934.027916] ? __mutex_unlock_slowpath+0xf8/0x6b0 [ 934.032774] ? nfnl_acct_start+0x270/0x340 [ 934.037032] netlink_dump+0x5c5/0xbb0 [ 934.040853] __netlink_dump_start+0x508/0x700 [ 934.045362] ? nfnl_acct_new+0x930/0x930 [ 934.049438] nfnl_acct_get+0x3e8/0x4a0 [ 934.053342] ? nfnl_acct_fill_info.constprop.0+0x810/0x810 [ 934.058975] ? nfnl_acct_new+0x930/0x930 [ 934.063028] ? nfnl_acct_get+0x4a0/0x4a0 [ 934.067087] ? nfnl_acct_try_del+0x180/0x180 [ 934.071504] ? nfnl_acct_fill_info.constprop.0+0x810/0x810 [ 934.071521] nfnetlink_rcv_msg+0xd0d/0xfcf [ 934.071548] ? nfnetlink_bind+0x2d0/0x2d0 [ 934.071566] ? avc_has_extended_perms+0x10f0/0x10f0 [ 934.071597] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 934.071610] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 934.071623] ? cred_has_capability+0x193/0x320 [ 934.071636] ? selinux_ipv4_output+0x50/0x50 [ 934.071657] ? debug_smp_processor_id+0x1c/0x20 [ 934.090908] ? perf_trace_lock+0x83/0x510 [ 934.090934] netlink_rcv_skb+0x17d/0x460 [ 934.090957] ? nfnetlink_bind+0x2d0/0x2d0 [ 934.090975] ? netlink_ack+0xb30/0xb30 [ 934.090992] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 934.091019] ? ns_capable+0x23/0x30 [ 934.091035] ? __netlink_ns_capable+0x104/0x140 [ 934.091054] nfnetlink_rcv+0x1c0/0x460 [ 934.091069] ? nfnetlink_rcv_batch+0x1750/0x1750 [ 934.091085] ? netlink_deliver_tap+0x254/0xc20 [ 934.102149] netlink_unicast+0x537/0x720 [ 934.102171] ? netlink_attachskb+0x770/0x770 [ 934.102194] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 934.102213] netlink_sendmsg+0x8ae/0xd70 [ 934.102236] ? netlink_unicast+0x720/0x720 [ 934.102261] ? selinux_socket_sendmsg+0x36/0x40 [ 934.102274] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 934.102288] ? security_socket_sendmsg+0x8d/0xc0 [ 934.102304] ? netlink_unicast+0x720/0x720 [ 934.102323] sock_sendmsg+0xd7/0x130 [ 934.102341] sock_write_iter+0x27c/0x3e0 [ 934.208433] ? sock_sendmsg+0x130/0x130 [ 934.212439] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 934.217988] ? iov_iter_init+0xc6/0x1f0 [ 934.221967] __vfs_write+0x587/0x810 [ 934.225673] ? kernel_read+0x120/0x120 [ 934.229572] ? selinux_file_permission+0x92/0x550 [ 934.234419] ? security_file_permission+0x89/0x230 [ 934.239338] ? rw_verify_area+0x118/0x360 [ 934.243472] vfs_write+0x20c/0x560 [ 934.247057] ksys_write+0x14f/0x2d0 [ 934.250775] ? __ia32_sys_read+0xb0/0xb0 [ 934.254836] ? do_syscall_64+0x26/0x620 [ 934.258797] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 934.264147] ? do_syscall_64+0x26/0x620 [ 934.268124] __x64_sys_write+0x73/0xb0 [ 934.272022] do_syscall_64+0xfd/0x620 [ 934.275824] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 934.280998] RIP: 0033:0x459829 [ 934.284173] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 934.303058] RSP: 002b:00007fca529c0c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 934.310761] RAX: ffffffffffffffda RBX: 00007fca529c0c90 RCX: 0000000000459829 [ 934.318024] RDX: 000000000000001f RSI: 0000000020000100 RDI: 0000000000000003 [ 934.325276] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 934.332540] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fca529c16d4 [ 934.339900] R13: 00000000004c5d9f R14: 00000000004e0070 R15: 0000000000000004 [ 935.657730] Bluetooth: hci0: command 0x1003 tx timeout [ 935.663208] Bluetooth: hci0: sending frame failed (-49) [ 937.737833] Bluetooth: hci0: command 0x1001 tx timeout [ 937.743354] Bluetooth: hci0: sending frame failed (-49) [ 939.817795] Bluetooth: hci0: command 0x1009 tx timeout 12:45:29 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x4b49, 0x0) 12:45:29 executing program 1: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) write$P9_RCREATE(r0, &(0x7f0000000100)={0x18, 0x73, 0x1, {{0x24, 0x1, 0x2}, 0x4}}, 0x18) ioctl$VIDIOC_RESERVED(r0, 0x5601, 0x0) openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000180)='/proc/capi/capi20ncci\x00', 0x200, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:45:29 executing program 0: syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x1) 12:45:29 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x8}, 0x0) 12:45:29 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x1, 0x43, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) socketpair(0x3, 0xb, 0x80000000, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bind$packet(r3, &(0x7f0000000040)={0x11, 0x3, r1, 0x1, 0xfff, 0x6, @dev={[], 0x28}}, 0x14) ioctl$sock_SIOCGIFBR(r2, 0x8940, &(0x7f0000000080)=@generic={0x3, 0x8, 0x81}) 12:45:29 executing program 4 (fault-call:1 fault-nth:5): r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:45:29 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000000)=0x0) sched_setparam(r1, &(0x7f0000000040)=0x8000) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x1, 0x43, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) 12:45:29 executing program 0: syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x1) 12:45:29 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0xa}, 0x0) 12:45:29 executing program 1: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) write$P9_RCREATE(r0, &(0x7f0000000100)={0x18, 0x73, 0x1, {{0x24, 0x1, 0x2}, 0x4}}, 0x18) ioctl$VIDIOC_RESERVED(r0, 0x5601, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) [ 944.138769] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 944.178212] Bluetooth: hci0: Frame reassembly failed (-84) [ 944.238416] FAULT_INJECTION: forcing a failure. [ 944.238416] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 944.250267] CPU: 0 PID: 31563 Comm: syz-executor.4 Not tainted 4.19.62 #36 [ 944.257288] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 944.266654] Call Trace: [ 944.269260] dump_stack+0x172/0x1f0 [ 944.272909] should_fail.cold+0xa/0x1b [ 944.276819] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 944.281941] ? debug_smp_processor_id+0x1c/0x20 12:45:29 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x1) [ 944.286625] ? perf_trace_lock+0xeb/0x510 [ 944.290797] ? mark_held_locks+0x100/0x100 [ 944.295048] ? __netlink_dump_start+0x508/0x700 [ 944.299736] __alloc_pages_nodemask+0x1ee/0x750 [ 944.304413] ? __vfs_write+0x587/0x810 [ 944.308312] ? vfs_write+0x20c/0x560 [ 944.312035] ? ksys_write+0x14f/0x2d0 [ 944.315854] ? __alloc_pages_slowpath+0x2870/0x2870 [ 944.320895] cache_grow_begin+0x91/0x8c0 [ 944.324971] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 944.330519] ? check_preemption_disabled+0x48/0x290 [ 944.335553] kmem_cache_alloc_node_trace+0x655/0x720 [ 944.340687] __kmalloc_node_track_caller+0x3d/0x80 [ 944.345637] __kmalloc_reserve.isra.0+0x40/0xf0 [ 944.350324] __alloc_skb+0x10b/0x5f0 [ 944.354056] ? skb_scrub_packet+0x490/0x490 [ 944.358477] ? __mutex_unlock_slowpath+0xf8/0x6b0 [ 944.363330] ? nfnl_acct_start+0x270/0x340 [ 944.367600] netlink_dump+0x5c5/0xbb0 [ 944.371424] __netlink_dump_start+0x508/0x700 [ 944.375916] ? nfnl_acct_new+0x930/0x930 [ 944.379982] nfnl_acct_get+0x3e8/0x4a0 [ 944.383869] ? nfnl_acct_fill_info.constprop.0+0x810/0x810 [ 944.389494] ? nfnl_acct_new+0x930/0x930 [ 944.393550] ? nfnl_acct_get+0x4a0/0x4a0 [ 944.397598] ? nfnl_acct_try_del+0x180/0x180 [ 944.402005] ? nfnl_acct_fill_info.constprop.0+0x810/0x810 [ 944.407646] nfnetlink_rcv_msg+0xd0d/0xfcf [ 944.411887] ? nfnetlink_bind+0x2d0/0x2d0 [ 944.416030] ? avc_has_extended_perms+0x10f0/0x10f0 [ 944.421141] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 944.426662] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 944.432184] ? cred_has_capability+0x193/0x320 [ 944.436752] ? selinux_ipv4_output+0x50/0x50 [ 944.441164] ? debug_smp_processor_id+0x1c/0x20 [ 944.445831] ? perf_trace_lock+0x83/0x510 [ 944.449995] netlink_rcv_skb+0x17d/0x460 [ 944.454052] ? nfnetlink_bind+0x2d0/0x2d0 [ 944.458203] ? netlink_ack+0xb30/0xb30 [ 944.462098] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 944.467662] ? ns_capable+0x23/0x30 [ 944.471292] ? __netlink_ns_capable+0x104/0x140 [ 944.475952] nfnetlink_rcv+0x1c0/0x460 [ 944.479840] ? nfnetlink_rcv_batch+0x1750/0x1750 [ 944.484589] ? netlink_deliver_tap+0x254/0xc20 [ 944.489180] netlink_unicast+0x537/0x720 [ 944.493258] ? netlink_attachskb+0x770/0x770 [ 944.497678] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 944.503213] netlink_sendmsg+0x8ae/0xd70 [ 944.507267] ? netlink_unicast+0x720/0x720 [ 944.511494] ? selinux_socket_sendmsg+0x36/0x40 [ 944.516152] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 944.521677] ? security_socket_sendmsg+0x8d/0xc0 [ 944.526420] ? netlink_unicast+0x720/0x720 [ 944.530660] sock_sendmsg+0xd7/0x130 [ 944.534372] sock_write_iter+0x27c/0x3e0 [ 944.538434] ? sock_sendmsg+0x130/0x130 [ 944.544484] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 944.550023] ? iov_iter_init+0xc6/0x1f0 [ 944.554007] __vfs_write+0x587/0x810 [ 944.557730] ? kernel_read+0x120/0x120 [ 944.561621] ? selinux_file_permission+0x92/0x550 [ 944.566460] ? security_file_permission+0x89/0x230 [ 944.571381] ? rw_verify_area+0x118/0x360 [ 944.575516] vfs_write+0x20c/0x560 [ 944.579059] ksys_write+0x14f/0x2d0 [ 944.582695] ? __ia32_sys_read+0xb0/0xb0 [ 944.586741] ? do_syscall_64+0x26/0x620 [ 944.590711] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 944.596073] ? do_syscall_64+0x26/0x620 [ 944.600057] __x64_sys_write+0x73/0xb0 [ 944.603942] do_syscall_64+0xfd/0x620 [ 944.607742] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 944.612933] RIP: 0033:0x459829 [ 944.616124] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 944.635024] RSP: 002b:00007fca529c0c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 944.642747] RAX: ffffffffffffffda RBX: 00007fca529c0c90 RCX: 0000000000459829 [ 944.650022] RDX: 000000000000001f RSI: 0000000020000100 RDI: 0000000000000003 [ 944.657399] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 944.664657] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fca529c16d4 [ 944.671923] R13: 00000000004c5d9f R14: 00000000004e0070 R15: 0000000000000004 12:45:30 executing program 4 (fault-call:1 fault-nth:6): r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) [ 944.799260] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 946.227766] Bluetooth: hci0: command 0x1003 tx timeout [ 946.234770] Bluetooth: hci0: sending frame failed (-49) [ 946.857726] Bluetooth: hci1: command 0x1003 tx timeout [ 946.863131] Bluetooth: hci1: sending frame failed (-49) [ 948.297738] Bluetooth: hci0: command 0x1001 tx timeout [ 948.303256] Bluetooth: hci0: sending frame failed (-49) [ 948.937756] Bluetooth: hci1: command 0x1001 tx timeout [ 948.943150] Bluetooth: hci1: sending frame failed (-49) [ 950.377747] Bluetooth: hci0: command 0x1009 tx timeout [ 951.017887] Bluetooth: hci1: command 0x1009 tx timeout 12:45:39 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5409, 0x0) 12:45:39 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0xe}, 0x0) 12:45:39 executing program 1: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) write$P9_RCREATE(r0, &(0x7f0000000100)={0x18, 0x73, 0x1, {{0x24, 0x1, 0x2}, 0x4}}, 0x18) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:45:39 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) syz_mount_image$minix(&(0x7f0000000000)='minix\x00', &(0x7f0000000040)='./file0\x00', 0x100, 0x6, &(0x7f0000000380)=[{&(0x7f0000000080)="de680ac990f57c690150bd3b4a8edf81db88a577ffa7a935b49e91939506c2e0aba7575730fd8fa0a49be9f59b154af363bc548403f6ae491cd521db726ae2a7bed01cdf4ac1f721c9eb38c7243255ee9cce0fc6331a07159dede4cb46944a70ab9078c92554dbd704023fcfc16a13aa8db8dfb8bc17aa008c84a0488a6840e8743d3292082f482c4bd548450f768e8a1109c8c642289692abf110120dd1988692efe6678f1641401ebfc6f77cda9b1d47c6c46e5a8c37c6bb0c96b3036ab97e229b6b2392354036a3f7388696f57caec9927f94ff2ea287414757343114a8804923f14ba601df00fd", 0xe9, 0x200}, {&(0x7f0000000180)="a88a35bb592d67f0c05a3d2b73969809c30065d294436075af0bdcfbc9281a228fa3eb396a3c77be2a69d7cd934d436b8ec5671aa14648c1e84852f0b091815f3da77c676365d8b7606dd0105832c4e1c4701d190fa7abdaf409c4f713c243e35b3af8ae40d9f0ab75f945f8a014d1ed0762ab3f7176d263ad7448fa321fda394b780f7d6ad8c3dee21ec031ccf18f938d3949002f2b0f4223", 0x99, 0xd9}, {&(0x7f0000000240)="024576021a67", 0x6, 0x8}, {&(0x7f0000000280)="5243d30e9cc4823df413d81e36fc2ae36a294614cb6e20f16a43090a0d9263b3d46285a07b75e94ed43cd33be68ff8c1d45325d16d7e45315747284e888ab75e18572ef7db6c6c6852da2f0b9e277dad5515a96e77b2663e757bab755253117006db0cd0a1be6725223ab3508992324e617f2ad6893317a5ff01ec8364fdcc685cba1115e32f5f8641550960848880902138d8dfcf22e469d4", 0x99, 0x2}, {&(0x7f0000000340)="058fba19868e83d40798bd4381e3fff3cd50689b5ff37cc2bd2de825fbe0f12a4eaceb3075184129aee6", 0x2a, 0x4}, {&(0x7f0000000780)="6406095575261564f7437a0bdaddc632917c759f1d0e73add37d330b2530aee417912ff8494b00311e95bf355c16583ce831c7fa6640ed532fe7da27986a38a91976ee16b2616f21c05a6d68a7a7bb5c334f9bf0a27223313904741eb8201c928d1f9c4b7b016def1dc63b7cce0336f3665c541a99c91a799d579fdc139bc027df9a578d6d185d7965e700a324ba6d93bda4bfafb8d025046df78610709ad73575369907677973bbd53d1e0a08b4cdba84116017bfd70fde8698e1ff12c65fe8f0b93fb86b70a7dd75871e0905d1a4816dded9bed01fb8938e080282d6066fd390c57672b4f5749461d6e8b7177b08b7ceb53a2fa254f272c809e4ef23fa14baf298259ab18fff5317be8e1b73bde82b3ccc20ab9bbde7feac4a332b9d5b3d03da0de4d904f6c6d31aa48e8c3eea12725435ab3ea0f525f43ae28cd2f7a0f9b376e1e007d357eb634c75e07a3c69573f0bc4b6608c84c51d9509549f8781e106d443cc06c866510550fa36410f47b3aacbd61fcc768a449144707b9303ee0c1efa69a1cb1cb331dd2070006c45acee04fbee361b10aa0d7151841efdce082496dad2702ed0a93b680e77051974236f3aba16b10ff1b64eaf8f1124ad02ca8921e0567ede5cf12e5706d4206bb770dfb716e894ac24d4c3810d80254587b227b92bdc568c250f95343e035b5694470c4be0616634dad917af48b15f7bea66dd87e1a43e6e474754f35e4c6de1bc8b57cecb087c54f937d0555c7842169c03df21031c9c438f049142880dd65801c761ccbef394725dd9fd5e905e26718b32b762dbef959ebb62b352dd60de6dc422eea69fa656f849fd05d224d59a5af7d9e0bb45141a2b86a1e8bd6010142f7d4eb4728349e3ea153b14258383065b72bd2ccb3cfacf691777bb632603a5d8aa5c2bf550c263080b090661c5fa9899d77d55077bea04e97d7fcccdccbfedc5a48a6458e576c212a0f4da756d8395bd3990b5fd5957612c115fa56b76ca8df3b039bdef7d347018a8766bccaea6b134077898bf516e7602c4824d29680e2449fff445e55eeb8c0e5c4b14022cc514cbf06b7d82827969cead4e95eded66bb6830b821619941bbfe455725db8b404c7fa81b7448880bc0e7c5a11545dc7a8147e740854cffdddb6c634897204b8b8fad5e719bf29235664867d26e5e3479163eed93e98618151f37f3add57c5cc14f0168d8dde03fc441088749511d90b2f10d17df051d8866bfb5e86d9f9508933bb28bba518e806723e8e0db0f2ec91110444584308001e7396f5e3d6cf646b2d69d78a40fa1d730ca375ff76d53d6a575d4032ebc61cc314a906d439d62d6205e74478691389bb27c8a79f2fa2b6fa3c4a405ed3a81d37923d8b755f0eadbf15e91e1bd58b8591f008dccda548b3caf13f6e1f67c94ad888a87acd1f49fad860bf352238a20b7ce195cb898b3227931de88ee60a6379833885a84fbfe24ff1213be32b9d901b7182018f074ae2cafacab03f087d38b301db7e5bc882222c601c008f90efab0285669007cf87dd624a6e123f56bbd7b54f86940227f82b61094f400a4ca1bcb2a5683677f47a133c8c9a20b8dbfa7a8e8bb193b3f579eae96d2c88e11f700083924aa4fba7aaf28a2deec3d79ed87108114d981c1dd399f8def839c76fde60b709686f4d2118f495624209abf664aae482d28133565c9912970006daee3ea0275e65cd0325601fd72eb50dcc2fbf914827f9c91c58d177dae75ff366232b9767ca3e23b4f72b916ed80ca08ed0cb3a87bbd270c97d33b1986d548ea7437fdf87eb1720807799fc05e9a4bb07db77b709679e1ba51930d21a50fef1719a45d008ef95f99b92a6774ef8c05c3f8f0a957362831c88e5b405cd361e0b37b894625f9a71f7c6809b18a31ea4bc0fc3ff3589bb464c64b90fba99c3872d28f72ed3ff5bdc7178fb76d6f1cccfc25b8c62cb40de655c8bea5222d7314494a2702072fb3a8a3dedc559d7a29171aafce964300e614910d98529bfab3328b4aae15df1945e85d41542f3b6e19a32e702f6083fe218fce79a2a78dec0aa52688739d4789738936b05d868259431b7e184cb3017269359b453dd2eb0991ad9ddb961489797ba6677c6dd4bce18fbfb944ba92b2ba5eb5124178bc68ffc9c31d42acfdae8ad945f48603042711bffca94b183098ca29c842df4ca4db75e1bd0f92360ef0172212035aac4bbe7dc569b4f50454253179b2d217efa91542664d1ee78150a8027636b5fda3e3e77d0be657c2a9f81df3ad842ecc4e5ca85f113cdd9ee4875faa27b5111c5effb275db7ac1613236a986727e184b138ddc6c812f8a2ede92c7e4cd2efe453d6dd2d2da1f183ad2fa8d384d6b8e5f67fe78637ce92014bdc9476c5650150d061529bfa1955681b66c913312af297fc1d6e54c020ea3d23b4b2cae55a4f74ec144db56b6acb1b4481a452f458dc47608fb34182c0ba98f0f4dbc3a97138456c0edfb8ee77deb17c91d240b8e55282959a77449d1125b3042a19e2251e4a9e4520705bf23e95edda9f7acf7b8015929eccd955182bf69582f02330db0869875364da14e613299d28e2f227397bfa4c9e8c3c96df2c4a01627becba1d45ced2289a8c002c330560cf434f823bf9e434cd1defd6d5254d0ccf9a6f19ba51f8d3545ed1d07fa5dec5b5560f8f623086f62af6c205884ca92db0590363880d218d1767b01ccf987f3831e88e9fd0cfef78da17dcaa533bbd294c3191f87df6ce7f6691989a94ec7aa1d54b121e321ba16609e01bfc5f81367e5f3a4ab86f1d9c6b8372f460118ff335c9967003995ab6db5f4e3724f6bfff7d8b64f4af9d8e86ca1cba5765d3046bb7826524da34f29211da85be8afc073c89a2ca8376af3eb977c5895158eecff838b90c69fbfb2205d4c8be0f30f654a72d17af0812081eeb1b6b06e26d96c00d7b50c30759c424cccd647215633fcfe0d30e717a99e1aff3b119ea4a4582cac095aa9d9792957e69d65def2a88ac6e1720309a3bed169b4244651f8f0bc69fc9fe8fc91711b63e7ffd9da2163fec40af0226946781b0827631bae6de9e5c238c0972f2bc1b0ea52e9077b8bbe671a186e74d3c78a6034c2fc9a7088fad58b8b7d7b8de00dcd0b0e38355212789be52c658ea5b35b489833d7756051769a40ba759a1b9d2a1e040925da45149bc831a32d12ee604bcd6893f1aa23c7b64c6e833ac9d2438897646748d39f4409f347515a79416ebfa4f364372732d11b894416f47e06bddc49191d6b58533ee1189c8fd2bed6bd74f563a96f1e906637a9bc16febaecc020c7ad4664b9b2e48753e51690e703c86b0cb0c7a28cc443b03eb1e715d74e0c2237f4422895b912ed756b87dd4bfc47fcca0d00caf06de3b2cb7325bf1cfbb69a76d3c2de1013e749727cd354ceeb309e21a1fc5c35277c6fc4305edc7e528cb90fdaadf04cdf77dbdcaa624fe755fbcc960cd87473b03c8e8197712462a9cceb4afe770fcd786df64d2a5c5776227e7bb2ed99447e226f1973f8d287bbee9da97f51089687e280a9fb65d2957a2a52d6aaf01cdb9b5546e0954f25264c9ad85e58cc5f219228ed6cea084118fde2f2ca67034c5db1ed28ed57bbf26eae2a6352e15e0ac5d529f196139dacfce822b144cd23e0d5a2879a40fa17d0eb6b26d6f709a0d15f630202b5a2a9b4eeb50a36baf9b01ae7305f2942b899a08eb739506cba35d1e44be8acf271b279814280857616238bbf802bcea1d975ee136e119b06afeb6b4d56d061f31716e6f63a0c7dd61b6585798f7f3ac0b673548960ff60cce16e6dd3a4577eaf6bc23e8ec496fb2bd30e16bf8ef084d00788b3bdf9c1ce24247ca93d526658c655630a742e05679e54ff23be60c5682a6049c94554079399df9aed721e9f856ede7de9f5f10166b8b2a6b52344f5cb666b34256ac5a5ec02c1fcda24572714aefbadbe99f9142538921ac8f9911a22c3f87686bda5ddefbfd6763c81b0c465c4d3842180136286abeb14368025269f8cd7ce124618854dd048d748ba1bb62363719d45e3dacc71a45f9d917c822ab94f2425e37dc1f892cd1f60f8ed8674681c8a09f41acf25f9f45f1e6cf9161c03363788a6f887005ccf8f338ee413bf0de73e6947ade92b86916a595a8addbd080bb02d14a1e2fa2d448462c93f2b73078da6cc033b8c296a6d7da811fa98e808bc6053d815dcd0b9331f1536ac78a1defa3b8f66feb940be9932244799aa3618243a7a222670e4a0de7117de34d1470fdba6339e983085a6b53bdcf6229a9a0f4a9f3c5968477ebb759360970103bcd0a710cd830dbfc072820e99714ed493b595456cd22143c50070360a299672ff116fed55cefce02459a2ad6fbabba41fddd9bca60cdc6eb10c05fdf3aabd62a6cf9bf1a9638d716b5bf7c164b2e4106197b9b296c3927db22aca70bebf24a47097a458663ee160b3c3fad16bbeaadbaf62c0d87c77a3443278da5369e3412208b317d4e3848f1b39442af26f09306cadff07ff0e55b2d3c02290313cb8be8ce073aab4641cc9ab19b527f49e49f99f55b6bf27475abb75dc9524a24e8c5ce244da796edad41b956246cf56abd5b7d74742b76f2aa2d40f55476d849d729e6a0b2a2f3a21715c33edbbbb44f7906db30b08c54efabcff9791518824a8b09b7a18497b0dddcb1efe43a98e84a91f26f1878cd730c48a7dce8ee496ffb8d7c4b42d5a0bf950e10026aa63546f5ac88a5bda2a71b9b69a230474bd393c9ae2d85a2a8ebb56a69bfdded569bfacb217efb22e0d3acf171328335e6d1df49b890a0b241093667130bca6a2ebbde439b8513fc733901ade23e3be507399700eec6e6e40733645f9fd8b06cbde63ee8ae90968c2958ae5e62a9d14680a8d023a2a24e7901070a444f12f7e4465812dc3b83be9463097d098e2ddc23ee7d488ed8cd06e077241c81c612ae06ed1f5430f47a379e57b120115d25c1bf232d603e58fe876e42e8021b6d78cff96e6b2c6df284f5b7217da5d4fc253576132401e0d36bce1ba99ae915136492802fece3035a2488382d5aacee5f3a8eeb777c9a4ba5597c7cf81c86797c244bd8c2717bb475181facd5195851b7652e5c689d56b4e8e99d16bb6d0a4574fcba8ab29f81533bd7d726a742df8b00ee37b994bfc1f44b31aab83d61e085324d3e8a5e17cb665ea5d9ec1ba560039927382a61222c70ecf2a50503720e5e8db030718f320092bc9908e4b1a30dc51d56b3c13d0db5699474caf375d863449749c08705fcbf1b51f3b857f49c30767d66fe2a90fd640ede75dab81ea88fe0e7943918638b83f46976780d0c84abd3fc0a65d5948255f275169ac2dfd4ff686a4ed95601d24460c16fc9675eb2d8f7669aa4d212618ef7f9db430ce1ccb3e79196d6d0d8826df6707d511977ac0f5ec0cab25be26a11dbd92858c5efc4484a200890a3587cd7479722cdf0a87f0f20a6bd29a05faacb52de5bc8d24fc8cb6f678aa3fa182cdccfcbb41a5d93104cb6156e75cfa334ea1c5ce3795bce5810bc3ce0d272528cfa63e6aa5a1385a07e293d0f361cd3ce0348d299e8bf8ccb4a6e139b91ee6fb827c8f992b057ac1f0d7800be077c5512fbaec0324bb1c0770d7784fb441a5d27d8e6d88fa7abd722c9e4872a7fa768d53677abf2b609613b03538247d12cd66f30ff83e2624df11046621f138930420a9c72cb405a8f4060d43bacbc6713cbc37af4930b92c41b8e3362124b955a0ed1f5f7030fe8ca7e6907281a6e8efb2a354db", 0x1000, 0x1}], 0x80400, 0x0) r2 = syz_open_dev$admmidi(&(0x7f0000000440)='/dev/admmidi#\x00', 0xd4, 0x2000) ioctl$KVM_GET_TSC_KHZ(r2, 0xaea3) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x1, 0x43, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) semget(0x0, 0x7, 0x8) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f00000004c0)="0b71e1a0db03b89cfc3f87c35601aa7fe95bc96484440e52ba6b67b367fe6bbcc59eeecc8afbd632742200c29ea4d78e7f89e4f828860f236bdd8d52cf1d331f80a8bb67d00a296a96bb4b6547274bb48ba1bd67627769768e2f4a0020e65bca4d8ca2f2c14187347d50db7a80c21c5a4ddbf344b851d85dec1bec13e9c7aca72425ef2d02df228e765b00f7ed4125f951872529d490bd4251c225e35e192607da411813d0f695e0f189c8ed2caabd2c2ab56bdfd47eacb67dd66aeef749f08891fe88e341c3046608e5e864fbdd64e761e40c2157aad4b846a6ce97829dfc7446631c139102ce0d3968576784fe44947c98615196c900f85ffc3b1b1f1074e4") 12:45:39 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) [ 954.341507] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:45:40 executing program 1: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:45:40 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80002, 0x0) ioctl$IOC_PR_PREEMPT(r2, 0x401870cb, &(0x7f0000000040)={0x0, 0x1, 0x1, 0x800}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000080)=ANY=[@ANYBLOB="010000004300"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="00000000010000000088506efc000000b53dfc13f2cc097772937a359948ba1dbce83ad52a"], 0x48}}, 0x0) 12:45:40 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x1f4}, 0x0) 12:45:40 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="0f0000000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:45:40 executing program 1: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:45:40 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x1) 12:45:40 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x3e8}, 0x0) [ 956.457721] Bluetooth: hci0: command 0x1003 tx timeout [ 956.463106] Bluetooth: hci0: sending frame failed (-49) [ 958.537851] Bluetooth: hci0: command 0x1001 tx timeout [ 958.543264] Bluetooth: hci0: sending frame failed (-49) [ 960.617786] Bluetooth: hci0: command 0x1009 tx timeout 12:45:50 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) 12:45:50 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="520000000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:45:50 executing program 1: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:45:50 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000180)={{{@in, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in=@local}}, &(0x7f0000000280)=0xe8) connect$can_bcm(r0, &(0x7f0000000480)={0x1d, r1}, 0x1a6) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x1, 0x43, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) r3 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x0, 0x0) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_LINK_STATS(r3, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40050002}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, r4, 0x200, 0x70bd2d, 0x25dfdbfb, {{}, 0x0, 0xb, 0x0, {0x14, 0x14, 'broadcast-link\x00'}}, ["", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x4000800}, 0x40004) write$UHID_GET_REPORT_REPLY(r3, &(0x7f00000002c0)={0xa, 0x3, 0x7a1d947f, 0xffffffff}, 0xa) 12:45:50 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0xa00}, 0x0) 12:45:50 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x1) 12:45:50 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x1) 12:45:50 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="c00000000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:45:50 executing program 1: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:45:50 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0xe00}, 0x0) 12:45:50 executing program 3: getgid() r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) r1 = dup3(r0, r0, 0x80000) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r1, 0x404c534a, &(0x7f0000000000)={0x17, 0xffffffffffffff2b, 0x3}) setsockopt$netrom_NETROM_IDLE(r1, 0x103, 0x7, &(0x7f0000000080)=0x6, 0x4) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[@ANYBLOB="00fffff64300fefffffffffffff40000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000000001000000000000000000000048ba1dbce83ad52a"], 0x48}}, 0x0) [ 964.661675] Bluetooth: hci0: Frame reassembly failed (-84) 12:45:50 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="c00e00000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) [ 966.697725] Bluetooth: hci0: command 0x1003 tx timeout [ 966.703237] Bluetooth: hci0: sending frame failed (-49) [ 968.777773] Bluetooth: hci0: command 0x1001 tx timeout [ 968.783189] Bluetooth: hci0: sending frame failed (-49) [ 970.857786] Bluetooth: hci0: command 0x1009 tx timeout 12:46:00 executing program 1: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:46:00 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x3f00}, 0x0) 12:46:00 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x540c, 0x0) 12:46:00 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x1) 12:46:00 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="effd00000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:46:00 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x1, 0x43, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000040)={{{@in=@dev, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@local}}, &(0x7f0000000140)=0xe8) r3 = geteuid() r4 = getegid() getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000180)={0x0, 0x0, 0x0}, &(0x7f00000001c0)=0xc) getresgid(&(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000280)=0x0) r8 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x5, 0x1) ioctl$sock_bt_cmtp_CMTPCONNDEL(r8, 0x400443c9, &(0x7f00000003c0)={{0x0, 0x5, 0x8, 0x7, 0x1, 0x9}}) r9 = getegid() lstat(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fsetxattr$system_posix_acl(r0, &(0x7f0000000380)='system.posix_acl_default\x00', &(0x7f0000000400)=ANY=[@ANYBLOB="02000000010003000000000002000400", @ANYRES32=r2, @ANYBLOB="02000200", @ANYRES32=r3, @ANYBLOB="040000000000000008000600553eafc9166bc3f2a2ad8417", @ANYRES32=r4, @ANYRES16=r5, @ANYRES32=r6, @ANYBLOB="08000300", @ANYRES32=r7, @ANYBLOB="08000300", @ANYRES32=r9, @ANYBLOB="08000100", @ANYRES32=r10, @ANYBLOB="10000100000000002000040000000000"], 0xf, 0x3) 12:46:00 executing program 1: mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x0) 12:46:00 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="e03f03000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:46:00 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0xe803}, 0x0) 12:46:00 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x1) 12:46:00 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[@ANYBLOB="01000000430000000000000000001700", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000000001000000000000000000000048ba1dbce83ad52a"], 0x48}}, 0x0) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x8000, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r2, 0x6, 0x15, &(0x7f0000000080)=0x7fffffff, 0x4) ioctl$TIOCSRS485(r2, 0x542f, &(0x7f0000000040)={0x3, 0x6, 0x800}) ioctl$VIDIOC_QUERYMENU(r2, 0xc02c5625, &(0x7f00000000c0)={0xb4, 0x28, @name="b54a69a36c64320d6b5b6c2edb374a077f83b658fe1d43d73969905199d0adce"}) [ 974.902718] Bluetooth: hci0: Frame reassembly failed (-84) 12:46:00 executing program 1: mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x0) 12:46:00 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0100200107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:46:00 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0xf401}, 0x0) [ 976.947729] Bluetooth: hci0: command 0x1003 tx timeout [ 976.953148] Bluetooth: hci0: sending frame failed (-49) [ 979.017792] Bluetooth: hci0: command 0x1001 tx timeout [ 979.023196] Bluetooth: hci0: sending frame failed (-49) [ 981.097749] Bluetooth: hci0: command 0x1009 tx timeout 12:46:10 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x1) 12:46:10 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r1, &(0x7f0000000200)={0x7, 0x8, 0xfa00, {r2, 0xff}}, 0x10) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$KVM_TPR_ACCESS_REPORTING(r0, 0xc028ae92, &(0x7f0000000000)={0xfb78}) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r3}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x1, 0x43, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) 12:46:10 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="effdffff0107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:46:10 executing program 1: mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x0) 12:46:10 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x540d, 0x0) 12:46:10 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x1000000}, 0x0) 12:46:10 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0200000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:46:10 executing program 1: r0 = syz_open_dev$usb(0x0, 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:46:10 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x2000000}, 0x0) 12:46:10 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000080), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[@ANYBLOB="010300004300"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000000001000000000000000000000048ba1dbce83ad52a"], 0x48}}, 0x0) [ 985.120116] Bluetooth: hci0: Frame reassembly failed (-84) 12:46:10 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x1) 12:46:10 executing program 1: r0 = syz_open_dev$usb(0x0, 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:46:10 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 12:46:10 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0300000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:46:10 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x1) 12:46:10 executing program 3: r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) getsockopt$TIPC_NODE_RECVQ_DEPTH(r0, 0x10f, 0x83, &(0x7f0000000080), &(0x7f00000000c0)=0x4) ioctl$BLKTRACESTART(r0, 0x1274, 0x0) connect(r0, &(0x7f0000000000)=@generic={0x8, "a1be90a48154b8eea4227ca8d25c455f21c9bafdb305ec2e07077ea5ed102df789de3dec9bc5b062cd6b14e04fe88811e1c0211e6b54d61134aff6408ac3ad808bc495de2f520142799a965ed3f587e2be0a3555b60c2990ec8d1b336c79eb1c01ca8e084d82ada8c8ada17a57d524c8d105df589cdcaba931c9a68164fd"}, 0x80) r1 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r1, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r1, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[@ANYBLOB="010000004300"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000e2ff00000000010000800000000048ba1d3ce83ad52a"], 0x48}}, 0x0) setsockopt$inet6_MRT6_DEL_MFC_PROXY(r0, 0x29, 0xd3, &(0x7f0000000100)={{0xa, 0x4e21, 0x8, @empty, 0x200}, {0xa, 0x4e24, 0x2, @rand_addr="26c897230b6d35641d4d7f608722144e", 0xe0a8}, 0x1d5, [0x2, 0x1f, 0xfff000000000000, 0x2, 0xa9, 0x6, 0x5, 0xfffffffffffffffa]}, 0x5c) [ 987.177733] Bluetooth: hci0: command 0x1003 tx timeout [ 987.183257] Bluetooth: hci0: sending frame failed (-49) [ 989.257759] Bluetooth: hci0: command 0x1001 tx timeout [ 989.263336] Bluetooth: hci0: sending frame failed (-49) [ 991.337812] Bluetooth: hci0: command 0x1009 tx timeout 12:46:20 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0400000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:46:20 executing program 1: r0 = syz_open_dev$usb(0x0, 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:46:20 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x1) 12:46:20 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x8000000}, 0x0) 12:46:20 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000000)={0x0, @multicast1, @broadcast}, &(0x7f0000000040)=0xc) sendmsg$can_bcm(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x1d, r1}, 0x10, &(0x7f0000000140)={&(0x7f00000000c0)={0x5, 0x5f568f5442d84a12, 0x1, {0x77359400}, {}, {0x1, 0x7fff, 0xff, 0x4}, 0x1, @can={{0x1, 0x100000000, 0x14, 0x8}, 0x3, 0x3, 0x0, 0x0, "5f2f334c15ab0e6f"}}, 0x48}, 0x1, 0x0, 0x0, 0x4004}, 0x80) connect$can_bcm(r0, &(0x7f0000000480), 0x10) prctl$PR_SET_DUMPABLE(0x4, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[@ANYBLOB="010000004300"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="23e246ee6f301665"], 0x48}}, 0x0) 12:46:20 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5412, 0x0) 12:46:20 executing program 1: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:46:20 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)) ioctl$KDADDIO(r0, 0x400455c8, 0x1) 12:46:21 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sync_retries\x00', 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000040)={{{@in6=@local, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in=@broadcast}}, &(0x7f0000000140)=0xe8) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000180)=r2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r3}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x1, 0x43, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) 12:46:21 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0xa000000}, 0x0) 12:46:21 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0500000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) [ 995.361963] Bluetooth: hci0: Frame reassembly failed (-84) 12:46:21 executing program 1: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:46:21 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0600000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:46:21 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)) ioctl$KDADDIO(r0, 0x400455c8, 0x1) 12:46:21 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x1, 0x43, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) r2 = dup3(r0, r0, 0x80000) sendto$isdn(r2, &(0x7f0000000780)={0x0, 0x1, "d14c6c1cedddf787373251e4ce65bdaa6c5ad199cd13eff9cbb6b5889987dab214ca1bd20b6e058852ae3b6f0021a46bbd03663246abe35151e1075c2548f62856af2ad37744784a572f3dc931560200fb7bcb45f51ae9629d7dcf4bb7311a5d12842666990c4b035fccf0b25ac61088118b1a897d083f432a29fd7d9eb55bc9d73a5926fdf2efed71da71d043fd7e44081399a02dc84ea9e3efa27ad9f3e481befa7416f9fcd935bd87afbf29983ffadf20f745be7b30feda1ef9901dd99fdb8dc45c67286c2cf60d49297392338ce4f0170b80f6e213202a7795b310f49e6cc2ed8cb9733a977f3ede7d9232ca857af341f881695f6ee73128ae5e597dbf69c2aa2bf1f5a71ef91ad6eb765fc934a9504eb34fcb85b15c9d0f61fd1b3c14661945872d2f49d4c6e1db5148d0bf4f71d51f38503729bb85e9dad04fbe49622fc8e9591cf9f8ee1d642734914c7ce8494cba661b441fab8873ea3fd4e3c82c15819d7d46a106484e0c55667595e71ecde014720b9a6f16543499db501babff6692d00239acd6781e6017dfafae1209cbe270338887be4ba690e29925b25a7d3039635e58e8d2d528f7daeee5f1138ac0d5c74e214033a1a87169f546c8a92b2527577008fb23686d60920c4d1f7a9cf9e5cb383d7555bce7fd89b715bd26455ef3cd985343db302594524f471df71b3b0de360a6d39ec2c978f1de85e59f8e7206be1457b09cac84923f97de348669096d54aecf4be7d51087b1bc75d17a13cb51d22b799979f5dd3463223750459b425e4cc8ddddae3c329fcdd4bec61da7cd5362ce12eace547560b690ce9c589a233ddb6daeee04816bc0084e20ede9a2b996b9d654f83ca7e3bac5cf0e39a072997052374b5990001305c2dd00fc6f9a3398fbe67e79a0f769026f08db71bf16bd69f80248e49028c900677304f8a43a607a0d43aaccff09a2d6cdaccb7cb55a78ac05a85372d23573a6c726a5160c709c44fc2ee82e8b370175621c500cd9323cb041e1ed113a6792975e10aa027a4473343ff1363065422ec26e5afa123c6a4e718c6dc61c9185131536cc283b0179d93581f959a3add37f5127b1071e259a6d92fe03d2d3e19a86a38cd0b5b8d361f6cdcabcd73c77dee359b1244ea95d5f04e35d52225cad9a1f55ca16322befb25e30eb053c17752d7b111c5f06894c989b0f4ce3387258b5859d0e14e94c5bc15cce69cc63560dfe9c41ac7eade92193f2084908a1d9aa9944f31bc2ea4a4d078cdef77f67952e56e1ef560aaebf4ce16f53d04c1da73525e144d3bfc725d4efdea6c314fc40d3ad8cf034f9bf81e0ed871ae12887ca78887d8c16a18f94a9cadb16294b495aba2042c90c3cbb8d35d951b1b707c95745df6b9a51b238fc0c3fc40cb37b8dc48959c7a9760ebfbc0c4627e367c779f57b0bd2115b940c54906da3b1cfe45598f1ba7dee041cbe3cc5c24ea184a33a8d455545e9466e7ab0494bc2c50307fef63b4efb19afd9ef3054cd47c10607312cf95fdb6c10c6e275efbb52d17bb196fe8cd22e72a411342a462abf419091d9dad93fa66defa245a617be9e5a23a394d41edd48c435ec4970b5652eb17c39184a2c1d854dfe214f28fdece5c534c3a11acf88cda815521330e69065d9a7d45d15d161f5aec314d1cb671a35d222e337ecfbaa8597d4a25b1fbff72dba13720300c23e6e943f55e6a9249a8440f13521c3715c42435b24da2f06423b2e4d75a5da5ace2504a70c382a2769724d973581694faee2dba32d23f812c9a8bd0efc5f1dec525a2f1d7b0664f76dc03427129478fe1de1a0bd2710c2af0819a95a235727ce65604414a933caad62074bcf6cd1c6c446cba705977b53e385fb04a6f018395dcde55a2a59dc6a74c70187b33d37966e272149c60bd91fdf3d2dde3e41cd2783a0e8653ecd4c36a32060413bea3586ad5890cd1ff6c06b4084519d5df676756fa580d595eaa41cd1ac33f86d54759028107737724dcaad8701cf4217561f4eb4efdd97be487e02e244c050dee3ecd2434d72120eca9d1d63022981b65a5590a2804893acbeeeb7e01cc5978777c811ff5e801a13ec3e073d16a3cd49920ecc5db64f5e05466f2836932132adb40ad4303cbe7c0e55cc850c97bc429ab5ddb68f30f3b59a6a52f8e7f1706cd20b3d32cb79428f28ddfce6527f87a25daedc0c007baaf8414dbbb98c8b1e43f5a37e1248102e6d80cf3768a4fe13be5298c316a630e11c593d938892a792af7f33b5a19325775c68e916e9b09bab684f2c32b3a241397dddd360698c83effdc394dabfe2008eec81fc0912f8f2c1e4e475777adcf341d73c99a70ab6024a54a55cecb2c36abe2faf841af9e9196e39009f806eef047d88fd55c2b969d9d24bf4ae54ab21e36182a9f272c42ca18550e2b8bec511e9bb62b55470b5dc025c4d254a2f736dea457d80f52ea41d0fcd42d0a0c1f52f85ac7f3c63143bf422dcd790eaadde542a5e64b1187655b89c6cc9070bcadc3526ea8190df21339f4169de25d1a1d86115c7c757f68912ef15ac84ded60bff70390e81e40e862081d6bf78d77e724e6943be061c1c7cc2fcc7b96cb89a7dd9e06e14d57ab9fa5fd2164babf4d30213c5880b84497d35a6523b65a0abde51a2f3ed5595d76e4d0d5671d0d27be3a530d184e1f7a4ee950f72a52c49211abba8244245a296b4c7b674ff3d9151b63b3cc1a89a476eb7ec8a90b206f045bd964a7fa9c5e8898bef8ec0eba021773736ef96114d4394d674a2f796b8108cc1d6d84b09489f4ff62915e58ce3c13b173f6c1ea1b7da5976bfb13a2da0ba449cbf9e18eec0db682512005150083a964630ea05a6bc1ecc06109c3cc465f42eaf3962cd32c21cac2f1b589979ec4badf4dd0d2aa838f94c2efd8536c9c31f397b614359aaa9738646ae6a2eb5ac34fba7e70b5ef154226e2216c43724a3090be64bcf04b8a2c44c8b45b3551efa6721c36fae159eea222b463e06f68e58e561d18a9243b83ea6ef9c751d97c2a737abe8101c1c367c7d72d355a08cde132e8157f0a6ac7b7c234460a7229b91e921ec9f2c04b853afc571cd1d6bb488be8f2915cde16ca2c5f485013f7f3222618624fb5f2a70f7052dd2a075a02a6c54f04da9ebd830cf8f2b17f4400125e6937ba46781b8d9d9f5c99c58082108a671c836b2921c5f6078f373008076b484824517304e8309d71e6f5f821efb19bf8a08d916b520ee822fba738fc079750e0f59a2835b5a452eb56b0f1ef447fa1fcacf036bbaeff6e50aed4dbde3d9889317e86a68eecf2e9f272a69b4ebcb79fbf87dd4bd9c17900a709085835e0be613fc34f4b9c49ffa621d53ddc2e1fe4fc1e70272eba0a5d400207b024c7ade48606d7eb703a9eca80a80969c79ae65324446860db7e781562ab8608bf9f4d7764c57ebacf4a559e96b819940c122a3ea54fda2bc6a790d72cc29297f6b2cef820033b2632c28926a77270e71baa791bb97c30c64759d5317c58cdc9c20aecb11fb3ecfd3f3dabc5c12c6331aad04b2a7512fb495600fa6fa1e7c8b7e640f7c214538c27e72ef53c4f9a8e7ab608b1028bb74c703ae7bcd2ccebfa7fb4f11dfe7bae001400f064b313cc6c390e831b7102d1f9c1a785ba6648dce04613934d9d4dee005e743d7d991adbf63630c6e1d07284d5b84290607bdee7a8f4f7bb43c1c81368ec404a8a2bd4d293c97961f9acf4c082ae42d1c92d2bc7fca83f81b7b773c0d94f650f8cb4d0dfa6daa00d1b0a80c80a6f919470396527e07dc4be3dc1bdf78422df5c34672aa4c2683a2bd2bfb1a5663d2f8c4aa128c30cd24867477c2e5bc1e652b188fab5def5470be72237edbe69583edbe6b4ba81d17abe7d83f5462ce6ff47591b9899442feb0f2c03baa2529bf27c4998737d8360b94c1cf9f4390721c54c264c8f9aae4ed599ccfc305dfd562d74b545bf689ee2de8eadfbe33894198c262d8ebc532fc924870ef3c4b3baa2eaa2be8361bc068deb8d0e9569ea3a9c4039c30348059576b5d6a5a3c8045a617b8795f37390aa03364e48222a1896e658cd3ac10dfdb5eda126e77cefba68910a579249724ed079ccc570f95a9dfa5aaad3f8862c087288fe97740169a420b1000b13feeb058fb472a8ed95a43bff4ea0ee8e876a2be7ce8bbc7175cd8135d4cffc90c5351e23bd2aae1ada43ff74e4a1c9797be0c2fe00e900684c439a9e72e0906d1ec8fccd9f2a0ea9cba83eb599d982dda6676cc3eba90594c0b839ae9dc27dcf7e8e442f5cef7a4c936880111d6b3cd1d83f3b97176ccb665b9f441322f86cdcfd79422d46359858b51c43892388effdebed31d985fe88f7c9a55f696a50e60b5f0b1510f98b2f63c01378a0a7e2184e74449e2f4828bbc8391a8ce583e2413422b53fde5d5cf6ce77c81b8072489a7cd2431e1f14c93f0f5abde1651711307a1d9de9f835929234d5e88dca7ca20acc556d3ebb09785fe0f1fc2c97bc02208e6edf08e8c8ac81d5115f47b47f253d88ad19c70bc5f5498ace182911a791315f0a6651d4ecc63700433dd0ea22151a76bcaa17a1fd268c97c7df04721327839296a7b8bf96307ac81fc01463dde7e02d11efa893983f2729b44c6039253b6df3170b9f5d31b06733667eafcdc16d1ea22699231697870b5d0c450de64e3ce7777300f238796fd412d279eb05f985a9e5c7a3584764521cba80a2caacd15264c6a2967f1354447c0cfd0fd24668a1ba01a3f85f350bf8a7232e62761493242ba0c1f1d7fee88445a5cc6211beaad0089db3cd637eb3e729f30ec5c571adf70de03c3ae1f0fd93773ae28341faf14d4ecf3660cda31ccca18609999330b51f508e2e1173cc968686f54adc36b8d7f5c533d674648f9e9f4235ad25a9a92006cb30fc4db3da32043d6bb4e6bf1f6a74dc025cf82c3f7603bda3effd9671f489b763f90b7a817ec2a785f265c95f2cf71019be9f1a41ae2db48c31b3e0c573d90bef18277f5d16311ccccde04bbeda03c9f55d42e35dd8fe31dd00f7b4749dcdfde3e734ccd0413591e5910bc9f28817a6636835fef31189d810567d186df699f2b8bec470e76172fbe862cf58648664300b3e1f6a6abc59e93cb536be7018d671288ff827ac2486353a9bae83838fdff603dffd88ff6ba3faa145107544a717bd061705eaa9b44c4fdf0f425ee8fa9de4e9cd6e1477ff769b30e041fcbc5bd748adca4b81b73e3c2071a9723a4b12cd6dd4d2cc40cbe5425ec00fd7b1caab2939f7e90642c1ec855db9fdc8a62bf1ca739d740a5cd89371139829964bc620aaeee9a036f061d20848838c7dc80313ff460cd127b67409cea399821efd85614d858ee8c777d2ee3002c5db79786ffaa161a8f8df3335425fcbdad4f701f3501b52c45baf17c0240ffe750ad1e1d699a844ba8dfee6c9f6cddd69b4a57ded1a1baa3d0b10f595239c41e7e07ad0f655e6b714a85768192688acb024d2f87dafe4674716cd6c9c1b238d5fbb64f48fdd3778a7c1a30ebf233fd3418f9984d1c077576904d225f26f3fb6cd1b30267eca510d84a97f4d5f0bc106d081d9ff304b6f5497804c7168bc6b839840c288556e05e8fc9619808dafd56f4ee41f96dd6f4e7e2fc6babb29502af82b2221866c9ab3c6edb54c84f6a906786c8fb33a5422ffaabfc8560b5a7c0aabf62b7b914d136f6a254a6dea0d2e739e422d2fae7d22747d742e44e45d0a80b3ee65c8d7d58b26715bf35d4716723065afeb85229866b5e25de6bcb965498fcb80b194066c6"}, 0x1008, 0x20000010, &(0x7f0000000000)={0x22, 0xe8, 0xffffffff, 0x101, 0x3}, 0x6) 12:46:21 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0xe000000}, 0x0) [ 997.417788] Bluetooth: hci0: command 0x1003 tx timeout [ 997.423205] Bluetooth: hci0: sending frame failed (-49) [ 999.497875] Bluetooth: hci0: command 0x1001 tx timeout [ 999.503744] Bluetooth: hci0: sending frame failed (-49) [ 1001.577809] Bluetooth: hci0: command 0x1009 tx timeout 12:46:31 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)) ioctl$KDADDIO(r0, 0x400455c8, 0x1) 12:46:31 executing program 1: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:46:31 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0700000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:46:31 executing program 3: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x200002, 0x0) r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000180)={'vcan0\x00', r1}) sendmsg$can_bcm(r0, &(0x7f0000000100)={&(0x7f0000000140)={0x1d, r1}, 0x10, &(0x7f0000000040)={&(0x7f0000000080)={0x1, 0x4, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0xffffffffffffff58}}, 0x0) 12:46:31 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5413, 0x0) 12:46:31 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x3f000000}, 0x0) 12:46:31 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0a00000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:46:31 executing program 1: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:46:31 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x0, 0x0) write$uinput_user_dev(r2, &(0x7f0000000780)={'syz0\x00', {0x0, 0x9, 0x9, 0x5}, 0x4d, [0x401, 0x2, 0x8, 0x4, 0x7, 0x101, 0xffffffffffffffff, 0x3ff, 0x0, 0x0, 0xff, 0x7fffffff, 0xc9, 0x3, 0x0, 0x7, 0x9b, 0x3, 0x0, 0x3ff, 0x9, 0x1, 0x1e73, 0x1ff, 0x0, 0x10000, 0xfffffffffffffff8, 0xfffffffffffffffe, 0xffff, 0x8, 0x2, 0x2, 0x7ff, 0xffffffffffffffe1, 0x6, 0x4, 0x1f, 0x80000001, 0x0, 0xffff, 0x2, 0x2, 0x6, 0x2, 0x3, 0x0, 0x6, 0x0, 0x0, 0xfffffffffffffffb, 0xa1, 0x9, 0x4, 0x8, 0x3, 0x6, 0x8, 0x401, 0x0, 0x3, 0x80000001, 0xfff, 0xfffffffffffff801, 0xfffffffffffffbff], [0x80000001, 0x82, 0x1, 0x0, 0x1f, 0x1, 0x7fffffff, 0x6, 0x7ff, 0xfffffffffffffffd, 0xffffffffffffff00, 0x1, 0x8, 0x8, 0x6a89, 0xf6, 0xfff, 0x3, 0x6, 0x7, 0x20, 0x8000, 0x4, 0x1, 0x5, 0xfffffffffffff801, 0x3, 0x8, 0x17b, 0x8, 0x4, 0xfffffffffffff020, 0x4, 0x4, 0x8, 0xfffffffffffffffe, 0x2, 0x9, 0x9, 0x10000, 0x7, 0x8, 0x0, 0x9, 0xad97, 0x8, 0x81, 0x4000000000, 0x8, 0x9, 0x8, 0x5, 0x8, 0x0, 0x0, 0x7, 0x1, 0x3, 0x7f, 0x58, 0x3, 0x20, 0x3, 0x13947d9c], [0x7, 0x2, 0x0, 0x0, 0x7, 0x2, 0x101, 0x1ff, 0xac, 0x0, 0x5, 0xf7b, 0x4, 0xfffffffffffffff7, 0x5, 0xb3, 0x4, 0x3, 0xffffffffffffff6d, 0x0, 0x10000, 0x0, 0x2, 0xfffffffffffffff8, 0x9, 0x3, 0x401, 0x101, 0x3, 0x5, 0x3, 0x4, 0x1, 0x6e, 0x8, 0x1, 0x5, 0xfff, 0xffffffff00000000, 0x7, 0x0, 0x9, 0x1, 0x80000001, 0x66, 0x5, 0x9, 0x80000000, 0x5, 0xffffffffffffffe0, 0x100000000, 0x167, 0x1ff, 0x9, 0x7f, 0x2, 0x7, 0x2, 0x9e42, 0x8, 0x6, 0x4, 0xb94, 0x4e], [0x5, 0x40, 0x23a, 0x8, 0x20, 0x2, 0x800, 0x6, 0x500000000000000, 0xfffffffffffffff7, 0xfff, 0x7f, 0x20, 0x800000000000, 0x3f, 0x8, 0x0, 0x1, 0x6, 0x100, 0x5, 0x3, 0xe9, 0x5, 0x6, 0x1, 0x9, 0x5, 0xc1, 0x8, 0x2, 0x2, 0x101, 0xffff, 0x1d545888, 0x7fff, 0xff, 0xffff, 0x4, 0x8000, 0xff, 0x1, 0x2, 0x40, 0xffffffff, 0x4, 0x6e2, 0x0, 0x3b3d, 0x1f, 0x8000, 0x4a, 0x17f7, 0x7, 0x0, 0x2, 0x4, 0x3f, 0x9, 0xc75, 0x7, 0xbe3, 0x7, 0xb49]}, 0x45c) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[@ANYBLOB="01fffffffffffffff9", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000000001000000000000000000000048ba1dbce83ad52a"], 0x48}}, 0x0) 12:46:31 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0xe8030000}, 0x0) 12:46:31 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x1) 12:46:31 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0b00000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:46:31 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0xf4010000}, 0x0) 12:46:31 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x1) 12:46:31 executing program 1: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:46:31 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) accept4(r0, &(0x7f0000000200)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000280)=0x80, 0x800) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', r1}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x1, 0x43, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) [ 1007.737727] Bluetooth: hci0: command 0x1003 tx timeout [ 1007.744116] Bluetooth: hci0: sending frame failed (-49) [ 1009.817806] Bluetooth: hci0: command 0x1001 tx timeout [ 1009.823218] Bluetooth: hci0: sending frame failed (-49) [ 1011.897740] Bluetooth: hci0: command 0x1009 tx timeout 12:46:41 executing program 1: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:46:41 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0e00000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:46:41 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5414, 0x0) 12:46:41 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0xffffff7f}, 0x0) 12:46:41 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x1) 12:46:41 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000000)=ANY=[@ANYBLOB="010000004300"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="57450000000001000000000000000000000048ba1dbce83ad52a1fa36966847c3ef4061efb27d8c46516"], 0x48}}, 0x0) 12:46:41 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0f00000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:46:41 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x100000000000000}, 0x0) 12:46:41 executing program 1: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x0) 12:46:41 executing program 3: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ubi_ctrl\x00', 0x4000, 0x0) ioctl$DRM_IOCTL_GET_MAP(r0, 0xc0286404, &(0x7f0000000040)={&(0x7f0000ffe000/0x1000)=nil, 0x2, 0x0, 0x1, &(0x7f0000ffc000/0x4000)=nil, 0x62}) write$apparmor_current(r0, &(0x7f00000001c0)=@profile={'stack ', '/dev/ubi_ctrl\x00'}, 0x14) r1 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r1, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r1, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000700)={&(0x7f0000000080)=ANY=[@ANYBLOB="0100", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="000000000100000000000010000000004882d41f8b94c3c1ef3285d349e18bb5a5ec3358ec34a81dc95527c6a7a230b517b66c4529e2a258c31d708effffff9053b24a4b78a483e4c141b5600c54765ccfd3b667a7dc5c2dea92de6767412a240213b365c4b011b43499a10f965b448cd5deb2b1a6e221a2c4921360469e7814755248f5f3695f6a4421af8b92878fafa067659f7b6256f22e4c7b711e623677abcb00da7aa5b628c236653357f821516029f91b59fd06dd442686c29862993e10b819bf89684abf656b9a20197c8b09c184eeb4e2e41970df30d19d1ceb0e"], 0x48}}, 0x0) 12:46:41 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) 12:46:41 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f4800000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:46:41 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x200000000000000}, 0x0) 12:46:41 executing program 1: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x0) [ 1017.897771] Bluetooth: hci0: command 0x1003 tx timeout [ 1017.903207] Bluetooth: hci0: sending frame failed (-49) [ 1018.057723] Bluetooth: hci1: command 0x1003 tx timeout [ 1018.063110] Bluetooth: hci1: sending frame failed (-49) [ 1019.977847] Bluetooth: hci0: command 0x1001 tx timeout [ 1019.983449] Bluetooth: hci0: sending frame failed (-49) [ 1020.137764] Bluetooth: hci1: command 0x1001 tx timeout [ 1020.143189] Bluetooth: hci1: sending frame failed (-49) [ 1022.057765] Bluetooth: hci0: command 0x1009 tx timeout [ 1022.217823] Bluetooth: hci1: command 0x1009 tx timeout 12:46:51 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5415, 0x0) 12:46:51 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) r1 = syz_open_dev$usbmon(&(0x7f00000000c0)='/dev/usbmon#\x00', 0x80000001, 0x2000) ioctl$SCSI_IOCTL_STOP_UNIT(r1, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000700)={&(0x7f0000000000)=ANY=[@ANYBLOB="010000004300"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="000000000100000000000000faffff3f00ba1dbce83a05690eccc47e2beeb9614f5ae1618d597806a1b3478e33cdb35c12731010e19a48528d89204e481071fbc085088c4e1f4f1e8410e404f6768935fac9f4106d9a987fb58e9fdf5120818902a1c5f40ab66f77a21cda3762b586d0176ade4106f66eeb58e0fb250817c0fd0c6390975c144fc5fbd2"], 0x48}}, 0x0) 12:46:51 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x400000000000000}, 0x0) 12:46:51 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f4c00000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:46:51 executing program 1: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x0) 12:46:51 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f6000000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:46:51 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="11dca5055e0bcfe47bf070") r1 = syz_open_dev$sg(&(0x7f0000000140)='/dev/sg#\x00', 0x0, 0x802) r2 = dup(r1) write$tun(r2, &(0x7f0000000180)={@void, @val, @ipv4={{0x5, 0x4, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, @dev, @multicast1}, @igmp={0x0, 0x0, 0x0, @local, "cb55e177"}}}, 0x2a) 12:46:51 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000140)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000380)='fuse\x00', 0x0, &(0x7f0000000280)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}, {@allow_other='allow_other'}]}}) setresuid(0x0, 0xfffe, 0x0) chown(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) 12:46:51 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x800000000000000}, 0x0) 12:46:51 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000140)={{{@in=@multicast1, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}}}, &(0x7f0000000240)=0xe8) connect$can_bcm(r0, &(0x7f0000000480)={0x1d, r1}, 0x10) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ubi_ctrl\x00', 0x48100, 0x0) ioctl$sock_inet_SIOCSARP(r2, 0x8955, &(0x7f0000000080)={{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x307, @remote}, 0x4, {0x2, 0x4e24, @rand_addr=0x7fff800000000000}, 'irlan0\x00'}) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r3}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x1, 0x43, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) 12:46:51 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_sctp(0x2, 0x800000000000001, 0x84) sendto$inet(r1, &(0x7f0000000000)='H', 0x1, 0x0, &(0x7f0000030ff0)={0x2, 0x0, @remote}, 0x10) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r1, 0x84, 0x6d, &(0x7f0000000400)={0x0, 0x524, "db3e5e1efb61a68718c91485226a6e87e4938b5c9b04e4b2f6a1b4419b44ccb5cb5f30312a5d6757488bb1a0d27a1f47f54121b5bc6fa5f0663049260c98c64f14dd72534bb29f8b714cd15c796569b9"}, &(0x7f0000000580)=0x306) 12:46:51 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0xa00000000000000}, 0x0) [ 1026.127193] Bluetooth: hci0: Frame reassembly failed (-84) [ 1028.137717] Bluetooth: hci0: command 0x1003 tx timeout [ 1028.143216] Bluetooth: hci0: sending frame failed (-49) [ 1030.217784] Bluetooth: hci0: command 0x1001 tx timeout [ 1030.223229] Bluetooth: hci0: sending frame failed (-49) [ 1032.297882] Bluetooth: hci0: command 0x1009 tx timeout 12:47:01 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f6800000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:47:01 executing program 1: r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000380)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f0000000140)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3235004000000f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4d}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f00000001c0)) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000380)) ioctl$KVM_RUN(r3, 0xae80, 0x0) 12:47:01 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5416, 0x0) 12:47:01 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) socket$key(0xf, 0x3, 0x2) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[@ANYBLOB="010000004300"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000000001000000000000000000000068ba1dbce83ad52a"], 0x48}}, 0x0) r2 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x10001, 0x111200) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r2, 0x40045532, &(0x7f0000000040)=0x1ff) 12:47:01 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000000400)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f0000000000)={{0x9}, 'port1\x00'}) 12:47:01 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0xe00000000000000}, 0x0) 12:47:01 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='\x00b\x00\x00@\xf5') renameat(r0, &(0x7f0000000000)='./file0\x00', r0, &(0x7f0000000040)='./file0\x00') 12:47:01 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f6c00000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:47:01 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x3f00000000000000}, 0x0) 12:47:01 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x3, 0x440100) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') sendmsg$TIPC_NL_NET_GET(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x60004}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x20, r2, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@TIPC_NLA_BEARER={0xc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x401}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4010}, 0x0) connect$can_bcm(r0, &(0x7f0000000480), 0x10) lsetxattr$trusted_overlay_opaque(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)='trusted.overlay.opaque\x00', &(0x7f0000000300)='y\x00', 0x2, 0x2) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000340)={{{@in6=@mcast1, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f0000000440)=0xe8) clock_gettime(0x0, &(0x7f0000000500)={0x0, 0x0}) sendmsg$can_bcm(r1, &(0x7f0000000680)={&(0x7f00000004c0)={0x1d, r3}, 0x10, &(0x7f0000000640)={&(0x7f0000000540)=ANY=[@ANYBLOB="b571", @ANYRES64=r4, @ANYRES64=r5/1000+30000, @ANYRES64=0x0, @ANYRES64=0x2710, @ANYBLOB="0400006001000000040000600b000000d47a76c2204538e1d11c249f619cfddcbea213ae47e00c45b56fa662a3ba760e4f4c6a89accd420f5e981e925dbe521324e13333f73d65a9b98ffaafbf5c9595"], 0x80}, 0x1, 0x0, 0x0, 0x40}, 0x810) sync() ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r6}, 0x10, &(0x7f0000000700)={&(0x7f0000000180)={0x1, 0x43, 0x0, {}, {0x0, 0x7530}, {0x0, 0x3, 0x0, 0xfffffffffffffffe}, 0x1, @canfd={{0x1, 0x6, 0x101, 0x7f}, 0x27, 0x2, 0x0, 0x0, "7357b55527b02af7be7365e06163bbc341c8d81135ab3041ade42ddfcb1c919897d156a38baa68961ff75045b025565b0afef07bc32dc9473d5207746f8a6c12"}}, 0xfffffffffffffff6}}, 0x20000081) getsockopt$inet_sctp6_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f0000000200), &(0x7f0000000240)=0x8) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f00000006c0)={0x49c, 0x1, 0x8000, 0x8001, 0x5, 0x0, 0x8, 0x2, 0x0}, &(0x7f0000000780)=0x20) getsockopt$inet_sctp_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f00000007c0)={r7, 0x0, 0x1, 0x2}, &(0x7f0000000800)=0x10) 12:47:02 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f7400000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:47:02 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0xe803000000000000}, 0x0) 12:47:02 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x3f000000}, 0x0) 12:47:02 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) [ 1036.675527] Bluetooth: hci1: Frame reassembly failed (-84) [ 1038.377746] Bluetooth: hci0: command 0x1003 tx timeout [ 1038.383224] Bluetooth: hci0: sending frame failed (-49) [ 1038.697766] Bluetooth: hci1: command 0x1003 tx timeout [ 1038.703172] Bluetooth: hci1: sending frame failed (-49) [ 1040.457862] Bluetooth: hci0: command 0x1001 tx timeout [ 1040.463298] Bluetooth: hci0: sending frame failed (-49) [ 1040.777781] Bluetooth: hci1: command 0x1001 tx timeout [ 1040.783188] Bluetooth: hci1: sending frame failed (-49) [ 1042.537811] Bluetooth: hci0: command 0x1009 tx timeout [ 1042.857794] Bluetooth: hci1: command 0x1009 tx timeout 12:47:12 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5418, 0x0) 12:47:12 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f7a00000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:47:12 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0xf401000000000000}, 0x0) 12:47:12 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0xe000000}, 0x0) 12:47:12 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) splice(r0, &(0x7f0000000000), r0, &(0x7f0000000040), 0xdde7, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x1, 0x43, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) 12:47:12 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1fe000000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:47:12 executing program 0 (fault-call:2 fault-nth:0): r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:47:12 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[@ANYBLOB="010000004300"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="000000000176908eadc800000000006aba1dc7e83ad52a00"], 0x48}}, 0x0) 12:47:12 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0xffffff7f00000000}, 0x0) [ 1046.545176] Bluetooth: hci0: Frame reassembly failed (-84) [ 1046.641493] FAULT_INJECTION: forcing a failure. [ 1046.641493] name failslab, interval 1, probability 0, space 0, times 0 [ 1046.657850] CPU: 0 PID: 32085 Comm: syz-executor.0 Not tainted 4.19.62 #36 [ 1046.664917] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1046.674280] Call Trace: [ 1046.676891] dump_stack+0x172/0x1f0 [ 1046.680543] should_fail.cold+0xa/0x1b [ 1046.684453] ? fault_create_debugfs_attr+0x1e0/0x1e0 12:47:12 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1ff000000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:47:12 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000000)=ANY=[@ANYBLOB="0100"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000000001000000000000000000000048ba1dbce83ad52aad7972a89d5ac3a9738ca5186c4c1191de95fe9480ef30300a2b6d8cb078296e80fd1e0830eefb8bb38232c67008d217fccc55246c37cac631cbfc58fbb91c02ddca9a6a"], 0x48}}, 0x0) [ 1046.689573] ? lock_downgrade+0x810/0x810 [ 1046.693747] __should_failslab+0x121/0x190 [ 1046.697999] should_failslab+0x9/0x14 [ 1046.703516] kmem_cache_alloc+0x2ae/0x700 [ 1046.707676] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1046.713324] ? memset+0x32/0x40 [ 1046.716624] vm_area_dup+0x21/0x170 [ 1046.720267] __split_vma+0xab/0x560 [ 1046.723909] ? find_vma+0x30/0x170 [ 1046.727464] do_munmap+0x2ed/0xed0 [ 1046.731020] ? arch_get_unmapped_area_topdown+0xc9/0x630 [ 1046.736488] mmap_region+0x224/0x1760 [ 1046.740298] ? file_map_prot_check+0x1f7/0x390 [ 1046.744896] ? __x64_sys_brk+0x6c0/0x6c0 [ 1046.748949] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1046.754472] ? get_unmapped_area+0x293/0x3b0 [ 1046.758926] do_mmap+0x8e2/0x1080 [ 1046.762373] vm_mmap_pgoff+0x1c5/0x230 [ 1046.766256] ? vma_is_stack_for_current+0xd0/0xd0 [ 1046.771100] ? iterate_fd+0x360/0x360 [ 1046.774894] ? __sb_end_write+0xd9/0x110 [ 1046.778947] ksys_mmap_pgoff+0x4aa/0x630 [ 1046.782995] ? find_mergeable_anon_vma+0x2e0/0x2e0 [ 1046.787917] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1046.792657] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1046.797400] ? do_syscall_64+0x26/0x620 [ 1046.801363] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1046.806802] __x64_sys_mmap+0xe9/0x1b0 [ 1046.810682] do_syscall_64+0xfd/0x620 [ 1046.814474] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1046.819664] RIP: 0033:0x459829 [ 1046.822841] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1046.841738] RSP: 002b:00007f655e432c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 1046.849435] RAX: ffffffffffffffda RBX: 00007f655e432c90 RCX: 0000000000459829 [ 1046.856688] RDX: 0000000000000001 RSI: 0000000000004000 RDI: 0000000020ffb000 [ 1046.864310] RBP: 000000000075bf20 R08: 0000000000000003 R09: 0000000000000000 [ 1046.871575] R10: 0000000000000011 R11: 0000000000000246 R12: 00007f655e4336d4 [ 1046.878831] R13: 00000000004c5d4d R14: 00000000004da6b8 R15: 0000000000000004 12:47:12 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) [ 1047.146774] Bluetooth: hci1: Frame reassembly failed (-84) [ 1048.617716] Bluetooth: hci0: command 0x1003 tx timeout [ 1048.623117] Bluetooth: hci0: sending frame failed (-49) [ 1049.177865] Bluetooth: hci1: command 0x1003 tx timeout [ 1049.183387] Bluetooth: hci1: sending frame failed (-49) [ 1050.697797] Bluetooth: hci0: command 0x1001 tx timeout [ 1050.703205] Bluetooth: hci0: sending frame failed (-49) [ 1051.257932] Bluetooth: hci1: command 0x1001 tx timeout [ 1051.263346] Bluetooth: hci1: sending frame failed (-49) [ 1052.777786] Bluetooth: hci0: command 0x1009 tx timeout [ 1053.337902] Bluetooth: hci1: command 0x1009 tx timeout 12:47:22 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x541b, 0x0) 12:47:22 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0xffffffff00000000}, 0x0) 12:47:22 executing program 0 (fault-call:2 fault-nth:1): r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:47:22 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0003000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:47:22 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600), 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x1, 0x43, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) 12:47:22 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0005000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) [ 1056.768253] FAULT_INJECTION: forcing a failure. [ 1056.768253] name failslab, interval 1, probability 0, space 0, times 0 [ 1056.796665] Bluetooth: hci0: Frame reassembly failed (-84) [ 1056.814417] CPU: 1 PID: 32112 Comm: syz-executor.0 Not tainted 4.19.62 #36 [ 1056.821561] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1056.830926] Call Trace: [ 1056.833543] dump_stack+0x172/0x1f0 [ 1056.837191] should_fail.cold+0xa/0x1b [ 1056.841126] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 1056.846246] ? __lock_is_held+0xb6/0x140 [ 1056.850338] __should_failslab+0x121/0x190 [ 1056.854588] should_failslab+0x9/0x14 [ 1056.858401] kmem_cache_alloc+0x47/0x700 [ 1056.862485] ? rcu_read_lock_sched_held+0x110/0x130 12:47:22 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0006000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) [ 1056.867539] anon_vma_clone+0xde/0x480 [ 1056.871455] __split_vma+0x17e/0x560 [ 1056.875179] ? find_vma+0x30/0x170 [ 1056.878733] do_munmap+0x2ed/0xed0 [ 1056.882284] ? arch_get_unmapped_area_topdown+0xc9/0x630 [ 1056.887753] mmap_region+0x224/0x1760 [ 1056.891563] ? file_map_prot_check+0x1f7/0x390 [ 1056.896154] ? __x64_sys_brk+0x6c0/0x6c0 [ 1056.900221] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1056.905933] ? get_unmapped_area+0x293/0x3b0 [ 1056.905957] do_mmap+0x8e2/0x1080 [ 1056.905979] vm_mmap_pgoff+0x1c5/0x230 [ 1056.917713] ? vma_is_stack_for_current+0xd0/0xd0 [ 1056.917727] ? iterate_fd+0x360/0x360 [ 1056.917746] ? __sb_end_write+0xd9/0x110 [ 1056.917768] ksys_mmap_pgoff+0x4aa/0x630 [ 1056.917788] ? find_mergeable_anon_vma+0x2e0/0x2e0 [ 1056.917807] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1056.917820] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1056.917836] ? do_syscall_64+0x26/0x620 [ 1056.953155] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe 12:47:22 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0007000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) [ 1056.958543] __x64_sys_mmap+0xe9/0x1b0 [ 1056.975756] do_syscall_64+0xfd/0x620 [ 1056.979585] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1056.984791] RIP: 0033:0x459829 [ 1056.988002] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1057.007037] RSP: 002b:00007f655e432c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 1057.014788] RAX: ffffffffffffffda RBX: 00007f655e432c90 RCX: 0000000000459829 12:47:22 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) 12:47:22 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = getegid() setgid(r1) connect$can_bcm(r0, &(0x7f0000000480), 0x10) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000040)=0x14) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000080)={{{@in=@local, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in6=@empty}}, &(0x7f0000000180)=0xffffffffffffffb5) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', r2}) clock_gettime(0x0, &(0x7f0000000200)={0x0, 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000300)={&(0x7f00000001c0)={0x1d, r2}, 0x10, &(0x7f00000002c0)={&(0x7f0000000240)={0x7, 0x10, 0x1, {}, {r4, r5/1000+30000}, {0x2, 0xc62, 0x4, 0x5}, 0x1, @canfd={{0x3, 0x1, 0x101, 0x80000001}, 0x2, 0x0, 0x0, 0x0, "ed4b691283d242615d458811e63bf2c9dbae14095f5295e93d2fe4b2b76f9259f9668ee75b9d5dca3098c4d49cfadae64a611d56500d6d27546f658fed9aab41"}}, 0x80}, 0x1, 0x0, 0x0, 0x4050}, 0x1) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r3}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x1, 0x43, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) 12:47:22 executing program 0 (fault-call:2 fault-nth:2): r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) [ 1057.022067] RDX: 0000000000000001 RSI: 0000000000004000 RDI: 0000000020ffb000 [ 1057.029336] RBP: 000000000075bf20 R08: 0000000000000003 R09: 0000000000000000 [ 1057.029345] R10: 0000000000000011 R11: 0000000000000246 R12: 00007f655e4336d4 [ 1057.029352] R13: 00000000004c5d4d R14: 00000000004da6b8 R15: 0000000000000004 [ 1057.178578] FAULT_INJECTION: forcing a failure. [ 1057.178578] name failslab, interval 1, probability 0, space 0, times 0 [ 1057.195831] CPU: 1 PID: 32140 Comm: syz-executor.0 Not tainted 4.19.62 #36 [ 1057.202879] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1057.212239] Call Trace: [ 1057.212264] dump_stack+0x172/0x1f0 [ 1057.212285] should_fail.cold+0xa/0x1b [ 1057.212303] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 1057.212319] ? lock_downgrade+0x810/0x810 [ 1057.212341] __should_failslab+0x121/0x190 [ 1057.212355] should_failslab+0x9/0x14 [ 1057.212370] kmem_cache_alloc+0x2ae/0x700 [ 1057.227559] ? do_munmap+0x893/0xed0 [ 1057.235916] vm_area_alloc+0x20/0x110 [ 1057.243833] mmap_region+0x961/0x1760 [ 1057.251318] ? file_map_prot_check+0x1f7/0x390 [ 1057.251341] ? __x64_sys_brk+0x6c0/0x6c0 [ 1057.251358] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1057.251374] ? get_unmapped_area+0x293/0x3b0 [ 1057.273726] do_mmap+0x8e2/0x1080 [ 1057.277204] vm_mmap_pgoff+0x1c5/0x230 [ 1057.281125] ? vma_is_stack_for_current+0xd0/0xd0 [ 1057.285985] ? iterate_fd+0x360/0x360 [ 1057.289808] ? __sb_end_write+0xd9/0x110 [ 1057.293909] ksys_mmap_pgoff+0x4aa/0x630 [ 1057.298083] ? find_mergeable_anon_vma+0x2e0/0x2e0 [ 1057.303038] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1057.307815] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1057.312597] ? do_syscall_64+0x26/0x620 [ 1057.316591] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1057.321971] __x64_sys_mmap+0xe9/0x1b0 [ 1057.326044] do_syscall_64+0xfd/0x620 [ 1057.329847] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1057.335038] RIP: 0033:0x459829 [ 1057.338335] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1057.357433] RSP: 002b:00007f655e432c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 1057.365362] RAX: ffffffffffffffda RBX: 00007f655e432c90 RCX: 0000000000459829 12:47:23 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) [ 1057.372733] RDX: 0000000000000001 RSI: 0000000000004000 RDI: 0000000020ffb000 [ 1057.380111] RBP: 000000000075bf20 R08: 0000000000000003 R09: 0000000000000000 [ 1057.387383] R10: 0000000000000011 R11: 0000000000000246 R12: 00007f655e4336d4 [ 1057.394639] R13: 00000000004c5d4d R14: 00000000004da6b8 R15: 0000000000000004 [ 1057.476224] Bluetooth: hci1: Frame reassembly failed (-84) [ 1057.482589] Bluetooth: hci1: Frame reassembly failed (-84) [ 1058.860034] Bluetooth: hci0: command 0x1003 tx timeout [ 1058.865437] Bluetooth: hci0: sending frame failed (-49) [ 1059.497830] Bluetooth: hci1: command 0x1003 tx timeout [ 1059.503361] Bluetooth: hci1: sending frame failed (-49) [ 1060.937738] Bluetooth: hci0: command 0x1001 tx timeout [ 1060.943148] Bluetooth: hci0: sending frame failed (-49) [ 1061.577857] Bluetooth: hci1: command 0x1001 tx timeout [ 1061.583306] Bluetooth: hci1: sending frame failed (-49) [ 1063.017751] Bluetooth: hci0: command 0x1009 tx timeout [ 1063.657847] Bluetooth: hci1: command 0x1009 tx timeout 12:47:32 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x541d, 0x0) 12:47:32 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f000a000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:47:32 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) 12:47:32 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x40, 0x0) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r1, 0x40485404, &(0x7f0000000040)={{0x1, 0x2, 0x7, 0x3, 0x7}, 0xc0, 0x8}) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r1, 0x84, 0x20, &(0x7f0000000100), 0x4) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000000c0), 0x4) setsockopt$inet_tcp_int(r1, 0x6, 0x19, &(0x7f00000001c0)=0x100000000, 0x4) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x1, 0x43, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000140)={{0x6, 0x5, 0x20, 0x2}, 'syz0\x00', 0x35}) 12:47:32 executing program 0 (fault-call:2 fault-nth:3): r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) [ 1066.986032] audit: type=1400 audit(1564404452.579:80): avc: denied { create } for pid=32149 comm="syz-executor.3" name="pfkey" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:insmod_t:s0 tclass=file permissive=1 [ 1067.012894] FAULT_INJECTION: forcing a failure. [ 1067.012894] name failslab, interval 1, probability 0, space 0, times 0 [ 1067.052664] CPU: 1 PID: 32156 Comm: syz-executor.0 Not tainted 4.19.62 #36 [ 1067.059730] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1067.069107] Call Trace: [ 1067.069138] dump_stack+0x172/0x1f0 [ 1067.069161] should_fail.cold+0xa/0x1b [ 1067.069180] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 1067.069195] ? lock_downgrade+0x810/0x810 [ 1067.069221] __should_failslab+0x121/0x190 [ 1067.069236] should_failslab+0x9/0x14 [ 1067.069248] kmem_cache_alloc_trace+0x2cc/0x760 [ 1067.069262] ? __lock_is_held+0xb6/0x140 [ 1067.069284] usbdev_mmap+0x189/0x790 [ 1067.069300] ? rcu_read_lock_sched_held+0x110/0x130 [ 1067.069315] ? usbdev_vm_close+0x50/0x50 [ 1067.069327] ? do_munmap+0x893/0xed0 [ 1067.069342] ? memset+0x32/0x40 [ 1067.069362] mmap_region+0xc2f/0x1760 [ 1067.069374] ? file_map_prot_check+0x1f7/0x390 [ 1067.069395] ? __x64_sys_brk+0x6c0/0x6c0 [ 1067.101434] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1067.101450] ? get_unmapped_area+0x293/0x3b0 [ 1067.101468] do_mmap+0x8e2/0x1080 [ 1067.101493] vm_mmap_pgoff+0x1c5/0x230 [ 1067.101516] ? vma_is_stack_for_current+0xd0/0xd0 [ 1067.101529] ? iterate_fd+0x360/0x360 [ 1067.101549] ? __sb_end_write+0xd9/0x110 [ 1067.101571] ksys_mmap_pgoff+0x4aa/0x630 [ 1067.101592] ? find_mergeable_anon_vma+0x2e0/0x2e0 [ 1067.101611] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1067.101624] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1067.101645] ? do_syscall_64+0x26/0x620 [ 1067.101659] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1067.101683] __x64_sys_mmap+0xe9/0x1b0 12:47:32 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f000b000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:47:32 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) 12:47:32 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) ioctl$VHOST_SET_FEATURES(r1, 0x4008af00, &(0x7f0000000040)) ioctl$KVM_S390_UCAS_UNMAP(r0, 0x4018ae51, &(0x7f0000000080)={0x3, 0x7fff, 0x7}) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x1, 0x43, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) 12:47:32 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f000e000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:47:32 executing program 0 (fault-call:2 fault-nth:4): r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) [ 1067.121498] Bluetooth: hci0: Frame reassembly failed (-84) [ 1067.122216] do_syscall_64+0xfd/0x620 [ 1067.122238] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1067.122251] RIP: 0033:0x459829 [ 1067.122267] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1067.122280] RSP: 002b:00007f655e432c78 EFLAGS: 00000246 [ 1067.129357] ORIG_RAX: 0000000000000009 12:47:32 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) getsockopt$IPT_SO_GET_ENTRIES(r0, 0x0, 0x41, &(0x7f0000000000)={'raw\x00', 0xb6, "87219b29b832aadac661f78bf83ef0625ab0f1b7685cd5bd61d22ddf53387f4493d353e88c1bdb719dd62a46c954d4400a410d0004889f7746a38d958ff2938b75e1d2357493ae252b81f3c8020f602e34d5517fa3cc8b1f32f76312ad034b41f0af6288b6a4040f68c47d657331e9d36978893d18b419a5631489e2f070d38732c22bb9b64eb5bae8e3419d503102719c60675023253413cecae9efa2291ed993bc0b78095090f90a22a1cf6a1ba4e771073b1e3c2d"}, &(0x7f0000000100)=0xda) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[@ANYBLOB="0300000043000000000000000000cc96", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000000001000000000000000000000048ba1dbce83ad52a"], 0x48}}, 0x0) [ 1067.129367] RAX: ffffffffffffffda RBX: 00007f655e432c90 RCX: 0000000000459829 [ 1067.129377] RDX: 0000000000000001 RSI: 0000000000004000 RDI: 0000000020ffb000 [ 1067.129384] RBP: 000000000075bf20 R08: 0000000000000003 R09: 0000000000000000 [ 1067.129392] R10: 0000000000000011 R11: 0000000000000246 R12: 00007f655e4336d4 [ 1067.129401] R13: 00000000004c5d4d R14: 00000000004da6b8 R15: 0000000000000004 [ 1067.332927] FAULT_INJECTION: forcing a failure. [ 1067.332927] name failslab, interval 1, probability 0, space 0, times 0 [ 1067.415582] CPU: 0 PID: 32176 Comm: syz-executor.0 Not tainted 4.19.62 #36 [ 1067.422655] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1067.432030] Call Trace: [ 1067.434643] dump_stack+0x172/0x1f0 [ 1067.438317] should_fail.cold+0xa/0x1b [ 1067.442230] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 1067.447358] ? lock_downgrade+0x810/0x810 [ 1067.451539] __should_failslab+0x121/0x190 [ 1067.455811] should_failslab+0x9/0x14 [ 1067.459633] __kmalloc+0x2e2/0x750 [ 1067.463198] ? hcd_buffer_alloc+0x3a8/0x550 [ 1067.467537] hcd_buffer_alloc+0x3a8/0x550 [ 1067.471805] ? hcd_buffer_destroy+0xa0/0xa0 [ 1067.476128] ? rcu_read_lock_sched_held+0x110/0x130 [ 1067.481230] ? kmem_cache_alloc_trace+0x348/0x760 [ 1067.486064] usb_alloc_coherent+0x62/0x90 [ 1067.490222] usbdev_mmap+0x1ce/0x790 [ 1067.493942] ? rcu_read_lock_sched_held+0x110/0x130 [ 1067.498947] ? usbdev_vm_close+0x50/0x50 [ 1067.502994] ? do_munmap+0x893/0xed0 [ 1067.506700] ? memset+0x32/0x40 [ 1067.509971] mmap_region+0xc2f/0x1760 [ 1067.513778] ? file_map_prot_check+0x1f7/0x390 [ 1067.518353] ? __x64_sys_brk+0x6c0/0x6c0 [ 1067.522424] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1067.527971] ? get_unmapped_area+0x293/0x3b0 [ 1067.532396] do_mmap+0x8e2/0x1080 [ 1067.535851] vm_mmap_pgoff+0x1c5/0x230 [ 1067.539747] ? vma_is_stack_for_current+0xd0/0xd0 [ 1067.544594] ? iterate_fd+0x360/0x360 [ 1067.548420] ? __sb_end_write+0xd9/0x110 [ 1067.552486] ksys_mmap_pgoff+0x4aa/0x630 [ 1067.556538] ? find_mergeable_anon_vma+0x2e0/0x2e0 [ 1067.561460] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1067.566202] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1067.570947] ? do_syscall_64+0x26/0x620 [ 1067.574910] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1067.580267] __x64_sys_mmap+0xe9/0x1b0 [ 1067.584155] do_syscall_64+0xfd/0x620 [ 1067.587952] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1067.593134] RIP: 0033:0x459829 [ 1067.596313] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1067.615207] RSP: 002b:00007f655e432c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 1067.622922] RAX: ffffffffffffffda RBX: 00007f655e432c90 RCX: 0000000000459829 [ 1067.630223] RDX: 0000000000000001 RSI: 0000000000004000 RDI: 0000000020ffb000 [ 1067.637512] RBP: 000000000075bf20 R08: 0000000000000003 R09: 0000000000000000 [ 1067.644800] R10: 0000000000000011 R11: 0000000000000246 R12: 00007f655e4336d4 [ 1067.652131] R13: 00000000004c5d4d R14: 00000000004da6b8 R15: 0000000000000004 12:47:33 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) [ 1069.177820] Bluetooth: hci0: command 0x1003 tx timeout [ 1069.183223] Bluetooth: hci0: sending frame failed (-49) [ 1071.257765] Bluetooth: hci0: command 0x1001 tx timeout [ 1071.263225] Bluetooth: hci0: sending frame failed (-49) [ 1073.337796] Bluetooth: hci0: command 0x1009 tx timeout 12:47:42 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x541f, 0x0) 12:47:42 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1fc00e000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:47:42 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x1, 0x43, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) r2 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_QUERYCTRL(r2, 0xc0445624, &(0x7f0000000040)={0x8, 0x8, "835443a22347beb6fb6f62db98707dec7c29ecf117fb6b1502070e581395a47c", 0x4, 0xffffffffffff33a6, 0x1, 0x8, 0x80}) 12:47:42 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) 12:47:42 executing program 0 (fault-call:2 fault-nth:5): r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:47:42 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) [ 1077.241162] FAULT_INJECTION: forcing a failure. [ 1077.241162] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1077.253021] CPU: 1 PID: 32201 Comm: syz-executor.0 Not tainted 4.19.62 #36 [ 1077.260054] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1077.269423] Call Trace: [ 1077.272035] dump_stack+0x172/0x1f0 [ 1077.275688] should_fail.cold+0xa/0x1b [ 1077.279593] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 1077.279611] ? debug_smp_processor_id+0x1c/0x20 [ 1077.289368] ? perf_trace_lock+0xeb/0x510 [ 1077.289382] ? mark_held_locks+0x100/0x100 [ 1077.289405] __alloc_pages_nodemask+0x1ee/0x750 [ 1077.289422] ? save_stack+0x45/0xd0 [ 1077.289441] ? __alloc_pages_slowpath+0x2870/0x2870 [ 1077.311123] cache_grow_begin+0x91/0x8c0 [ 1077.315212] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1077.320791] ? check_preemption_disabled+0x48/0x290 [ 1077.325826] __kmalloc+0x68b/0x750 [ 1077.329399] ? hcd_buffer_alloc+0x3a8/0x550 [ 1077.333755] hcd_buffer_alloc+0x3a8/0x550 [ 1077.337933] ? hcd_buffer_destroy+0xa0/0xa0 [ 1077.342288] ? rcu_read_lock_sched_held+0x110/0x130 [ 1077.347308] ? kmem_cache_alloc_trace+0x348/0x760 [ 1077.352167] usb_alloc_coherent+0x62/0x90 [ 1077.356335] usbdev_mmap+0x1ce/0x790 [ 1077.360065] ? rcu_read_lock_sched_held+0x110/0x130 [ 1077.365195] ? usbdev_vm_close+0x50/0x50 [ 1077.369268] ? do_munmap+0x893/0xed0 [ 1077.373001] ? memset+0x32/0x40 [ 1077.376472] mmap_region+0xc2f/0x1760 [ 1077.380286] ? file_map_prot_check+0x1f7/0x390 [ 1077.384987] ? __x64_sys_brk+0x6c0/0x6c0 [ 1077.389068] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1077.394723] ? get_unmapped_area+0x293/0x3b0 [ 1077.399157] do_mmap+0x8e2/0x1080 [ 1077.402637] vm_mmap_pgoff+0x1c5/0x230 [ 1077.406550] ? vma_is_stack_for_current+0xd0/0xd0 [ 1077.411926] ? iterate_fd+0x360/0x360 [ 1077.415748] ? __sb_end_write+0xd9/0x110 [ 1077.419834] ksys_mmap_pgoff+0x4aa/0x630 [ 1077.423922] ? find_mergeable_anon_vma+0x2e0/0x2e0 [ 1077.428867] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1077.433646] ? trace_hardirqs_on_thunk+0x1a/0x1c 12:47:43 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f000f000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:47:43 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) 12:47:43 executing program 1: ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x540b, 0x0) 12:47:43 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000000)={0x1, 0x43, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0xfffffffffffffe47}}, 0x0) write$binfmt_aout(r0, &(0x7f0000000780)={{0xcc, 0x100, 0x6, 0xa9, 0x122, 0x2, 0x3ce, 0x5}, "62c06f7a8ab7b56a468559984f0847f0d37ff4f33241df9a7769ae8a857d22682b525c73aad07e508e180df1ba8db3b23044a91dbe83e5ab6ce93938570f4acf1d24a78fe45480435e179e2ac06695f0e7e69ef3acb7fc3345ee617b27deb7f346b49b4a2d3fab661449ada00e41e0681cd7d1e48ec65a0f18516292772793ae5d258c594b1cdb226625d9c72bc22cb5a6f07a4819e9afaba506f5aa166b1cd8a379e5a43d3cbccaba1742e260678d91f97a249d9bba774f486102fd37c9a1d5d62228f553cf8dceb7213370c5947bb67ec051", [[], [], [], [], [], [], [], [], []]}, 0x9f3) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20\x00', 0x400000, 0x0) setsockopt$inet6_MRT6_ADD_MFC_PROXY(r2, 0x29, 0xd2, &(0x7f0000000100)={{0xa, 0x4e20, 0x1, @mcast2, 0x7}, {0xa, 0x4e23, 0x7ff, @loopback, 0x9}, 0x44, [0x3c55, 0x1, 0x2, 0x3, 0x100000000, 0x7, 0x1, 0x3f]}, 0x5c) connect$can_bcm(r0, &(0x7f0000000080)={0x1d, r1}, 0x10) [ 1077.438417] ? do_syscall_64+0x26/0x620 [ 1077.442424] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1077.447808] __x64_sys_mmap+0xe9/0x1b0 [ 1077.451727] do_syscall_64+0xfd/0x620 [ 1077.455556] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1077.460767] RIP: 0033:0x459829 [ 1077.464001] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1077.483089] RSP: 002b:00007f655e432c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 12:47:43 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) [ 1077.490824] RAX: ffffffffffffffda RBX: 00007f655e432c90 RCX: 0000000000459829 [ 1077.498108] RDX: 0000000000000001 RSI: 0000000000004000 RDI: 0000000020ffb000 [ 1077.505397] RBP: 000000000075bf20 R08: 0000000000000003 R09: 0000000000000000 [ 1077.512673] R10: 0000000000000011 R11: 0000000000000246 R12: 00007f655e4336d4 [ 1077.512683] R13: 00000000004c5d4d R14: 00000000004da6b8 R15: 0000000000000004 12:47:43 executing program 1: ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x540b, 0x0) [ 1077.639822] Bluetooth: hci0: Frame reassembly failed (-84) [ 1079.657749] Bluetooth: hci0: command 0x1003 tx timeout [ 1079.663151] Bluetooth: hci0: sending frame failed (-49) [ 1081.737809] Bluetooth: hci0: command 0x1001 tx timeout [ 1081.743220] Bluetooth: hci0: sending frame failed (-49) [ 1083.817791] Bluetooth: hci0: command 0x1009 tx timeout 12:47:53 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0020000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:47:53 executing program 0 (fault-call:2 fault-nth:6): r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:47:53 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x1, 0x43, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000040)=0xc) ptrace$setsig(0x4203, r2, 0x7067, &(0x7f0000000080)={0x33, 0x4, 0x8a6}) 12:47:53 executing program 1: ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x540b, 0x0) 12:47:53 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5421, 0x0) 12:47:53 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) 12:47:53 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = openat$cgroup_ro(r0, &(0x7f0000000140)='cgroup.events\x00', 0x0, 0x0) ioctl$DRM_IOCTL_GET_CAP(r1, 0xc010640c, &(0x7f0000000180)={0x2ce, 0x5}) connect$can_bcm(r0, &(0x7f0000000480), 0x10) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x200, 0x0) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r2, 0x6, 0x21, &(0x7f00000001c0)="6500ddfff11400", 0x6b) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(r2, 0x84, 0x6e, &(0x7f00000000c0)=[@in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x17}}, @in6={0xa, 0x4e20, 0x0, @empty, 0x4}, @in6={0xa, 0x4e24, 0x1, @dev={0xfe, 0x80, [], 0x2b}, 0xa8}, @in={0x2, 0x4e23, @local}], 0x58) prctl$PR_GET_TSC(0x19, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r3}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x1, 0x43, 0x400000000000000, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x45}}, 0x0) 12:47:53 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) 12:47:53 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) 12:47:53 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f003f000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:47:53 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:47:53 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) r1 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x796, 0x0) getsockname$netrom(r1, &(0x7f0000000040)={{0x3, @default}, [@netrom, @null, @rose, @default, @netrom, @bcast, @rose, @default]}, &(0x7f00000000c0)=0x48) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x1, 0x43, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) 12:47:53 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0040000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:47:53 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) 12:47:53 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) 12:47:53 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4002, 0x1, 0x11, r0, 0x0) 12:47:54 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0048000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) [ 1090.217766] Bluetooth: hci0: command 0x1003 tx timeout [ 1090.223163] Bluetooth: hci0: sending frame failed (-49) [ 1092.297814] Bluetooth: hci0: command 0x1001 tx timeout [ 1092.303221] Bluetooth: hci0: sending frame failed (-49) [ 1094.377794] Bluetooth: hci0: command 0x1009 tx timeout 12:48:03 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5423, 0x0) 12:48:03 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) 12:48:03 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) r1 = getpgrp(0x0) fcntl$setown(r0, 0x8, r1) r2 = socket$can_bcm(0x1d, 0x2, 0x2) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000200)={{{@in6=@initdev, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in=@loopback}}, &(0x7f0000000080)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000001880)={{{@in, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@empty}}, &(0x7f0000001980)=0xe8) connect$can_bcm(r2, &(0x7f0000000000)={0x1d, r4}, 0x236) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000000c0)={{{@in6=@dev, @in6=@initdev}}, {{@in=@dev}}}, &(0x7f00000001c0)=0xe8) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000003c0)={'vcan0\x00', r3}) sendmsg$can_bcm(r2, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r5}, 0x10, &(0x7f0000000700)={&(0x7f0000000300)=ANY=[@ANYBLOB="01000000430000000000000000000000c18157c17a1d502280068010", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000000001000000000000000000000048ba1dbce83ad52a"], 0x48}}, 0x0) 12:48:03 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) 12:48:03 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4004, 0x1, 0x11, r0, 0x0) 12:48:03 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f004c000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:48:04 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0060000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:48:04 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) accept$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0}, &(0x7f0000000080)=0x14) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', r1}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x1, 0x43, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$TIOCLINUX3(r3, 0x541c, &(0x7f0000000100)) r4 = syz_open_pts(0xffffffffffffffff, 0x309000) ioctl$KDGETMODE(r4, 0x4b3b, &(0x7f0000000000)) 12:48:04 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) 12:48:04 executing program 1: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x540b, 0x0) [ 1098.422622] Bluetooth: hci0: Frame reassembly failed (-84) 12:48:04 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x400a, 0x1, 0x11, r0, 0x0) 12:48:04 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0068000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) [ 1100.457764] Bluetooth: hci0: command 0x1003 tx timeout [ 1100.463170] Bluetooth: hci0: sending frame failed (-49) [ 1102.537817] Bluetooth: hci0: command 0x1001 tx timeout [ 1102.543230] Bluetooth: hci0: sending frame failed (-49) [ 1104.617823] Bluetooth: hci0: command 0x1009 tx timeout 12:48:14 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5424, 0x0) 12:48:14 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000001c0)={{{@in6=@initdev, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in=@dev}}, &(0x7f00000002c0)=0xe8) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vcan0\x00', r1}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x1, 0x43, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) 12:48:14 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0xe07000, 0x1, 0x11, r0, 0x0) 12:48:14 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) 12:48:14 executing program 1: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x540b, 0x0) 12:48:14 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f006c000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:48:14 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0074000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:48:14 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0xf05000, 0x1, 0x11, r0, 0x0) 12:48:14 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) 12:48:14 executing program 1: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x540b, 0x0) 12:48:14 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[@ANYBLOB="010000004300"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000000001000000400000000000000048ba1dbce83ad52a"], 0x48}}, 0x0) [ 1108.669417] Bluetooth: hci0: Frame reassembly failed (-84) 12:48:14 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f007a000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) [ 1110.697743] Bluetooth: hci0: command 0x1003 tx timeout [ 1110.703260] Bluetooth: hci0: sending frame failed (-49) [ 1112.777805] Bluetooth: hci0: command 0x1001 tx timeout [ 1112.783468] Bluetooth: hci0: sending frame failed (-49) [ 1114.857824] Bluetooth: hci0: command 0x1009 tx timeout 12:48:24 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) mkdir(&(0x7f00000003c0)='./file0\x00', 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000000)='fuse\x00', 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="66642729fa149e6569460f42c6416b0f9299dc8c45b335a7c041d850e46af9ff46a6aeadd03bf6faca0b8259b948fce4a40b97b8a3b94aa60a", @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) close(r2) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f0000000100)=@random={'btrfs.', '\x00'}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x1, 0x43, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) 12:48:24 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) 12:48:24 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5425, 0x0) 12:48:24 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000140)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000940)='fuse\x00', 0x0, &(0x7f0000000980)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) 12:48:24 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x7fffdf004000, 0x1, 0x11, r0, 0x0) 12:48:24 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0ec0000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:48:24 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f00e0000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:48:24 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x7ffffffff000, 0x1, 0x11, r0, 0x0) 12:48:24 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) 12:48:24 executing program 1: r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000d0fff5)='/dev/audio\x00', 0x0, 0x0) ioctl$int_in(r0, 0x800000c0045005, &(0x7f0000000040)=0x40000000040000) 12:48:24 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) r1 = semget(0x1, 0x6, 0x18) semctl$GETNCNT(r1, 0x3, 0xe, &(0x7f0000001980)=""/213) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) io_setup(0x3, &(0x7f0000001940)=0x0) r4 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x0, 0x2) r5 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/btrfs-control\x00', 0x109440, 0x0) r6 = syz_open_dev$vcsn(&(0x7f0000000440)='/dev/vcs#\x00', 0x3, 0x8000) r7 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000540)='/proc/sys/net/ipv4/vs/sync_persist_mode\x00', 0x2, 0x0) r8 = syz_open_dev$sndpcmc(&(0x7f0000001880)='/dev/snd/pcmC#D#c\x00', 0x0, 0x111800) io_submit(r3, 0x7, &(0x7f0000001900)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x27, r0, &(0x7f0000000040)="d48af392", 0x4, 0x0, 0x0, 0x2, r4}, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x7, 0x2, r0, &(0x7f0000000100)="e07af9ca9c7b86c8f01d84e48aa490b5ac0e25b90a924361714c690351e8a71253d54c23398657f3094161a27a038b71063bcc5f14c6b19c5d9d1c34bcf9137f9e53202cf604453785ecad90aae94dcbe8717cc4f91db65e2b46a469d4c194fd6389382df011e3da15854e471fc1285d24acedf8e67aeea31f9a8248e8efe371968c1028bc3a8f7b1164cefceb99241af9634c284196910957e4438e9184cc69d26230ad87417eb2fcf0208cd921548f8dac926660e7150c196831ab1e3c44d1f16f3e30655bd53a63ed432ee4a0b5ba4f6dc8c8819e356b3ac6391d7a5505fafad7fb9afab2b4480ba0e633b353be763475e270dcd3075ccb62bc0ba00c", 0xfe, 0x0, 0x0, 0x2}, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x7, 0x7f, r0, &(0x7f0000000240)="63bf08e8b5d2ddce1df87dbd32f84b0e9f141c53fe8c8fae3a29fa7213ca76c051616aac340517fb8b035a6dbdc611f292960d5e308b705e138a5362c2b2641c36f2943428c71a2a17898849bb489e8e74552c10fd03a4235e813b02287a1a", 0x5f, 0x80000001, 0x0, 0x3, r5}, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000340)="2e1afa8e73f68ca4906734d9d4edd8d7dc071b1de8bc38226d1539d699525a4b792685614936d862ef5c8bd213c40d9bca59b5d60ed7c36476d74a59d3fa069ab930a2983d724a961e410ae68de26024f96c2f40edf2368c4f59af07c7a359b048695d0006cd7bcf7fd3c77868f18469327749e360bf97691d10f4881810fe1e68579dbff586d826c206833ea1dc328f4ec2ac49003b05b563414f2b489e7ea0dd5a94f6081a5272033e54be131cc00c3faa843afb8f101b53df3748a7da8349e136ecd335aacde9bb07b1a1e05dfd3f63d350c75de5d82f0b6adbbcedd03201a344a2583a", 0xe5, 0x8, 0x0, 0x1, r6}, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x7, 0x5, r0, &(0x7f0000000780)="745048b853277e84d967ba15b67bf8961635fc89f5130463abdb41089781bf8936cce10637ae1e83c65374532b88bdace828952da6dd17a568cdbb5b1bd8eb57c6706d1b6050207ef1fd930e6197c0ae36f0b2a6ff95a0d50842a6b88a5b2603e82aa2b7a88d6662a2b6326c17f55d08a63eb89f401165fef403a4e34a11026d16f8193f5337b9a73a213262edb6f1f59aa8c4c3a51d26d4426280c6fd5acb552d9d58d2baea607bbb2ebdedc1d85d78df4f5454f9bb458a96bc879f3e9b08afc3381cbe0509ccb268ffe2071651b5fcb0fbcbf2818bf15757ebf9812a2d1e587c6706ba3f2e5c954637216668d273fe0bd9a450369f0ff8bb38a13a9a770062be01f0c734ebe34fe8a49c0e80f42af0017254eddbb1a8ba8602e1d488832389321e0bf6af07dac35a84ffe93c4a1758cbbb373ab58bded5d457e6f177ca141b71817f2bfa28100de914a8264a4bb93e3cf58b67aad446ac238165c7e83684988613f7cdc3e752d9f77657e08e24ae814e61512719f1c43ec49213be3e2ab96ba470986d754ee829636bdbee3d1d0b0908cf28bbd890aa043d59623c497a98521a9415f30493105c6192bb30cec5fe24057507b6d3c1b8db4a3a02846629c9e2e211c69d375a7addf4b3cd7c2757ab06ce2b90b97dfa90a5d92a066646b82de88cfebe783c82c6f70cba2d49ac73cb9cf859c19bb04848af074a7575247cef340a4a84288b322e20140e17d882415183ab9f38dd9b6996b138a4ac4eb06151282f6445a4b5399681e9926cbd917553568ad663ad4fe9e0541eaff93fc62cf7c071ab94c3bf5ae354c4aad526fe4454ed451f8a5285c0c6f9615a0627fb0d3c2e8e85adde8f29582014dd971c43e0cc9bce839cece0c74afdb4387eef614eade44e306788d538748a9238e63e46fcd7a293399e3f4b8df451f71ec7f6c72874d27a75eb890cf80e9b01d067c4d40a29cf43cc3a1488a468189f074a458bf4c9e64fa82daf4339245b927da61979c33270209ab106ae9d596fe09897178d2ac4c1ffe76be3f137a2cac60b8df41c38adc79150c26495625709598c812ba477c8f83a502c7c8611c303ddc537364e82f5ce835f9e7ee4d0bcc5dc9cad56738bf115bcc85d3de7671cfeb01bacc39f665e0224fb57c730a790ed6de31396eaafcdd0bd9190a2dbac7f278b3f166212392b039a16fbcb62cf539e8c65e56f9dffa612ee36e7bf3e6910af9dfd68871b26fe3ea0e373898f38e3df22f5b21f9f6669ffb9d9794bf4bb8ba581b422ba3a78a6789f866b1d14b40d49e1782a5d095a184823126498675c9ade659f4511428167b1c705dd965d52a5321c67984ffb58a3afe23a9afefcdb7e608ef7e7d96939761747a0d047a10777e8eda53be544332ed6e1b908275597c7bcdabc87d5349933cd9128a343739c3bdf232848d66fb58bc75ba743c6f8a5bfb89b14bc4ff0a29cce6e4206ff3e3fed0d3de04a9d601864d7e04afdd6d85eadb079a918d4ad1e91bf404c81db38770cf529b781f27bcc4fea01e373944af79e9da89a2dbf0ab64cc62a7f2d41ea245b877101b53ade016e364d1e3f87fd90f068aca43d68b1ef8252b126148228d41a48544a4b18e96d4f2da3e68828c226bacd718fb24395f3bdf4d61c86c835d40fa9547bf4e8e73139182333492a77f708d1f4b69f29a15d475e68ae65ea592e55fb386cc6401f7faff53774e46dbfb673b90fb483dc30c8f371327e267bc647d832990de74927171dc448af29a57f15920921d3e482e21bd6c1107ff854b44ae8bedba2b24ffda96cae427cb1af3b82373db08bed1ce19884ce9496bccc6b61be5fbfe65a4844ba88eb779bf14a39629a7f8be4f9c460928885729250ac7431cd8e4910c1a6fe72e090a7ab307313da42d200b6ab9e2a2894e03ac44809f6a100f72929c6d137d2af861757fbb352ad27394ca83704bdd3d0f195ec9c2357b956cd045afbb1f3a2043e1a0f64fbea45d2cb64000deb7f476f7329faaeb8cf521427b184259df263c47a8666bf6175b4fc9be96ade06221235d42f1ffeacfacb969536d9263c28486f36944f6ea35369ddf3f9a1f4e2671dbd50d9aafd74a6a39595afc1d323439ac8ad4aacc91b3651ec5ae7bbc721c2ce8fbd4ab3cc3d5a8c5f73824b30edddfb64fad474185fb04f284e5d20b3f5d0645a34b420120f02e0b454a549dbe875844866082f95b8a7e9c14c56a7bfc482bbd1cf8c47e29352b14a8725c6ca3df78e696a3f7ab9a6433beea84bd0e5f540323f71b84aeea30f4eba66fb498d1a53b5f0f0887e8b40aeb6599c0ce679b773d4a11dc91e5739f23fbb65199646971c22abb03b93c375810569cf771d2ea9d08462458b9cea9c72f63afb82e5f289b8ce3171579d8ff9af6eefbcc2de442f533f29eef9b4a7a986d03b6d9c9fa5bd07904983f36ea6fc3deb34433a7441d72caa9b215da8d297786eb2323d45b9dd4fb64b603761d3c09a6070062562046917008f9ecad175feef46fb41d6dba4af53fbe7b3f194de4435625e532a2175d24b2559cca93a5f728d054b60bb2461d2747f5a92a9988dd2c57599c40829250cb169f57be52faa5b00801c5a5a3ef1e7db9f7f1a7fb6ed61a9e5bb6c5b0949ac59cd5079ea37cf6df02cfac94afe1fe39face082ee6afa2a26478c6af1e9656eb3d8838586444af6a16c151982662fbe71fbc018b9bb69909b8dbe464a125aa72aa5a81d428c3f37a74f94b2e038c42d1cb01509f0bb0ffd76b5c93bb22e841db24cae6c359fa6859bb06519e688af7c0202c64145f568f957ae098716d3a36390d782df6f9091feb593b8399d3626357a31e9b530c1a4bcdc4a3917324b303924bf29745be61aa312af87228b4bfff7ccdb7a16048a33eab3ebe1e4acb4e1c6c188d016d2f040d910cbf8942d505e9d1bbb5bee1c17deb2dc6bf94401af06c8f031d0333da60c33755a0b4985dc4c68a779174028af4ae0adeddb0315215fb3b56a5dcacd4bf347ee08583db88cf626a8bec825ee039780bd197a57eafdf3ef48fae195a30179fd0adb9b31b3cdd2daf2fc3f8cb41cfcf2e062b96cc1412ab17943cb4d5f9b4ebc41e615e30d145052369310e797fb33827395f7df83c62e045f5c22ce53df5f1f4c301bc5843f49d7d2a23d36eac0e0543cf44c7200603f2351a4208f5f9c2f5a381214221e5c6bc0863c88bd72330513041f622f56cbdff6b9dc7674521b5d16b31646bcfc25d4e80756318111eadfc911026c4a01d07b5337f6c974caac34b9baee597e835271e9560b0bc38579ec7ec4440e32096f288a48b6dcb897eeae56218f9d3689bb8d567e3b9207951066a794e66130ab8a4663683618e1119dae3a27a82eb1dfb9d0b3af9c1d4f5fab9028aa4c5c835f2d5e424c018b715f4d7625860879367c4cd0676fa38c8a2d31d33f72a49fa45ad9d98344e87724bc5e77fd73fdbd13aab2280551f95d4a034dfdf7a1fc5370ed56c1aa20860dfa1f676924ae6d5f42dda2a9cdb140df10384e098566d99b0dafeaaefcb05628c47b34b781c1510eced82f1fb01e11bcd94ac82dcbe8f7595e35780496662e59cb4ab16bad6299d243681af8fca7cfe566306118d4cb7d52f9eb81438635b6c26620b8707a79771c53d2b14c7d55fd370f6a32a58b67c4766f5227b602c1d8ea7b531678a2117d7dab682fa4a2bb316c0d7a3bab8aa15ba6d082baf4b216a8b0edeeafb479571b08ec7caa82123fe34d1d6b44876126098ddb65c080923c7fb3f0409f84a0f4a2e189d4bdcb7afda7f0a7883eff53907f4d7be58214c0983fd7c9303a6448997eed2480a74180fd5b289fd3073f25ea4e00d3350a65de70aec32a96f794ecfff93a0cfde47d6a68e8acfbfeb7e7263d29c54a3fd192f2c792d58211b24b1460020b4fda81c4a1f8efe3dde0782797e47abed01003e098f3ea5f1c7598846eb2fddb667386cb3a297616f1c77e33de435a795509961f5858c99d39468f816504e742d7393458162973edad27000cac6fc5e91cb312d49e21758c97ab998dde9e7be694ccbde73c3e49965caf592a7dc174add47648265e7e31a6be28d7525ea1e817a3f657a2fc084729c2d8cd79c67cc36509bcf7fdb909085818c99ffd424f7f87102dd6aad79d4843386a2c1e49e502d5ebf8fc471330da608796369421e22eb6d63773d993fc2b476cda97e2f82efbaf98afc60baab7153c393d814167cd19ffe08c06bd147b8efe23d5261f3e395b7d993a5c26c96bf3590c4874dc6e2fb75f419610380195531c03b3e5f1beb9ffa66628b404098970139f3c58759a94a18e688239093192503462697390256b056dc8bc3530ebc13671365831a2e24ca29c57f7b363d09837dad5875015e73e9ff4f1c1e730086c523768e1df82cefe7e94c24cd2c3f3b0de4fd75fd86475d5f7d91c0dd0544e6b9715e10d1a068c1693b715ef6f44cd2d6498d62040ab1edbf3e1022439ddd8b2cbae4a7a4948f33d991638bb097453b64118c24b6e2b6406c5efd938e4d96bb087c3974fe2ce2fc662ad3e1b9c9f03459ce7dbc341c1367c89ff38902c25f03cac18351c8e11391437e72b4331d94a8e0433a87dc4e268715af565a00d98f9942e7e3ec35ac713e01be5515605d623715c9be14a48c76ded7c3245c4abd0d1416c1d4d3e182d8b3ca624270d6a340264b110e6a77c7d5fe89574c372e81779e0567bca59fe5f8f1fa6126bac3a9f99d36d326fed4058df0c12ecdc288aa52b626ebaec87d26476ea49eecf73868829f8502f18e009766649bd4ea4c62c6bb6dd0ffbc470e4471772b05d4da2d80a7dc48288dc5f41f84ae78fe8c0ab0ec79d97ca9dde66a1a5b0051ecb1a377d4f074b9f78d64b87f6b7b927b5ca4a8fa896c943d8c35bd84dc9dfed5abb971f2017b447e472f0795f90a47337248642fb1e35eb5a0fb315a0621e942df59033282d37666ff10395558efc7a41a42241ebe353e61cfc487b0732e8f96b233c4be43641d767e86be1a3ac16b606dd4e9e1806fdd2e33218df69aa9ca3526ab89e3eccfc88d9f7e420115c86ec3fd3ee1915ec18a1eb4d68e9e34b79e87501ca30fd9307de7951f1793c98eb9c3f4cc7d2030b8d2d797ae4caae87966c5383ec608b3b7e7e716ed178901d7690af1783778f12990bf06c7055a30b08d725d1ddcf5efd0711726537000ab31de0791a83d3c4cbb436b8e10e012445ec83e6e0730fde60d571a0242f7b89e450fa108c026786bc5983085ab5ce55f4354dea029c0d825875181b389cc04e22c1b90a678cec6e8caeca28f18cf70676245b882694cb102882cdc27b505f337b56ff97522e6e0bdbf9e6b1e93b4b88922713b3fcae9794a2246ba9676b73df0ef7d7d2a30715b694bd056eb6ca3a106a0fc4f4227aeda15ea3e4ada774d915e6349bdce397dd8e7b7915bef586f65926936e188305c864a3f14b4969124a5155a66e4d160e622991c2861d3cacb98d1db4d0ee96519df67567290fc4c2ab389b03c9b1182ebc31cca89ccbaf87fe03cdc49ab8bd81b87af3c4a9f297e8edb58ca17d9b98b9f5493e5383dccc63969029592f4c2554226d9839e6a6a62166e13057d95f0f6a193a40ce8f5d28f793f1732d3ec983128b907e0c899be8632c359eb184f2b02e08c45f6770dc8b1de4d7c1d31e07ad409769330e37a788338541ed050c1c34345b68a7f31fac281cf60f399a211aced07d75577b71bdfd71310341baddddfd8c562e5ee6fd2f0540b83dbffb51936ac3272c6bdba2785f", 0x1000, 0x9, 0x0, 0x1, r0}, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x6, 0xd5ae, r0, &(0x7f0000001780)="06c18bdb8556a0d5123bc4f1acb88a0e4792e4197d394e11918962f3986b68296e881d4f66a4d3baae3c356aa4f3474b5b28a32c56d43f56346ab76c892d558193b0d0985b8ab9046ea7d696a49294aff65b80cc392f74177e65c9b688501dccd4ce469f2f7bc6997b13f8582efac5b2618a71cfed779dab5c4b6ff654b9bf3ffe2fa187b16804dc554cfba19d2a8afcf50b3e07383d76d755cf808d06cc71dad6138b2797f4a24c388a8004621e69c718b58a57ca2e71eced904313bb3d199444dba4a5da5f33abad1c355639cfda83cc72cbc626398fa5df7a0b0eafa3760135ccc58fdafe7906", 0xe8, 0x3049, 0x0, 0x1, r7}, &(0x7f00000018c0)={0x0, 0x0, 0x0, 0x7, 0x3f, r0, &(0x7f0000000640)="ac93d2410d", 0x5, 0xffffffffffff8000, 0x0, 0x1, r8}]) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000000)={&(0x7f0000001a80)={0x1, 0x43, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @canfd={{0x4, 0x3, 0x7, 0x3ff}, 0x9, 0x1, 0x0, 0x0, "474ad73a098087d3bde34cb530cdb0eecd9623d5772335a96bf1414ec38a08a1c3fc558bef852ea5547502bc99d705759562d37d93def9f493daba11700ec5c9"}}, 0x46}}, 0x0) 12:48:24 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f00f0000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) [ 1118.944576] Bluetooth: hci0: sending frame failed (-49) 12:48:24 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) 12:48:24 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2, 0x11, r0, 0x0) [ 1121.017704] Bluetooth: hci0: command 0x1003 tx timeout [ 1121.023311] Bluetooth: hci0: sending frame failed (-49) [ 1123.097829] Bluetooth: hci0: command 0x1001 tx timeout [ 1123.103277] Bluetooth: hci0: sending frame failed (-49) [ 1125.177808] Bluetooth: hci0: command 0x1009 tx timeout 12:48:34 executing program 1: r0 = socket$inet_dccp(0x2, 0x6, 0x0) getsockopt$inet_int(r0, 0x10d, 0xcf, &(0x7f0000000140), &(0x7f00000000c0)=0x4) 12:48:34 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) prctl$PR_MCE_KILL_GET(0x22) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0xfffffffffffffeb8, &(0x7f0000000700)={&(0x7f0000000100)=ANY=[@ANYBLOB="01000000430000000000008000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="00000100010000000000000000d200004900d52a00000000"], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) pread64(r0, &(0x7f0000000000)=""/22, 0x16, 0x39) 12:48:34 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000207ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:48:34 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5427, 0x0) 12:48:34 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) 12:48:34 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x11, r0, 0x0) 12:48:34 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x4, 0x11, r0, 0x0) 12:48:34 executing program 1: r0 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r0, &(0x7f0000000000)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x24) r1 = socket$inet_udplite(0x2, 0x2, 0x88) sendmmsg(r0, &(0x7f0000005c00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="180000000000000010010000010000007700000000000000d5b0aba8f5bcd13e315d6025cf9735c6201afced7350847ff81d3ad5bc15cd09c55f295e922a2850be1bcb099d3c8cd2e14f0e320cca70f6409de383db8169de2f494277433b505156eb152fbd0c94291784ec3eca6b578a8c63484f035fc5350158ef226e4b18df23ba1594f82fedb49624d40f0bbf8c66d3288ee14ef7bcc2ae68fdad81b9bb9f2ff03c5028d4c4c793e4adc9244871d265513a5a8a3604e637c76a0d45dca5d8ffd9332174a7d0a129ed10c8897479454225197083d7f864c4346cc1cbc355bbbdaa2a8053059ee80647a6f9509f4b8b6577c01d9f5e958616a6019c7d6cf3c643e8040151eeef47f161a3e72e40b526b3c793290eea2630e7ca64945ec10d0d3c5d38a2099e29dada153fcc9283bd19fb0061eec1740500b1788b090000000000000002b37a625bfc401326897c7dd714daae7df2b0e3773a857206bc40ade76624fe4c2f6947a97a1430157986"], 0x18}}], 0x1, 0x4008000) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") dup3(r1, r0, 0x0) 12:48:34 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vcan0\x00'}) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/enforce\x00', 0x341400, 0x0) ioctl$sock_inet_SIOCGIFPFLAGS(r1, 0x8935, &(0x7f0000000200)={'veth0\x00', 0xffffffffffffffb6}) getsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000140)={0x0, 0x8, 0xcb}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f00000001c0)=@sack_info={r2, 0x32a48e89, 0xfd}, 0xc) accept4$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0}, &(0x7f0000000080)=0x14, 0x80000) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000000c0)={'vcan0\x00', r3}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r4}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[@ANYBLOB="0100000053000000f0ffffffffffffff", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="00000000010000000039ffffff00003eda"], 0x48}}, 0x0) [ 1129.105058] Bluetooth: hci0: Frame reassembly failed (-84) [ 1129.106194] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:48:34 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) 12:48:34 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000507ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:48:34 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x300, 0x11, r0, 0x0) 12:48:34 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) r2 = syz_open_dev$vbi(&(0x7f0000000000)='/dev/vbi#\x00', 0x1, 0x2) ioctl$sock_ax25_SIOCADDRT(r2, 0x890b, &(0x7f0000000040)={@default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, 0x2, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @null, @null, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @default, @null]}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x1, 0x43, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) [ 1131.177756] Bluetooth: hci0: command 0x1003 tx timeout [ 1131.184343] Bluetooth: hci0: sending frame failed (-49) [ 1133.257713] Bluetooth: hci0: command 0x1001 tx timeout [ 1133.263111] Bluetooth: hci0: sending frame failed (-49) [ 1135.337760] Bluetooth: hci0: command 0x1009 tx timeout 12:48:44 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5428, 0x0) 12:48:44 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x40400000, 0x11, r0, 0x0) 12:48:44 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) 12:48:44 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000000)=ANY=[@ANYBLOB="a6001000430000000000000000000000e2ab74a6b9688ced8d47047bf4fe2ace89b53dc5531ebf1215a074d1209ea1bf64742658b85dbd8be41664d8e9b396ccdfa5f9ec16f81ad776c14a981c90a6c7eaa909b8ce87547f85548b63e0587b241c3d009cbb0ad54effd46216eec8814001c0df95122df603e3e9dc7827e001e6d4aaa740e5082ad37ee6cc11c0ca20c73f2c0c98f1232fa5a3c096bee4cdbb6cb259b3720b38c68acf8975f9257491ef250d12fb8c9fb951d403179601da7ecc4fa0f6a8c4dcd62c7a9ecab1", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000000001000000000000000000000048ba1dbce83ad52a"], 0x48}}, 0x0) ioctl$FITRIM(r0, 0xc0185879, &(0x7f0000000140)={0x0, 0x22b}) 12:48:44 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e21, 0x0, @empty}, 0x1c) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4e21, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000140), 0x10) 12:48:44 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1fffffff1f07ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:48:44 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000022307ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:48:44 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x2) 12:48:44 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r2, 0xc0305710, &(0x7f0000000040)={0x1, 0x922, 0x4, 0xaf}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[@ANYBLOB="0100df00430000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000000001000000000000000000000048ba1dbce83ad52a"], 0x48}}, 0x0) 12:48:45 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) [ 1139.359679] Bluetooth: hci0: Frame reassembly failed (-84) 12:48:45 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000002507ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:48:45 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x4) 12:48:45 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") getsockopt$sock_int(r0, 0x1, 0x1, 0x0, &(0x7f00000001c0)) [ 1141.417693] Bluetooth: hci0: command 0x1003 tx timeout [ 1141.423108] Bluetooth: hci0: sending frame failed (-49) [ 1143.497783] Bluetooth: hci0: command 0x1001 tx timeout [ 1143.503389] Bluetooth: hci0: sending frame failed (-49) [ 1145.577874] Bluetooth: hci0: command 0x1009 tx timeout 12:48:55 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) 12:48:55 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000000), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000100)=ANY=[@ANYBLOB="010000004300"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="00004068010000000000ff000000000048ba1dbce83ad52aed4d4cf09d6be40a7827f6a1f13b02f015b148a08abd0c36e655769138265cdfbf20a4073cc8548a35e1da5b072141"], 0x48}}, 0x0) r2 = syz_open_dev$midi(&(0x7f0000000040)='/dev/midi#\x00', 0x7, 0x121000) ioctl$VIDIOC_SUBDEV_S_FMT(r2, 0xc0585605, &(0x7f0000000080)={0x1, 0x0, {0x0, 0xff, 0x0, 0x7, 0xb, 0x7, 0x3, 0x7}}) 12:48:55 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000003f07ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:48:55 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5441, 0x0) 12:48:55 executing program 1: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$radio(0x0, 0x2, 0x2) ioctl$sock_inet_SIOCSIFNETMASK(0xffffffffffffffff, 0x891c, 0x0) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r1, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r1, 0x5) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = accept4(r1, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r2, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(0xffffffffffffffff, 0x84, 0x12, 0x0, 0x21c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x1000000000054}, 0x98) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) 12:48:55 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0xa) 12:48:55 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0xa00) 12:48:55 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000004007ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:48:55 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) 12:48:55 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000240)={&(0x7f00000000c0)={0x1d, r1}, 0x10, &(0x7f0000000200)={&(0x7f0000000180)={0x7, 0x8c4, 0xf2a, {}, {}, {0x0, 0x44, 0x38c7c325, 0x3ff}, 0x1, @canfd={{0x3, 0x8b1, 0xfffffffffffffff9, 0x18}, 0xa, 0x3, 0x0, 0x0, "aeb747f2ad84083ee8e80f5de952f0d300cdf345dcb463fee2efe941390ecca9b7005a5158594461b66caa01f4197fd704db5da5a3f8d329d934b53d71f6eac3"}}, 0x80}}, 0x1) sendmsg$can_bcm(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x1d, r1}, 0x10, &(0x7f0000000100)={&(0x7f0000000000)={0x6, 0x43, 0x0, {}, {0x0, 0x7530}, {0x0, 0x4, 0x100000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x57705a4caa700fa0}, 0x1, 0x0, 0x0, 0x80d1}, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000280)='rdma.current\x00', 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r2, 0x227d, &(0x7f00000002c0)) 12:48:55 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x2000) 12:48:55 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000005207ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:48:55 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) 12:48:55 executing program 3: r0 = socket$inet_dccp(0x2, 0x6, 0x0) getsockopt$inet_int(r0, 0x10d, 0xf9, &(0x7f0000000140), &(0x7f00000000c0)=0x4) 12:48:55 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x4000) [ 1151.737730] Bluetooth: hci0: command 0x1003 tx timeout [ 1151.743209] Bluetooth: hci0: sending frame failed (-49) [ 1153.817851] Bluetooth: hci0: command 0x1001 tx timeout [ 1153.823281] Bluetooth: hci0: sending frame failed (-49) [ 1155.897747] Bluetooth: hci0: command 0x1009 tx timeout 12:49:05 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5450, 0x0) 12:49:05 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f75cc3d9907ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:49:05 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) 12:49:05 executing program 3: getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dlm-control\x00', 0x20840, 0x0) ioctl$BLKRAGET(r0, 0x1263, &(0x7f0000000100)) ioctl$BLKBSZSET(0xffffffffffffffff, 0x40081271, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000740)='/dev/full\x00', 0x3, 0x0) accept4$tipc(r1, &(0x7f0000000780)=@name, &(0x7f00000007c0)=0x10, 0x80800) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_mtu(r0, 0x0, 0xa, 0x0, &(0x7f0000000140)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup\x00', 0x200002, 0x0) fchdir(r2) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000000c0)='./file0\x00', 0xe000, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000300)="eb3c906d6b66732e666174000804010002000270f7f8", 0x16}], 0x0, 0x0) umount2(&(0x7f0000000040)='./file0\x00', 0x4) 12:49:05 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x40000) 12:49:05 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ceph(&(0x7f0000000080)='ceph\x00', &(0x7f0000000340)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 12:49:05 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) 12:49:05 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f75cc3d9f07ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:49:05 executing program 1: r0 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) write$nbd(r0, &(0x7f0000000380)={0x67446698, 0x0, 0x0, 0x0, 0x0, "6517a42ac4cb7a63d1a97a7e5a31524e892eac4023b714a3202f99f16d06589e03469637a7267592938766010a35efd21affe2009efd"}, 0x46) sendfile(r0, r0, &(0x7f0000000200), 0xa198) 12:49:05 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x400000) [ 1159.862341] Bluetooth: hci0: Frame reassembly failed (-84) 12:49:05 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_GEM_FLINK(0xffffffffffffffff, 0xc008640a, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000280)={0x26, 'hash\x00', 0x0, 0x0, 'rmd320-generic\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x159, &(0x7f0000000100)=[@op={0x18}], 0x24}], 0x4924924924924b1, 0x0) 12:49:05 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) [ 1161.897809] Bluetooth: hci0: command 0x1003 tx timeout [ 1161.903323] Bluetooth: hci0: sending frame failed (-49) [ 1163.977793] Bluetooth: hci0: command 0x1001 tx timeout [ 1163.983203] Bluetooth: hci0: sending frame failed (-49) [ 1166.057780] Bluetooth: hci0: command 0x1009 tx timeout 12:49:15 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x6b6b6b) 12:49:15 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0002000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:49:15 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5451, 0x0) 12:49:15 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) 12:49:15 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) 12:49:15 executing program 1 (fault-call:1 fault-nth:0): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) 12:49:15 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) 12:49:15 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0003000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:49:15 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) 12:49:15 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x800000) 12:49:15 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) [ 1170.089955] Bluetooth: hci0: Frame reassembly failed (-84) 12:49:15 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) 12:49:15 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) 12:49:15 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x2, 0x0) [ 1172.147733] Bluetooth: hci0: command 0x1003 tx timeout [ 1172.153174] Bluetooth: hci0: sending frame failed (-49) [ 1174.217780] Bluetooth: hci0: command 0x1001 tx timeout [ 1174.223355] Bluetooth: hci0: sending frame failed (-49) [ 1176.297745] Bluetooth: hci0: command 0x1009 tx timeout 12:49:25 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5452, 0x0) 12:49:25 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0004000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:49:25 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1000000) 12:49:25 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) 12:49:25 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x4b47, 0x0) 12:49:25 executing program 3: ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x540b, 0x0) 12:49:25 executing program 3: ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x540b, 0x0) 12:49:25 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) 12:49:26 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0005000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:49:26 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x2000000) 12:49:26 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x4b49, 0x0) [ 1180.380560] Bluetooth: hci0: Frame reassembly failed (-84) 12:49:26 executing program 3: ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x540b, 0x0) [ 1182.457746] Bluetooth: hci0: command 0x1003 tx timeout [ 1182.463581] Bluetooth: hci0: sending frame failed (-49) [ 1184.537827] Bluetooth: hci0: command 0x1001 tx timeout [ 1184.544598] Bluetooth: hci0: sending frame failed (-49) [ 1186.617803] Bluetooth: hci0: command 0x1009 tx timeout 12:49:36 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) 12:49:36 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x545d, 0x0) 12:49:36 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0006000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:49:36 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) 12:49:36 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x4000000) 12:49:36 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5409, 0x0) 12:49:36 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) 12:49:36 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0xa000000) 12:49:36 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) 12:49:36 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0007000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) [ 1190.576123] Bluetooth: hci0: Frame reassembly failed (-84) 12:49:36 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540a, 0x0) 12:49:36 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x2) 12:49:36 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f000a000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) [ 1192.617882] Bluetooth: hci0: command 0x1003 tx timeout [ 1192.623289] Bluetooth: hci0: sending frame failed (-49) [ 1194.697764] Bluetooth: hci0: command 0x1001 tx timeout [ 1194.703281] Bluetooth: hci0: sending frame failed (-49) [ 1196.777786] Bluetooth: hci0: command 0x1009 tx timeout 12:49:46 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x20000000) 12:49:46 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) 12:49:46 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540c, 0x0) 12:49:46 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x4) 12:49:46 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5460, 0x0) 12:49:46 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f000b000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:49:46 executing program 3: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x540b, 0x0) 12:49:46 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x8) 12:49:46 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540d, 0x0) 12:49:46 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f000e000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) [ 1200.807046] Bluetooth: hci0: Frame reassembly failed (-84) 12:49:46 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x40000000) 12:49:46 executing program 3: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x540b, 0x0) 12:49:46 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f000f000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:49:46 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0xa) 12:49:46 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540e, 0x0) 12:49:46 executing program 3: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x540b, 0x0) [ 1202.867829] Bluetooth: hci0: command 0x1003 tx timeout [ 1202.873829] Bluetooth: hci0: sending frame failed (-49) [ 1204.937767] Bluetooth: hci0: command 0x1001 tx timeout [ 1204.943351] Bluetooth: hci0: sending frame failed (-49) [ 1207.017800] Bluetooth: hci0: command 0x1009 tx timeout 12:49:56 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x40049409, 0x0) 12:49:56 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x6b6b6b00) 12:49:56 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0xe) 12:49:56 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0048000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:49:56 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5411, 0x0) 12:49:56 executing program 3: pivot_root(&(0x7f0000000440)='./file1\x00', &(0x7f0000000480)='./file0\x00') mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x1) mkdir(&(0x7f0000000400)='./file1\x00', 0x0) stat(0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000080)='./file1\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000780)={{}, {}, [{0x2, 0x2}, {0x2, 0x4}], {0x4, 0x1}, [{}], {0x10, 0x4}}, 0x3c, 0x2) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, 0x0, &(0x7f0000000280)) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f00000002c0)={0x0, @in={{0x2, 0x0, @dev}}, [0x0, 0x0, 0x0, 0x518, 0x3, 0x0, 0x32, 0xb48b, 0x0, 0x73ce5b98, 0x3, 0x4, 0x8, 0x6, 0x7]}, &(0x7f00000003c0)=0x100) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x1000000, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) 12:49:56 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x1f4) 12:49:56 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x400000000000) 12:49:56 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5412, 0x0) 12:49:56 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f004c000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) [ 1211.074666] Bluetooth: hci0: Frame reassembly failed (-84) [ 1211.109203] overlayfs: workdir and upperdir must reside under the same mount 12:49:56 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x4000000000000) 12:49:56 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x3e8) [ 1211.183746] overlayfs: workdir and upperdir must reside under the same mount [ 1213.097732] Bluetooth: hci0: command 0x1003 tx timeout [ 1213.103143] Bluetooth: hci0: sending frame failed (-49) [ 1215.177758] Bluetooth: hci0: command 0x1001 tx timeout [ 1215.183185] Bluetooth: hci0: sending frame failed (-49) [ 1217.257737] Bluetooth: hci0: command 0x1009 tx timeout 12:50:06 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x40086602, 0x0) 12:50:06 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0060000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:50:06 executing program 3: fchdir(0xffffffffffffffff) pivot_root(0x0, &(0x7f0000000480)='./file0\x00') mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x1) mkdir(&(0x7f0000000400)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000080)='./file1\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000780)={{}, {0x1, 0x3}, [{0x2, 0x2}], {0x4, 0x1}, [{}], {0x10, 0x4}}, 0x34, 0x2) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000200)={0x2, [0x0, 0x0]}, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x1000000, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) 12:50:06 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5413, 0x0) 12:50:06 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0xa00) 12:50:06 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0xffffffffffffb) 12:50:06 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0068000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:50:06 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x6b6b6b00000000) 12:50:06 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0xe00) [ 1221.320606] Bluetooth: hci0: Frame reassembly failed (-84) 12:50:07 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5414, 0x0) 12:50:07 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x80000000000000) [ 1221.361097] overlayfs: workdir and upperdir must reside under the same mount 12:50:07 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x3f00) [ 1221.425130] overlayfs: workdir and upperdir must reside under the same mount [ 1223.337703] Bluetooth: hci0: command 0x1003 tx timeout [ 1223.343118] Bluetooth: hci0: sending frame failed (-49) [ 1225.417812] Bluetooth: hci0: command 0x1001 tx timeout [ 1225.423222] Bluetooth: hci0: sending frame failed (-49) [ 1227.497733] Bluetooth: hci0: command 0x1009 tx timeout 12:50:17 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x40087602, 0x0) 12:50:17 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f006c000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:50:17 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000240)="11dca50d5e0bcfe47bf070") syz_open_dev$usbmon(&(0x7f0000000180)='/dev/usbmon#\x00', 0x0, 0x0) 12:50:17 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x100000000000000) 12:50:17 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0xe803) 12:50:17 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5415, 0x0) 12:50:17 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5416, 0x0) 12:50:17 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0xf401) 12:50:17 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0074000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:50:17 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x1000000000000002, 0x0) sendto$rose(0xffffffffffffffff, &(0x7f0000000080), 0x0, 0x14, &(0x7f0000000200)=@full={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x2, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast]}, 0x40) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0x60000000, &(0x7f0000000000)=[{&(0x7f0000000140)="230000005e0081aee4050c00000f0000709110ecab372942b44ee4a0008bc609f6d8ff", 0x23}], 0x1}, 0x0) recvmsg(0xffffffffffffffff, 0x0, 0x0) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, &(0x7f0000000280), 0x4) [ 1231.556357] Bluetooth: hci0: Frame reassembly failed (-84) 12:50:17 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x200000000000000) 12:50:17 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f007a000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) [ 1233.577737] Bluetooth: hci0: command 0x1003 tx timeout [ 1233.583427] Bluetooth: hci0: sending frame failed (-49) [ 1235.657815] Bluetooth: hci0: command 0x1001 tx timeout [ 1235.664882] Bluetooth: hci0: sending frame failed (-49) [ 1237.737779] Bluetooth: hci0: command 0x1009 tx timeout 12:50:27 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x4020940d, 0x0) 12:50:27 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x1000000) 12:50:27 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5418, 0x0) 12:50:27 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x400000000000000) 12:50:27 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x1000000000000002, 0x0) sendto$rose(0xffffffffffffffff, &(0x7f0000000080), 0x0, 0x14, &(0x7f0000000200)=@full={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x2, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast]}, 0x40) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0x60000000, &(0x7f0000000000)=[{&(0x7f0000000140)="230000005e0081aee4050c00000f0000709110ecab372942b44ee4a0008bc609f6d8ff", 0x23}], 0x1}, 0x0) recvmsg(0xffffffffffffffff, 0x0, 0x0) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, &(0x7f0000000280), 0x4) 12:50:27 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f00e0000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:50:27 executing program 3: syz_emit_ethernet(0x74, &(0x7f0000000100)={@local, @link_local={0x1, 0x80, 0xc2, 0x4305}, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x3, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd]}, @local={0xfe, 0x80, [0x2]}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) 12:50:27 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f00f0000107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:50:27 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x2000000) 12:50:27 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x541b, 0x0) 12:50:27 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0xa00000000000000) [ 1241.778790] Bluetooth: hci0: Frame reassembly failed (-84) 12:50:27 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000030107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) [ 1243.817700] Bluetooth: hci0: command 0x1003 tx timeout [ 1243.823409] Bluetooth: hci0: sending frame failed (-49) [ 1245.897747] Bluetooth: hci0: command 0x1001 tx timeout [ 1245.903151] Bluetooth: hci0: sending frame failed (-49) [ 1247.977770] Bluetooth: hci0: command 0x1009 tx timeout 12:50:37 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x541d, 0x0) 12:50:37 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x4000000) 12:50:37 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x2000000000000000) 12:50:37 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000140)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000380)='fuse\x00', 0x0, &(0x7f0000000200)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) 12:50:37 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x80045432, 0x0) 12:50:37 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000050107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:50:37 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000060107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:50:37 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x8000000) 12:50:37 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x4000000000000000) 12:50:37 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x541f, 0x0) 12:50:37 executing program 3: keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_update={'update ', 'default', 0x20, 'trusted:'}, 0x665, 0x0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180)={'syz'}, &(0x7f0000000100), 0xca, 0xfffffffffffffffe) 12:50:37 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000070107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) [ 1252.163419] encrypted_key: master key parameter 'trusted:' is invalid 12:50:37 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x8000000000000000) 12:50:37 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0xa000000) 12:50:37 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5420, 0x0) 12:50:37 executing program 3: [ 1254.057718] Bluetooth: hci0: command 0x1003 tx timeout [ 1254.063164] Bluetooth: hci0: sending frame failed (-49) [ 1256.137778] Bluetooth: hci0: command 0x1001 tx timeout [ 1256.143180] Bluetooth: hci0: sending frame failed (-49) [ 1258.217744] Bluetooth: hci0: command 0x1009 tx timeout 12:50:47 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f00000a0107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:50:47 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0xfbffffffffff0f00) 12:50:47 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0xe000000) 12:50:47 executing program 3: 12:50:47 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x80045440, 0x0) 12:50:47 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5421, 0x0) 12:50:47 executing program 3: 12:50:47 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f00000b0107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:50:47 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5423, 0x0) 12:50:47 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x40000, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:50:47 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x3f000000) [ 1262.284491] Bluetooth: hci0: Frame reassembly failed (-84) 12:50:48 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f00000e0107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:50:48 executing program 3: 12:50:48 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) timer_create(0x4, &(0x7f0000000000)={0x0, 0x21, 0x0, @thr={&(0x7f0000000080)="e7f8f2d9b449b6e38d8cd0dce76cddab64ee33c9b70dc2608625536dc92c5ed17199b1d35736a1c647eb7b2cdf8cdcaf0debe5504835920aedc209d31178ff378d9c7ba3fc40d02587b3d2857021f6c18fff7bf53665919d626f2dabf59eda5d6d7fc34f868c1d820f094439658f4ef70cfbb70f2ac26c7e34edcc15b2d145ad87669f79cfce6276e4f66a9b56cb5b8206222b039d1c7aedc23a56620013964690c87e58478d33402e1a3eb9c2b49de8bed2eeed84e4a413378dd8ac2ead2f66ff7c0337b07fa2200cdbb98e65e0d36698de74d4d77aa060608b9be79ab809e8cc5d52f8eb0da27e96216a5311e06a66be4b26c534", &(0x7f0000000180)="1cfeaaaa515ea5da283a823541891d40e38d08bfe0414942c437e0dc14c1e47103fa77757f6ca8750a8c5f59785eeb3ddf1ea60d8622ed4541a69034390258ce11dc84e8c423f7bece9f987d6bc74e958590077214114daa6da8788a5df23b9e311e93dd8d642be1d2ada3201c5fbd74f934136c72c96d19712b12ab65598534e2668e6f4fe0978f18ea47cc"}}, &(0x7f0000000240)=0x0) timer_delete(r1) 12:50:48 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5424, 0x0) 12:50:48 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0xe8030000) [ 1264.297747] Bluetooth: hci0: command 0x1003 tx timeout [ 1264.304169] Bluetooth: hci0: sending frame failed (-49) [ 1266.377756] Bluetooth: hci0: command 0x1001 tx timeout [ 1266.383156] Bluetooth: hci0: sending frame failed (-49) [ 1268.457804] Bluetooth: hci0: command 0x1009 tx timeout 12:50:57 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x80086601, 0x0) 12:50:57 executing program 3: 12:50:57 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x200002, 0x0) mmap$binder(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000080)={'bpq0\x00'}) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:50:57 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f00c00e0107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:50:57 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5425, 0x0) 12:50:57 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0xf4010000) 12:50:58 executing program 3: 12:50:58 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0xffffff7f) 12:50:58 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f00000f0107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:50:58 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5427, 0x0) [ 1272.498149] Bluetooth: hci0: Frame reassembly failed (-84) 12:50:58 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000000)={0x2, 0x0, 0x10003, 0xffffffff80000001}) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000080)={0x0, r1, 0x10000, 0xff}) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f00000000c0)={0x0, r0, 0x1, 0x7, 0x9, 0x30}) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:50:58 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000200107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) [ 1274.537803] Bluetooth: hci0: command 0x1003 tx timeout [ 1274.543350] Bluetooth: hci0: sending frame failed (-49) [ 1276.617803] Bluetooth: hci0: command 0x1001 tx timeout [ 1276.623385] Bluetooth: hci0: sending frame failed (-49) [ 1278.697781] Bluetooth: hci0: command 0x1009 tx timeout 12:51:08 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x80087601, 0x0) 12:51:08 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='task\x00') getdents(r0, &(0x7f00000013c0)=""/4096, 0x1000) 12:51:08 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x100000000000000) 12:51:08 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5428, 0x0) 12:51:08 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$UI_SET_SNDBIT(r0, 0x4004556a, 0x2) 12:51:08 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f00003f0107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:51:08 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000400107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:51:08 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x200000000000000) 12:51:08 executing program 0: r0 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x7f, 0x80) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000010c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000001080), 0x13f, 0xa}}, 0x20) r1 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x200, 0x8006000) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x0) ioctl$EVIOCGSW(r1, 0x8040451b, &(0x7f0000000080)=""/4096) 12:51:08 executing program 3: r0 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCGIFDSTADDR(r0, 0x8917, &(0x7f0000000000)={'syz_tun\x00', {0x2, 0x0, @local}}) 12:51:08 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) [ 1282.749334] Bluetooth: hci0: Frame reassembly failed (-84) 12:51:08 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000480107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) [ 1284.777727] Bluetooth: hci0: command 0x1003 tx timeout [ 1284.783378] Bluetooth: hci0: sending frame failed (-49) [ 1286.857858] Bluetooth: hci0: command 0x1001 tx timeout [ 1286.863275] Bluetooth: hci0: sending frame failed (-49) [ 1288.937846] Bluetooth: hci0: command 0x1009 tx timeout 12:51:18 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x400000000000000) 12:51:18 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0xc0045878, 0x0) 12:51:18 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5441, 0x0) 12:51:18 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) ioctl$NBD_SET_SIZE(r0, 0xab02, 0xee) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:51:18 executing program 3: r0 = socket$inet_dccp(0x2, 0x6, 0x0) getsockopt$inet_int(r0, 0x10d, 0x10, &(0x7f0000000140), &(0x7f00000000c0)=0x55) 12:51:18 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f00004c0107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:51:18 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000600107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:51:18 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x800000000000000) 12:51:18 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5450, 0x0) 12:51:18 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) sendmmsg$inet(r0, &(0x7f0000015700)=[{{&(0x7f00000004c0)={0x2, 0x4e23, @remote}, 0x10, 0x0, 0x0, &(0x7f0000010300)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev}}}], 0x20}}], 0x1, 0x0) 12:51:18 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) [ 1292.950081] Bluetooth: hci0: Frame reassembly failed (-84) 12:51:18 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000380)="11dca5055e0bcfe47bf070") getsockopt$sock_timeval(r0, 0x1, 0x2a, &(0x7f00000000c0), &(0x7f0000000140)=0x10) 12:51:18 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000680107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) [ 1295.017708] Bluetooth: hci0: command 0x1003 tx timeout [ 1295.023246] Bluetooth: hci0: sending frame failed (-49) [ 1297.097810] Bluetooth: hci0: command 0x1001 tx timeout [ 1297.103226] Bluetooth: hci0: sending frame failed (-49) [ 1299.177890] Bluetooth: hci0: command 0x1009 tx timeout 12:51:28 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5451, 0x0) 12:51:28 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0xc0045878, 0x0) 12:51:28 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0xa00000000000000) 12:51:28 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x5, 0xfffffffffffffffb) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:51:28 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) readv(r0, &(0x7f0000000840)=[{&(0x7f0000000040)=""/143, 0x8f}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0x73a0b1b, 0x0, 0x0, 0x800e00549) shutdown(r1, 0x0) r3 = dup(r2) r4 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000017c0)=[{&(0x7f0000000100)=""/117, 0x75}, {0x0}], 0x2}, 0x0) r5 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r5, 0x0, 0xccf3, 0x0, 0x0, 0x800e00545) shutdown(r4, 0x0) r6 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r6, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000140)=""/141, 0x8d}, {0x0}], 0x2}, 0x2) shutdown(r5, 0x0) shutdown(r3, 0x0) 12:51:28 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f00006c0107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:51:28 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000740107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:51:28 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffb, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:51:28 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0xe00000000000000) 12:51:28 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5452, 0x0) [ 1303.211791] Bluetooth: hci0: Frame reassembly failed (-84) 12:51:28 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f00007a0107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:51:28 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000000000), &(0x7f0000000080)=0x4) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:51:28 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x3f00000000000000) [ 1305.257796] Bluetooth: hci0: command 0x1003 tx timeout [ 1305.263676] Bluetooth: hci0: sending frame failed (-49) [ 1307.337818] Bluetooth: hci0: command 0x1001 tx timeout [ 1307.344018] Bluetooth: hci0: sending frame failed (-49) [ 1309.417952] Bluetooth: hci0: command 0x1009 tx timeout 12:51:38 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0xc0189436, 0x0) 12:51:38 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f000ec00107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:51:38 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x545d, 0x0) 12:51:38 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x2, 0x1) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:51:38 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0xe803000000000000) 12:51:38 executing program 3: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x800) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000040)={0xffffffffffffffff}) setsockopt$IP_VS_SO_SET_EDITDEST(r0, 0x0, 0x489, &(0x7f0000000080)={{0xff, @local, 0x4e22, 0x2, 'lblcr\x00', 0x7, 0x8, 0x79}, {@broadcast, 0x4e22, 0x10000, 0xb3, 0x1000}}, 0x44) readv(r0, &(0x7f00000001c0)=[{&(0x7f0000000100)=""/177, 0xfffffffffffffe11}], 0x328) ioctl$sock_netdev_private(r0, 0x89fc, &(0x7f0000000300)="45dd94b80393d9b37cfa2874c5a794395097027729873aaf59eb8cfb70912429cc4f99e74dcff258a2a19c3f15d933d989bbbd69a3106153494b9b6a705625bfd76776") syz_open_dev$loop(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) prctl$PR_GET_FP_MODE(0x2e) r1 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x89a1, &(0x7f00000000c0)={@local={0xfe, 0x80, [0x600, 0x3ef, 0x0, 0x3f00000000000000, 0x100000000000000, 0x0, 0x1103, 0x0, 0x0, 0x0, 0x0, 0x6]}}) ioctl$sock_inet6_SIOCADDRT(r1, 0x89a0, &(0x7f0000000100)={@local={0xfe, 0x80, [0x0, 0xfeff0000]}, @empty, @loopback}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) dup(0xffffffffffffffff) mmap(&(0x7f0000a60000/0x4000)=nil, 0x4000, 0x8, 0x20810, 0xffffffffffffffff, 0x0) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KDSKBSENT(r2, 0x4b49, &(0x7f0000000240)="f6d9f95adcf31e0303052573e578ab762ef82244022ba5556ea627f22183a44dde258f2440cbcde93fc735b24c0b5ad281b784cbf31304502d329e74de2bf3") tgkill(0x0, 0x0, 0x1) 12:51:39 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000e00107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:51:39 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0xf401000000000000) [ 1313.439576] Bluetooth: hci0: Frame reassembly failed (-84) 12:51:39 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5460, 0x0) 12:51:39 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) flock(r0, 0x0) 12:51:39 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000f00107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:51:39 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x40045431, 0x0) [ 1315.497798] Bluetooth: hci0: command 0x1003 tx timeout [ 1315.503385] Bluetooth: hci0: sending frame failed (-49) [ 1317.577808] Bluetooth: hci0: command 0x1001 tx timeout [ 1317.583237] Bluetooth: hci0: sending frame failed (-49) [ 1319.657758] Bluetooth: hci0: command 0x1009 tx timeout 12:51:49 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0xc020660b, 0x0) 12:51:49 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={0x2}) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:51:49 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000030007ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:51:49 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0xffffff7f00000000) 12:51:49 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x40045436, 0x0) 12:51:49 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-blowfish-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000040)="0a0775db", 0x4) r1 = accept$alg(r0, 0x0, 0x0) r2 = dup(r1) write$UHID_DESTROY(r2, &(0x7f0000000200), 0xffffff77) recvmmsg(r1, &(0x7f0000004580)=[{{0x0, 0x0, &(0x7f0000001440)=[{&(0x7f0000001340)=""/239, 0x8}, {&(0x7f0000000280)=""/24, 0x20000298}], 0x2}}], 0x1, 0x0, 0x0) 12:51:49 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x40049409, 0x0) 12:51:49 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0xffffffff00000000) 12:51:49 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000020107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:51:49 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000000000)=0x5, 0x4) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) [ 1323.695755] Bluetooth: hci0: Frame reassembly failed (-84) 12:51:49 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x240, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) 12:51:49 executing program 0: r0 = syz_open_dev$usb(&(0x7f00000002c0)='/dev/bus/usb/00#/00#\x00', 0x5, 0xffffffffffffffff) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f0000000080)={0x0, 0x0, 0x1, 0x0, [], [{0x1, 0x20, 0x80000001, 0x100000000, 0xbe3, 0x3}, {0x5, 0x3, 0x57, 0x2, 0x2ce40b3d, 0x1ff}], [[]]}) r1 = syz_genetlink_get_family_id$team(&(0x7f0000000200)='team\x00') getsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000006c0)={@dev, 0x0}, &(0x7f0000000700)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000740)={{{@in, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in=@empty}}, &(0x7f0000000840)=0xe8) getpeername$packet(r0, &(0x7f0000000880)={0x11, 0x0, 0x0}, &(0x7f00000008c0)=0x14) getpeername$packet(r0, &(0x7f00000009c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000a00)=0x14) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000a40)={0x0, @local, @loopback}, &(0x7f0000000a80)=0xc) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000ac0)={'team0\x00', 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000c40)={{{@in=@multicast2, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in=@multicast1}}, &(0x7f0000000d40)=0xe8) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000d80)={'team0\x00', 0x0}) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000001080)={{{@in=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@initdev}}, &(0x7f0000001180)=0xe8) accept$packet(r0, &(0x7f0000000240)={0x11, 0x0, 0x0}, &(0x7f0000001200)=0x14) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000001240)={0x0, @empty, @multicast2}, &(0x7f0000001280)=0xc) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000001480)={{{@in=@remote, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in6=@mcast2}}, &(0x7f0000001580)=0xe8) getsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000007580)={@multicast2, @remote, 0x0}, &(0x7f00000075c0)=0xc) getpeername$packet(r0, &(0x7f0000007600)={0x11, 0x0, 0x0}, &(0x7f0000007640)=0x14) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000007680)={'vcan0\x00', 0x0}) setsockopt$ax25_SO_BINDTODEVICE(r0, 0x101, 0x19, &(0x7f0000000280)=@rose={'rose', 0x0}, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000076c0)={'lo\x00', 0x0}) getsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f0000007700)={@loopback, @empty, 0x0}, &(0x7f0000007740)=0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000007800)={'vcan0\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(r0, &(0x7f0000008100)={&(0x7f00000001c0), 0xc, &(0x7f00000080c0)={&(0x7f0000007840)={0x858, r1, 0x200, 0x70bd29, 0x25dfdbfe, {}, [{{0x8, 0x1, r2}, {0x98, 0x2, [{0x54, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x24, 0x4, [{0x8001, 0xfffffffffffff94f, 0x9, 0x3ac}, {0x9, 0x3, 0x1, 0x7}, {0x1, 0x26, 0xc0}, {0x80, 0x80, 0x200, 0x2c2}]}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x10001}}, {0x8, 0x6, r3}}}]}}, {{0x8, 0x1, r4}, {0x1ec, 0x2, [{0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x7}}, {0x8, 0x6, r5}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r6}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0xc1bf}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0xff}}, {0x8}}}, {0x7c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x4c, 0x4, [{0x7, 0x0, 0x8000, 0x30000}, {0x4, 0x4, 0x7, 0xb1f0}, {0x1b32, 0x6, 0x80000000, 0x3}, {0x80000000, 0x0, 0x30, 0x7}, {0xed, 0x5f, 0x61, 0xa6}, {0xb0, 0x10000, 0xb9e, 0x4d}, {0xa1c5, 0x6, 0x0, 0x7ff}, {0x3, 0x2, 0x4d, 0x100}, {0x1, 0x4, 0xb0, 0x6}]}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r7}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x8001}}}]}}, {{0x8, 0x1, r8}, {0x13c, 0x2, [{0x3c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0xc, 0x4, [{0x3, 0x5, 0x2, 0x8}]}}}, {0x44, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x14, 0x4, 'activebackup\x00'}}}, {0x3c, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0xc, 0x4, 'random\x00'}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r9}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x4ef}}, {0x8}}}]}}, {{0x8, 0x1, r10}, {0xf4, 0x2, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x7f}}}, {0x3c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0xc, 0x4, [{0xbd2a, 0xdd73, 0x325, 0xfbd5}]}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x100}}}, {0x44, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x14, 0x4, 'activebackup\x00'}}}]}}, {{0x8, 0x1, r11}, {0x12c, 0x2, [{0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r12}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r13}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x1ff}}}, {0x34, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x4}}}]}}, {{0x8, 0x1, r14}, {0x3c, 0x2, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x27b6}}}]}}, {{0x8, 0x1, r15}, {0x128, 0x2, [{0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r16}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x23}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x9}}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r17}}}]}}, {{0x8, 0x1, r18}, {0xc0, 0x2, [{0x3c, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0xc, 0x4, 'random\x00'}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'broadcast\x00'}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x7}}, {0x8, 0x6, r19}}}]}}]}, 0x858}, 0x1, 0x0, 0x0, 0x8000}, 0x40040d0) fsetxattr$security_capability(r0, &(0x7f0000000000)='security.capability\x00', &(0x7f0000000180)=@v2={0x2000000, [{0xffff}, {0x6, 0x7f}]}, 0x14, 0x2) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BLKTRACESTART(r0, 0x1274, 0x0) [ 1325.737908] Bluetooth: hci0: command 0x1003 tx timeout [ 1325.743366] Bluetooth: hci0: sending frame failed (-49) [ 1327.817876] Bluetooth: hci0: command 0x1001 tx timeout [ 1327.824317] Bluetooth: hci0: sending frame failed (-49) [ 1329.897782] Bluetooth: hci0: command 0x1009 tx timeout 12:51:59 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x3f00) 12:51:59 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x40086602, 0x0) 12:51:59 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000030107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:51:59 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$int_in(r0, 0x5473, &(0x7f0000000000)=0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[@ANYBLOB="0400"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000e13f00000000000000000000000048ba1dbee83ad52a"], 0x48}}, 0x0) 12:51:59 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) socket$bt_cmtp(0x1f, 0x3, 0x5) getsockopt$TIPC_DEST_DROPPABLE(r0, 0x10f, 0x81, &(0x7f00000000c0), &(0x7f0000000080)=0x4) 12:51:59 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000000)=0x0) ptrace$getenv(0x4201, r1, 0xada, &(0x7f00000000c0)) setsockopt$inet6_mtu(r0, 0x29, 0x17, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) r2 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000100)={&(0x7f0000ffb000/0x2000)=nil, 0x2000}, &(0x7f0000000140)=0x10) ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0x9) fcntl$setstatus(r0, 0x4, 0x46800) sendmmsg(r0, &(0x7f000000ac80), 0x400000000000302, 0x0) socket$inet6(0xa, 0xe, 0x5) 12:51:59 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x111002, 0x0) ioctl$VIDIOC_G_FREQUENCY(r1, 0xc02c5638, &(0x7f00000000c0)={0x9, 0x7, 0x2}) bind$bt_rfcomm(r1, &(0x7f0000000080)={0x1f, {0x6, 0x6, 0xffff, 0x5, 0x3ff, 0x4}, 0xfc}, 0xa) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) 12:51:59 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000040107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:51:59 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$EVIOCGUNIQ(r0, 0x80404508, &(0x7f0000000000)=""/64) 12:51:59 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x40087602, 0x0) [ 1333.904687] Bluetooth: hci0: Frame reassembly failed (-84) [ 1333.915072] Bluetooth: hci0: Frame reassembly failed (-84) 12:51:59 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) 12:51:59 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$TUNSETTXFILTER(r0, 0x400454d1, &(0x7f0000000000)={0x1, 0x3, [@remote, @remote, @remote]}) write$UHID_CREATE2(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="0b00000073797a310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000ffff00000000000001040000010100005dcd5d4654f208dc52a5c27f4319aa9796059a003fbda454eb9a0c27cc6a634de57f7625222221a666568acc8ec3c55eb4f548295689d818e59e8781fb7bf4d80ff0ad82536f9598b5ecbde0936f4f3814e4d9ab48a2be4eb31b4832688a9a3943c05526d42850912addffdc5808d4826489d5e1de824d8abd75044b1ab3eb619db722fbbe4efd226f91e3b976e3cba8c3697b361d322a4ee3cb2ae7b4942c"], 0x199) dup2(r0, r0) [ 1335.977740] Bluetooth: hci0: command 0x1003 tx timeout [ 1335.983199] Bluetooth: hci0: sending frame failed (-49) [ 1336.697731] Bluetooth: hci1: command 0x1003 tx timeout [ 1336.703207] Bluetooth: hci1: sending frame failed (-49) [ 1338.057810] Bluetooth: hci0: command 0x1001 tx timeout [ 1338.063229] Bluetooth: hci0: sending frame failed (-49) [ 1338.777805] Bluetooth: hci1: command 0x1001 tx timeout [ 1338.783223] Bluetooth: hci1: sending frame failed (-49) [ 1340.137785] Bluetooth: hci0: command 0x1009 tx timeout [ 1340.857837] Bluetooth: hci1: command 0x1009 tx timeout 12:52:10 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x4000) 12:52:10 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000050107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:52:10 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[@ANYBLOB="0400"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="00000000010000000000000000000000e6c28b5de83ad52a"], 0x48}}, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) ioctl$SG_SET_TIMEOUT(r3, 0x2201, &(0x7f0000000040)=0x2) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='trusted.overlay.nlink\x00', &(0x7f0000000100)={'L-', 0x8}, 0x28, 0x2) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000880)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_RESET_STATS(r2, &(0x7f0000000980)={&(0x7f0000000840), 0xc, &(0x7f0000000940)={&(0x7f00000008c0)={0x7c, r4, 0x900, 0x70bd2a, 0x25dfdbfe, {}, [@TIPC_NLA_MEDIA={0x38, 0x5, [@TIPC_NLA_MEDIA_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1ff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffffffffff9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}]}, @TIPC_NLA_NODE={0x24, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x5}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_MON={0xc, 0x9, [@TIPC_NLA_MON_REF={0x8}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x840}, 0x40) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000140)={0x0}, &(0x7f0000000180)=0xc) process_vm_writev(r5, &(0x7f00000003c0)=[{&(0x7f00000001c0)=""/6, 0x6}, {&(0x7f0000000200)=""/82, 0x52}, {&(0x7f0000000280)=""/49, 0x31}, {&(0x7f00000002c0)=""/203, 0xcb}], 0x4, &(0x7f0000000640)=[{&(0x7f00000004c0)=""/238, 0xee}, {&(0x7f0000000400)=""/89, 0x59}, {&(0x7f0000000780)=""/132, 0x84}], 0x3, 0x0) 12:52:10 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x4020940d, 0x0) 12:52:10 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40400fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000000)) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:52:10 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000000)=0x0) ptrace$getenv(0x4201, r1, 0xada, &(0x7f00000000c0)) setsockopt$inet6_mtu(r0, 0x29, 0x17, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) r2 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000100)={&(0x7f0000ffb000/0x2000)=nil, 0x2000}, &(0x7f0000000140)=0x10) ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0x9) fcntl$setstatus(r0, 0x4, 0x46800) sendmmsg(r0, &(0x7f000000ac80), 0x400000000000302, 0x0) socket$inet6(0xa, 0xe, 0x5) 12:52:10 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) ioctl$SCSI_IOCTL_STOP_UNIT(r0, 0x6) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000080)=0xc) fcntl$setown(r0, 0x8, r1) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:52:10 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000060107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:52:10 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x80045430, 0x0) 12:52:10 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000000)=ANY=[@ANYBLOB="04000000ebf52021a28ba513c55b4b6b1503e0edffdbea91b596713e705da326040a83387a9907d162a5a60f3711eb2088bc121bab5af4541c46870692b84d5faff0b9cfc641d2edd3b428491879e6214ca2ba1842afc3f25e1aab8677a6d738b04c9e18ed22e5baa9af8a28300221ee2d51166b3ae73c5dea873c7ba44d70a4280fa08aba00", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000000001000000000000000000000048ba1dbce83ad52a"], 0x48}}, 0x0) 12:52:10 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000070107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:52:10 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000000)=ANY=[@ANYBLOB="0400"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="b45100000100000000000000ff070000ba1dbce88e82da89683ad52a"], 0x48}}, 0x0) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm_plock\x00', 0x0, 0x0) socket$can_bcm(0x1d, 0x2, 0x2) bind$netlink(r2, &(0x7f00000000c0)={0x10, 0x0, 0x25dfdbfb, 0x20000}, 0xc) [ 1346.857739] Bluetooth: hci0: command 0x1003 tx timeout [ 1346.863130] Bluetooth: hci0: sending frame failed (-49) [ 1347.657746] Bluetooth: hci1: command 0x1003 tx timeout [ 1347.663135] Bluetooth: hci1: sending frame failed (-49) [ 1348.937755] Bluetooth: hci0: command 0x1001 tx timeout [ 1348.943171] Bluetooth: hci0: sending frame failed (-49) [ 1349.737810] Bluetooth: hci1: command 0x1001 tx timeout [ 1349.743221] Bluetooth: hci1: sending frame failed (-49) [ 1351.017758] Bluetooth: hci0: command 0x1009 tx timeout [ 1351.817758] Bluetooth: hci1: command 0x1009 tx timeout 12:52:21 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x1000000) 12:52:21 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$CAPI_MANUFACTURER_CMD(r0, 0xc0104320, &(0x7f0000000000)={0x477, &(0x7f0000000080)="3283079546c2bc1e7c787befbd78dcbbd24c3c8738523b755c1ef2e7ef2158e5a08c6acbc98e2cbd0af5bae2d557d9e8589137dad99dd8d199dc48fc04595a619a89a4524422e030eb425a448f9fb3926962759193a21717f3d1ecc16dafeae72f5d64933d7baba95b7cb0a2c7593db93b0b5ce7c83b613c933118c76830312fb602658407fa1880ce96057b3b10b27dc780e56e35293307d434a7486e5fe948dbb9f0f657eb7c8415f8b691e696f97cc5"}) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000180)=0x2, 0x4) ioctl$TUNGETFEATURES(r0, 0x800454cf, &(0x7f00000001c0)) pipe2(&(0x7f0000000140), 0x80000) 12:52:21 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x80045432, 0x0) 12:52:21 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f00000a0107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:52:21 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x800, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000980)={0x0, @in={{0x2, 0x4e21, @multicast1}}, 0x1, 0x80}, &(0x7f0000000a40)=0x90) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000a80)={0x0, 0x9}, &(0x7f0000000ac0)=0x8) r4 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000e00)='NET_DM\x00') ioctl$SG_SET_KEEP_ORPHAN(r1, 0x2287, &(0x7f0000000f00)=0x1) sendmsg$NET_DM_CMD_START(r1, &(0x7f0000000ec0)={&(0x7f0000000dc0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000e80)={&(0x7f0000000e40)={0x14, r4, 0x300, 0x70bd2a, 0x25dfdbfb, {}, ["", "", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0xc084}, 0x800) sendmmsg$inet_sctp(r1, &(0x7f0000000c00)=[{&(0x7f0000000040)=@in6={0xa, 0x4e23, 0x9, @local, 0x10000}, 0x1c, &(0x7f0000000840)=[{&(0x7f0000000080)="ff79abebf796fd31f68b2771df208dac8afc2d0a81e1a6a96001510c30d3dbdd0af75597857c0ca739b3a96c8a0734bac70e8bd3007c2249fab962776e6543c10fcb5a097741a811a3d06cc9ed029a9a49bea7d353ad815e8f2a341e4f5a90f6c8cd915694821a3cdc9279ba80c004", 0x6f}, {&(0x7f0000000100)="4a7ec2b37854baa9f83038e11f7260c952104f01e29300de2d0f6815e0cb", 0x1e}, {&(0x7f0000000140)="5e1f775832fcb19704ec372e86525819a0e0aa3799c591c8f19d0768177ad794e1b39f8eb35ff239e20c680f93d0a744405d115eb5bb63456b9b370c998661be2c6dc0265fc23d0bb3c06aeae9e79d850d94a9bccdebcd0be1240f7ef49d19a7d28152c118f9b105a4d2b68d9bdcb814867f51f6e46dbb0c42edcb5723e6be022b2785ea7ff76298ce5ca5f237afe8fb569ee2d130338aa7fd00b0859aab9bc6b9d79454558359b096d15b9020b0e82f2d5ea590e8a46f04cd8c714531c0ebb5ebbf0db2e682017492cdf785d315e2c67936f8549196a01554a70b6daca122c1e672db", 0xe3}, {&(0x7f0000000240)="95e0d8697179d36b6960fa41b41293ff40209f0771916c1078b675f60aab921d280f3031564232e2613eca9a7c61df6f7856e574905f3d26dc123d1de36233d951e55c5f11da56eb2e00def92c86b00002ad510d64682fdee9abc086b2cf53f68b67431efdaac0ea698a428af2b0b5e29cc77417d36d7998e9e1172527ae7143c4dfe1dd26bee665e6c658722c58177357d3425b6f2faa68070cfb8904ef87cf5f51c06bc4bd79c3e36eb52d3a6cb02ac86508bd34a6214168bd9af00dcb29ba59c570368bdf4a574f73703ec98e", 0xce}, {&(0x7f0000000340)="fb22d3b6dfc41dde55193805b3b6fa6e025647ffe144aa6cd6ac82bd3ea971a97354b25ba40fcf43ed475adda1b592e7ad462882e877a3f7ba47627f8242d478016ae0", 0x43}, {&(0x7f00000003c0)="e2f63c607764fe0d4c62b88e044b32a1376b822db69e1b4f6389f2fc32cbf18bf0893592781cdbf10aa496a5400587270ab732a7bf371f3fc5530b661c63b60274", 0x41}, {&(0x7f00000004c0)="9271804059f832e6332dd6c9f931f9fac26846cf31239bcf58ffc99fc4cdc7a9b9e325ac677aa1b3ab4559bfd1b189c1c25cc174020bb67de9463d38bdf9c879f701e0b80aac39e0aa6a02ff51ac476a0ce7baabeb14cbedf7775d44da810fdc7653992eed367b2573a81d8dbec6765143acdbb6f6c53aea7fb57f7c64ff22f5c300e188259be8ced96052bc7d3265d46a2fea217206b1f0229e22c703ad98fe316c3c350b0a78cff9a49354f8cb998b2a2c0ed43f39e5aef7ae1c931269b091dbb7", 0xc2}, {&(0x7f0000000780)="840ed3c670bedc2912249b06074da37c503045ff4a7cf38ced56423a69849e51d71cc0f4b89e076eb7026b8acdad719120f93eb0adb1284acc9da582c958eed4a52b75d79636226bd430ee77a404808179983957c499e741afa6f0056dfa63f84154cc269b31ab01039862261bc39425bd6016440b82809ce4efa6a4248f9ac6e768158ec39c2867bed8c1a67eb1e0bab8fe4644139ae0e8fc6ccd", 0x9b}], 0x8, 0x0, 0x0, 0x10}, {&(0x7f0000000440)=@in={0x2, 0x4e22, @local}, 0x10, &(0x7f0000000940)=[{&(0x7f0000000640)="097ccbb4aa92f9e021b676a0de9b79f11d1e7bd6a718103e9be4632a5794221b1755dff9de43", 0x26}, {&(0x7f00000008c0)="bac38a2deed95ab6b981", 0xa}, {&(0x7f0000000900)="b4df18e5aa7262c5389d1c67fd701236049fc5d4bcb6658998f655c8", 0x1c}], 0x3, &(0x7f0000000b00)=[@prinfo={0x18, 0x84, 0x5, {0x30, 0x4}}, @init={0x18, 0x84, 0x0, {0x9a5, 0x1, 0x3, 0x4}}, @authinfo={0x18, 0x84, 0x6, {0x6}}, @dstaddrv4={0x18, 0x84, 0x7, @empty}, @sndinfo={0x20, 0x84, 0x2, {0xffffffff, 0x8000, 0xff, 0x3f, r2}}, @dstaddrv6={0x20, 0x84, 0x8, @remote}, @sndrcv={0x30, 0x84, 0x1, {0x0, 0xc5, 0x8008, 0x5d70, 0x7ff, 0x3ff, 0x100000001, 0x100000001, r3}}], 0xd0, 0x44000}], 0x2, 0x4000000) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r5}, 0x10, &(0x7f0000000700)={&(0x7f0000000c80)=ANY=[@ANYBLOB="0400"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0200000001000000000000000000000048ba1dbce83ad52a750f7d7df4d370f66c6856d752a0f3680062a0f83a65202a3254915e4e7759de2ba44f9502d4220118d988ae3f085c670af43ad69305a2ce4db1be941224f366b94fd819d2cc0a9d799686de222d849b3208a83674ad4b8e69ef29d1b8535d73057c9def3bf3510631658042dc61b20f2053958c8bdc304ec36fc91666a893d4f862cc453cae1e00c0942573afedc039e3e729895701c1793ded5ecfdc2d37bed195efb8fa0aa7b075a9d67cd3df012b3d433cafa11a2ea1137e07e6017df2bea9"], 0x48}}, 0x0) bind(r0, &(0x7f0000000680)=@ax25={{0x3, @default}, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x80) syz_genetlink_get_family_id$net_dm(&(0x7f0000000f40)='NET_DM\x00') 12:52:21 executing program 3: socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(0xffffffffffffffff, &(0x7f0000000480), 0x10) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$radio(0x0, 0x2, 0x2) ioctl$sock_inet_SIOCSIFNETMASK(0xffffffffffffffff, 0x891c, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0x5) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) r2 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x9, 0x1000000000054}, 0x98) [ 1356.261156] QAT: Invalid ioctl [ 1356.287812] QAT: Invalid ioctl 12:52:21 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f00000e0107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:52:21 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x80045438, 0x0) 12:52:21 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000540)='/selinux/policy\x00', 0x0, 0x0) connect$can_bcm(r1, &(0x7f0000000580), 0xfffffffd) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00'}) stat(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) r4 = getegid() r5 = getegid() getresgid(&(0x7f00000001c0), &(0x7f0000000200), &(0x7f0000000240)=0x0) getresgid(&(0x7f0000000280), &(0x7f00000002c0), &(0x7f0000000300)=0x0) socket$can_raw(0x1d, 0x3, 0x1) r8 = getegid() fstat(r0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fsetxattr$system_posix_acl(r0, &(0x7f0000000040)='system.posix_acl_access\x00', &(0x7f00000003c0)=ANY=[@ANYBLOB="02000000010002000000210002000400", @ANYRES32=r2, @ANYBLOB="02000100", @ANYRES32=r3, @ANYBLOB="040006000000000008000500", @ANYRES32=r4, @ANYBLOB="08000600", @ANYRES32=r5, @ANYBLOB="08000500", @ANYRES32=r6, @ANYBLOB="08000100", @ANYRES32=r7, @ANYBLOB="08000500", @ANYRES32=r8, @ANYBLOB="08000100", @ANYRES32=r9, @ANYBLOB="10000200000000002000020000000000"], 0x64, 0x3) sendmsg$can_bcm(r0, &(0x7f0000000000)={&(0x7f0000000600), 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) 12:52:22 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) get_mempolicy(&(0x7f0000000000), &(0x7f0000000100), 0x40, &(0x7f0000ffe000/0x2000)=nil, 0x1) write$P9_RSTAT(r0, &(0x7f0000000080)={0x67, 0x7d, 0x2, {0x0, 0x60, 0x100000001, 0x7ff, {0x24, 0x4, 0x6}, 0xcc000000, 0x0, 0x8, 0xfffffffffffffe01, 0x0, '', 0x13, 'GPLvmnet0security]&', 0x15, '/dev/bus/usb/00#/00#\x00', 0x5, '\'user'}}, 0x67) [ 1356.360428] Bluetooth: hci0: Frame reassembly failed (-84) 12:52:22 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f00000f0107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:52:22 executing program 3: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x800) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000040)={0xffffffffffffffff}) setsockopt$IP_VS_SO_SET_EDITDEST(r0, 0x0, 0x489, &(0x7f0000000080)={{0xff, @local, 0x0, 0x2, 'lblcr\x00', 0x0, 0x8, 0x79}, {@broadcast, 0x4e22, 0x10000, 0xb3, 0x1000}}, 0x44) readv(r0, &(0x7f00000001c0)=[{0x0}], 0x1) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=0x0) ioctl$sock_netdev_private(r0, 0x89fc, &(0x7f0000000300)="45dd94b80393d9b37cfa2874c5a794395097027729873aaf59eb8cfb70912429cc4f99e74dcff258a2a19c3f15d933d989bbbd69a3106153494b9b6a705625bfd76776") syz_open_dev$loop(0x0, 0x0, 0x0) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r2, 0x89a1, &(0x7f00000000c0)={@local={0xfe, 0x80, [0x600, 0x3ef, 0x0, 0x3f00000000000000, 0x100000000000000, 0x0, 0x1103, 0x0, 0x0, 0x0, 0x0, 0x6]}}) ioctl$sock_inet6_SIOCADDRT(r2, 0x89a0, &(0x7f0000000100)={@local={0xfe, 0x80, [0x0, 0xfeff0000]}, @empty, @loopback}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) open(&(0x7f0000000280)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000a60000/0x4000)=nil, 0x4000, 0x8, 0x20810, 0xffffffffffffffff, 0x0) r3 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000200)='/dev/qat_adf_ctl\x00', 0x0, 0x0) ioctl$KDSKBSENT(r3, 0x4b49, &(0x7f0000000240)="f6d9f95adcf31e0303052573e578ab762ef82244022ba5556ea627f22183a44dde258f2440cbcde93fc735b24c0b5ad281b784cbf31304502d329e74de2bf3aa7d3e7352f70aa2b8b054f140c9b4f596f1498ff449dfa8e83c152ca7828892177b4d58d7f6aa212ca0a871d8ebc9e36755aafaaa6778fc8a08650b9af9081cd65211d0ae8d44d9e5d828d2c54f6742017954cb123d39a4a16c5adf7085c7ee3504377e819a25") tgkill(r1, 0x0, 0x1) [ 1358.377729] Bluetooth: hci0: command 0x1003 tx timeout [ 1358.384372] Bluetooth: hci0: sending frame failed (-49) [ 1359.177722] Bluetooth: hci1: command 0x1003 tx timeout [ 1359.183205] Bluetooth: hci1: sending frame failed (-49) [ 1360.457806] Bluetooth: hci0: command 0x1001 tx timeout [ 1360.463220] Bluetooth: hci0: sending frame failed (-49) [ 1361.257800] Bluetooth: hci1: command 0x1001 tx timeout [ 1361.263267] Bluetooth: hci1: sending frame failed (-49) [ 1362.547804] Bluetooth: hci0: command 0x1009 tx timeout [ 1363.337762] Bluetooth: hci1: command 0x1009 tx timeout 12:52:33 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x3f000000) 12:52:33 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x80045439, 0x0) 12:52:33 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) setsockopt$TIPC_MCAST_REPLICAST(r0, 0x10f, 0x86) setsockopt$ax25_SO_BINDTODEVICE(r0, 0x101, 0x19, &(0x7f0000000000)=@bpq0='bpq0\x00', 0x10) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:52:33 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000480107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:52:33 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x19a) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="11dca50d5e0bcfe47bf070") mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', 0x0, 0x100000, 0x0) mount(0x0, &(0x7f0000000080)='.', 0x0, 0xffffffffffffffff, 0x0) mount(&(0x7f0000000000), &(0x7f00000000c0)='.', 0x0, 0x23080, 0x0) mount(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x80000, 0x0) mount(&(0x7f0000000080), &(0x7f0000187ff8)='.', 0x0, 0x5010, 0x0) mount(&(0x7f0000000080), &(0x7f0000000140)='.', 0x0, 0x5110, 0x0) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vsock\x00', 0x50000, 0x0) ioctl$KVM_GET_DEBUGREGS(r2, 0x8080aea1, &(0x7f0000000340)) getpeername$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000002c0)=0x14) bind$xdp(r2, &(0x7f0000000300)={0x2c, 0x2, r3, 0x30, r2}, 0x10) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') ioctl$NBD_SET_SIZE(r2, 0xab02, 0x80000000) sendmsg$IPVS_CMD_FLUSH(r2, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, r4, 0xa02, 0x70bd2c, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x4000011}, 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) socket$can_bcm(0x1d, 0x2, 0x2) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r5}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[@ANYBLOB="0400"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="000200003a0c39a704819d2b0000000d48ba1dbce83ad52a"], 0x48}}, 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='trusted.overlay.origin\x00', &(0x7f0000000080)='y\x00', 0x2, 0x1) 12:52:33 executing program 3: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x800) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000040)={0xffffffffffffffff}) setsockopt$IP_VS_SO_SET_EDITDEST(r0, 0x0, 0x489, &(0x7f0000000080)={{0xff, @local, 0x4e22, 0x2, 'lblcr\x00', 0x7, 0x8, 0x79}, {@broadcast, 0x4e22, 0x10000, 0xb3, 0x1000}}, 0x44) readv(r0, &(0x7f00000001c0)=[{&(0x7f0000000100)=""/177, 0xfffffffffffffe11}], 0x328) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=0x0) ioctl$sock_netdev_private(r0, 0x89fc, &(0x7f0000000300)="45dd94b80393d9b37cfa2874c5a794395097027729873aaf59eb8cfb70912429cc4f99e74dcff258a2a19c3f15d933d989bbbd69a3106153494b9b6a705625bfd76776") syz_open_dev$loop(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) prctl$PR_GET_FP_MODE(0x2e) r3 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r3, 0x89a1, &(0x7f00000000c0)={@local={0xfe, 0x80, [0x600, 0x3ef, 0x0, 0x3f00000000000000, 0x100000000000000, 0x0, 0x1103, 0x0, 0x0, 0x0, 0x0, 0x6]}}) ioctl$sock_inet6_SIOCADDRT(r3, 0x89a0, &(0x7f0000000100)={@local={0xfe, 0x80, [0x0, 0xfeff0000]}, @empty, @loopback}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) open(&(0x7f0000000280)='./bus\x00', 0x0, 0x0) dup(r2) mmap(&(0x7f0000a60000/0x4000)=nil, 0x4000, 0x8, 0x20810, 0xffffffffffffffff, 0x0) r4 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000200)='/dev/qat_adf_ctl\x00', 0x0, 0x0) ioctl$KDSKBSENT(r4, 0x4b49, &(0x7f0000000240)="f6d9f95adcf31e0303052573e578ab762ef82244022ba5556ea627f22183a44dde258f2440cbcde93fc735b24c0b5ad281b784cbf31304502d329e74de2bf3aa7d3e7352f70aa2b8b054f140c9b4f596f1498ff449dfa8e83c152ca7828892177b4d58d7f6aa212ca0a871d8ebc9e36755aafaaa6778fc8a08650b9af9081cd65211d0ae8d44d9e5d828d2c54f6742017954cb123d39a4a16c5adf7085c7ee3504377e819a25") tgkill(r1, 0x0, 0x1) 12:52:33 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x80045440, 0x0) 12:52:33 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f00004c0107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:52:33 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x1) [ 1367.849475] Bluetooth: hci0: Frame reassembly failed (-84) 12:52:33 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) ioctl$TIOCLINUX5(r0, 0x541c, &(0x7f0000000000)={0x5, 0x3ff, 0x9, 0x5, 0xfffffffffffffffa}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000f00)={0x0, 0x0}, &(0x7f0000000f40)=0xfffffffffffffe59) connect$netrom(0xffffffffffffffff, &(0x7f0000000dc0)={{0x3, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x3}, [@bcast, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, 0x48) r2 = geteuid() getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000300)={0x0, 0x0, 0x0}, &(0x7f0000000340)=0xc) fstat(r0, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000400)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000001f000000060000001009000018070000a80400000000000018070000a8040000400800004008000040080000400800004008000006000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB='\x00'/96], @ANYBLOB="ff020000000000000000000000000001542f411e9e79e70a35ebf94f08a58aaaffffffffff000000ffffffff000000ffffffffff00000000ffffffff000000006970365f76746930000000000000000065727370616e30000000000000000000000000000000000000ff0000000000000000000000000000000000000000000000000000000000ff000000000000000000000000000000006c00060470000000000000000000000000000000c80010010000000000000000000000000000000000000000000000004800534e50540000000000000000000000000000000000000000000000000000fe8000000000000000000000000000bb00000000000000000000000000000001210008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200148010000000000000000000000000000000000000000000000002800727066696c7465720000000000000000000000000000000000000000000001000000000000003000737268000000000000000000000000000000000000000000000000000000290303e00300090001210000000000002800484c000000000000000000000000000000000000000000000000000000000106000000000000ff020000000000000000000000000001213ac4af2cf64a048a85a48ff2780f18000000ffffffffffffffffffffffffff00000000ffffffffffffffff0000000062617461647630000000000000000000687773696d300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002100ff04f9000000000000000000000000000000280250020000000000000000000000000000000000000000000000002800657569363400000000000000000000000000000000000000000000000000000000000000000038017274000000000000000000000000000000000000000000000000000000000900000001f9ffff050000000400000030020000ff020000000000000000000000000001000000000000000000000000000000010000000000000000000000000000000000000000000000000000ffff0000d2619989871fefcb2547d3a6f1155b7639eafe8800000000000000000000000000013b16e8a398c91096c6bea41e6d575966fe8000000000000000000000000000bbff01000000000000000000000000000136460fca5138af4ce547c703f979ff7d00000000000000000000ffffe0000001fe88000000000000000000000000000100000000000000000000000000000001fe80000000000000000000000000000ffe8000000000000000000000000000bb00000000000000000000000000000000050000002800544f530000000000000000000000000000000000000000000000000000000008000000000000836b8590173ddf6d52db729d68455ac3ff010000000000000000000000000001ffffff00000000ffffffffffffffff00000000ffffffff000000000000000000697036746e6c3000000000000000000062707130000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000000000000000000000000000000000800004000000000000000000000000000000280270020000000000000000000000000000000000000000000000003801727400000000000000000000000000000000000000000000000000000000010000000300000000ffffff0104000035000000d48b1c01813fb7f2f08c134943ee113300000000000000000000000000000000fe800000000000000000000000000016fe80000000000000000000000000001e00000000000000000000000000000001ff020000000000000000000000000001ff010000000000000000000000000001486445f35c19eb1a44d8930087714cf2fe8000000000000000000000000000aa00000000000000000000ffffffffffffff01000000000000000000000000000100000000000000000000000000000001fe8000000000000000000000000000aafe8000000000000000000000000000aa00000000000000000000000000000000fe8000000000000000000000000000bb03000000280069707636686561646572000000000000000000000000000000000000000020040100000000004800534e5054000000000000000000000000000000000000000000000000000020c5426b3fb1dbe1249f5f0adee1d9ee000045cf0000000000000000000000002e2e020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001280100000000000000000000000000000000000000000000000038006f776e657200"/2048, @ANYRES32=r1, @ANYRES32=r2, @ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="03030000000000002800484c0000000000000000000000000000000000000000000000000000000001040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a800d00000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff00000000"], 0x970) setxattr$trusted_overlay_upper(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='trusted.overlay.upper\x00', &(0x7f0000000100)={0x0, 0xfb, 0xcd, 0x492364b77a308901, 0x3917, "894eb9f538a9c27c00973a6b8993169c", "b52060aa97df3772cc40d3eb5a4fbfa38f504576773be5dc83cecad5154803030601015780e154b5822784d0a2e63477da251311780a2182da67fe15fd9f98687f53bfbb5899cd3854e8ad4c7f24582cfd68746fdd1b0516c085a6b643aff6ed176aed1a3733ca6c0abd0ab0475890f425cd270d87ab4d44587f9c491191a37dd08f2fca07bdd5497ee8b0d5de48e2f271fa5e08d9f4d08250d5eeef8b046d3903d9c3ba026f07bed3bfabc4b4510ff8de7588aa5efe0f4b"}, 0xcd, 0x3) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) syz_open_dev$vcsa(&(0x7f0000000d80)='/dev/vcsa#\x00', 0x26c4000000, 0x20000) 12:52:33 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000600107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:52:33 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x80086601, 0x0) [ 1369.897725] Bluetooth: hci0: command 0x1003 tx timeout [ 1369.903133] Bluetooth: hci0: sending frame failed (-49) [ 1370.697699] Bluetooth: hci1: command 0x1003 tx timeout [ 1370.703109] Bluetooth: hci1: sending frame failed (-49) [ 1371.977818] Bluetooth: hci0: command 0x1001 tx timeout [ 1371.983234] Bluetooth: hci0: sending frame failed (-49) [ 1372.777778] Bluetooth: hci1: command 0x1001 tx timeout [ 1372.783196] Bluetooth: hci1: sending frame failed (-49) [ 1374.057797] Bluetooth: hci0: command 0x1009 tx timeout [ 1374.857769] Bluetooth: hci1: command 0x1009 tx timeout 12:52:44 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x40000000) 12:52:44 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000580)="11dca50d5e0bcfe47bf070") r1 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0xfffffffffffffffc) r2 = fcntl$dupfd(r1, 0x0, r1) write$P9_RSTATFS(r2, &(0x7f00000002c0)={0x43}, 0x43) sendfile(r1, r1, &(0x7f0000000080), 0xa198) 12:52:44 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000680107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:52:44 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', 0x40000fffffb, 0x400000) getsockopt$netlink(r0, 0x10e, 0x7, &(0x7f00000000c0)=""/226, &(0x7f0000000000)=0xe2) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) getsockopt$X25_QBITINCL(r0, 0x106, 0x1, &(0x7f0000000040), &(0x7f00000001c0)=0x4) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:52:44 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x80087601, 0x0) 12:52:44 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = dup(r0) ioctl$DRM_IOCTL_DROP_MASTER(r1, 0x641f) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) 12:52:44 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) fsetxattr$security_smack_transmute(r0, &(0x7f0000000000)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000080)='TRUE', 0x4, 0x3) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:52:44 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f00006c0107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:52:45 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffc) r2 = add_key(&(0x7f0000000080)='asymmetric\x00', &(0x7f00000000c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffa) keyctl$link(0x8, r1, r2) recvmmsg(r0, &(0x7f0000004500)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000002c0)=""/1, 0x1}, {&(0x7f0000000780)=""/4096, 0x1000}, {&(0x7f0000000300)=""/106, 0x6a}], 0x3, &(0x7f00000003c0)=""/77, 0x4d}, 0xfffffffffffffffb}, {{&(0x7f00000004c0)=@l2, 0x80, &(0x7f0000000640)=[{&(0x7f0000001780)=""/229, 0xe5}, {&(0x7f0000000440)=""/29, 0x1d}, {&(0x7f0000000540)=""/75, 0x4b}, {&(0x7f0000001880)=""/97, 0x61}], 0x4, &(0x7f0000001900)=""/88, 0x58}, 0x2}, {{&(0x7f0000001980)=@pppoe={0x18, 0x0, {0x0, @link_local}}, 0x80, &(0x7f0000002f40)=[{&(0x7f0000001a00)=""/123, 0x7b}, {&(0x7f0000001a80)=""/4096, 0x1000}, {&(0x7f0000002a80)=""/113, 0x71}, {&(0x7f0000002b00)=""/231, 0xe7}, {&(0x7f0000002c00)=""/83, 0x53}, {&(0x7f0000002c80)=""/117, 0x75}, {&(0x7f0000002d00)=""/2, 0x2}, {&(0x7f0000002d40)=""/225, 0xe1}, {&(0x7f0000002e40)=""/115, 0x73}, {&(0x7f0000002ec0)=""/125, 0x7d}], 0xa, &(0x7f0000003000)=""/165, 0xa5}, 0x1946}, {{&(0x7f00000030c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x80, &(0x7f0000003380)=[{&(0x7f0000003140)=""/93, 0x5d}, {&(0x7f00000031c0)=""/254, 0xfe}, {&(0x7f00000032c0)=""/32, 0x20}, {&(0x7f0000003300)=""/105, 0x69}], 0x4, &(0x7f00000033c0)=""/127, 0x7f}, 0x7}, {{&(0x7f0000003440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @empty}}}, 0x80, &(0x7f00000044c0)=[{&(0x7f00000034c0)=""/4096, 0x1000}], 0x1}, 0x40}], 0x5, 0x2100, 0x0) r3 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/status\x00', 0x0, 0x0) ioctl$VHOST_SET_OWNER(r3, 0xaf01, 0x0) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r4}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) r5 = openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x200000, 0x0) ioctl$TCSETXF(r5, 0x5434, &(0x7f0000000140)={0x5, 0x73, [0x22, 0x0, 0xbedd, 0x5, 0xbf51]}) setsockopt$llc_int(r5, 0x10c, 0x8, &(0x7f0000000240)=0x100000001, 0x4) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r5, 0xc0bc5310, &(0x7f0000000180)) [ 1379.389141] Bluetooth: hci0: Frame reassembly failed (-84) 12:52:45 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0xc0045878, 0x0) 12:52:45 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x40000fffffe, 0x4) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$VIDIOC_ENUMOUTPUT(r0, 0xc0485630, &(0x7f0000000040)={0x8e30, "f160e09e72f3a32de133f6490c91c2874047f716aa010140d58581f50e689bc4", 0x5, 0x7d, 0x5, 0x5d78f94882dd3ec0, 0x6}) 12:52:45 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000740107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) [ 1380.149330] Bluetooth: hci1: Frame reassembly failed (-84) [ 1381.417732] Bluetooth: hci0: command 0x1003 tx timeout [ 1381.423186] Bluetooth: hci0: sending frame failed (-49) [ 1382.217797] Bluetooth: hci1: command 0x1003 tx timeout [ 1382.223200] Bluetooth: hci1: sending frame failed (-49) [ 1383.497731] Bluetooth: hci0: command 0x1001 tx timeout [ 1383.503204] Bluetooth: hci0: sending frame failed (-49) [ 1384.297826] Bluetooth: hci1: command 0x1001 tx timeout [ 1384.303292] Bluetooth: hci1: sending frame failed (-49) [ 1385.577812] Bluetooth: hci0: command 0x1009 tx timeout [ 1386.377767] Bluetooth: hci1: command 0x1009 tx timeout 12:52:56 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0xfeffffff) 12:52:56 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0xc0045878, 0x0) 12:52:56 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) mremap(&(0x7f0000ff9000/0x5000)=nil, 0x5000, 0x3000, 0x0, &(0x7f0000ffc000/0x3000)=nil) 12:52:56 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f00007a0107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:52:56 executing program 3: unshare(0x20020000) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='devpts\x00vh\xd2p!s\n@ha.\xc1\x88\x05\x89\x1d\b\xb3Xd\x92Y\x1b\x8c\xc0\xd0\xf4\x952\x8c!JC\xd1]Ul\xa2\x80\x19\x88 \xd4b\x0f\x87\x89P\xb4M\xf7]w\xa9\xb6\xc3}\x16\f\x87ueg$\xd9,\x8c\x9b\xbb*\xfe\x95\xb8\xa1\x9aVA\xb73w\xdf/\xa9\xc5\x8e\xe1\xef\xc5\x8d\x168\xba\"\x83\x8b\xe2\xf7*\xfa\xd20a\x94\xc7yiF\a\v\x14\xd2\xc1z\x94\x9d\x9d\a*\xab\xea\xd9Ee\xac\xa28p\xa2\xa1\x9a;\xb4o\xa0\xf1\xd7&[2\xf2\x82\xbc\xc2tu\xfb\xf5\xb1Y\xd6\xa9\x1b\xbec\xdeA\x8d\x94W)\x93,\xac\x02\x86\xd1\r\x00\xefZ\xf3Y\x84\xdbF\xf2u\xa1\x8b_\x9fe\xfe[q\xb1\\\xcen\bC \x81', 0x0, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) semget$private(0x0, 0x0, 0x600) getsockopt$bt_BT_POWER(0xffffffffffffffff, 0x112, 0x9, &(0x7f0000000700)=0x6, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) rmdir(&(0x7f0000000080)='./file0\x00') ioctl$sock_inet_SIOCGIFBRDADDR(r0, 0x8919, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, 0x0) r1 = gettid() chroot(&(0x7f00000003c0)='./file0\x00') rt_tgsigqueueinfo(0x0, r1, 0x34, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) perf_event_open(&(0x7f0000000100)={0x0, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000500)='/dev/full\x00', 0x0, 0x0) getresuid(0x0, 0x0, 0x0) getresgid(0x0, 0x0, 0x0) geteuid() 12:52:56 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[@ANYBLOB="0400"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="000037a941e20000000000000000000048ba1dbce83ad52a"], 0x48}}, 0x0) 12:52:56 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000e00107ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:52:56 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$sock_SIOCGSKNS(r0, 0x894c, &(0x7f0000000000)) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) [ 1390.891735] Bluetooth: hci0: Frame reassembly failed (-84) 12:52:56 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0xc0189436, 0x0) 12:52:56 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000180)='/dev/bus/usb/00#/00#\x00', 0xff, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:52:56 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000507ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:52:56 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000000)=ANY=[@ANYBLOB="040000000000002bf4f3c1000001000031a1d15a0a2e532ad267648137e79db37755f0e975c93f967bc51f7d824953d514b74f7d0040f20000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000000001000000000000000000000048ba1dbce83ad52a"], 0x48}}, 0x0) [ 1392.937697] Bluetooth: hci0: command 0x1003 tx timeout [ 1392.943103] Bluetooth: hci0: sending frame failed (-49) [ 1393.737754] Bluetooth: hci1: command 0x1003 tx timeout [ 1393.743237] Bluetooth: hci1: sending frame failed (-49) [ 1395.017791] Bluetooth: hci0: command 0x1001 tx timeout [ 1395.023202] Bluetooth: hci0: sending frame failed (-49) [ 1395.817831] Bluetooth: hci1: command 0x1001 tx timeout [ 1395.823311] Bluetooth: hci1: sending frame failed (-49) [ 1397.097767] Bluetooth: hci0: command 0x1009 tx timeout [ 1397.897795] Bluetooth: hci1: command 0x1009 tx timeout 12:53:07 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0xffffff7f) 12:53:07 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x2172, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffc000/0x1000)=nil) syz_open_procfs(0x0, &(0x7f00000000c0)='net/if_inet6\x00') 12:53:07 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x800000000) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:53:07 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0xc020660b, 0x0) 12:53:07 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000022307ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:53:07 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000003c0)={@mcast2}, &(0x7f0000000400)=0x14) connect$can_bcm(r0, &(0x7f0000000480), 0x10) r1 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x8, 0x4100) mbind(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, &(0x7f00000002c0)=0x6, 0x400, 0x2) ioctl$ASHMEM_GET_PIN_STATUS(r1, 0x7709, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f0000000040)) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000700)={&(0x7f0000000140)=ANY=[@ANYBLOB="0400"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000000001000000020000000000000048bb1dbce83ad52af227f064436cc2c7972512aeb794bd3e431a3ebec45e4cf0261014a0568ed27012ad01a0b0563203a864f6104381fc3ab7a05c7feb949dce457fd0ba84cbe40e73d3b25e1d4a3209ad8aaca3abe2799ebdf334d4ee7b484f20d47eec0369002d5f7265ab0c46ada132312829c8a2468be30d433ef82ffaead25d936479d97c48628fad2f32dc5640a3880b77157afa7e271a502ff8d794b6a568a1cea3228cd96c082f704d9bd41184d903aa0887490341a06b38e9ed00ba19691cfba17553f2b5a15cef53363a3fb9d51e0781c44223ad4e9d5b2525534d4b977088f995c24c0de894f61cc8d5cc553c2cf1529357fc98e4e256e7c78b2b739377371501a6c6032a01bf7a55890a266d0451d852667f96c2ae4464"], 0x48}}, 0x0) 12:53:07 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000040)={{{@in=@initdev, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in=@dev}}, &(0x7f0000000140)=0xe8) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vcan0\x00', r1}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) 12:53:08 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000002507ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:53:08 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f0000000080)={0x4, {{0x2, 0x4e22, @multicast2}}, 0x1, 0x2, [{{0x2, 0x4e23, @loopback}}, {{0x2, 0x4e21, @multicast2}}]}, 0x190) 12:53:08 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000580)="11dca50d5e0bcfe47bf070") perf_event_open(&(0x7f00000000c0)={0x2, 0x70, 0x10001, 0x80000004, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) write$P9_RSTATFS(r2, &(0x7f00000002c0)={0x43, 0x9, 0x0, {0x0, 0x0, 0x0, 0x0, 0x40}}, 0x43) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd) getuid() perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000000080), 0xa198) 12:53:08 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x2) 12:53:08 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000003f07ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) [ 1404.457737] Bluetooth: hci0: command 0x1003 tx timeout [ 1404.463159] Bluetooth: hci0: sending frame failed (-49) [ 1405.257764] Bluetooth: hci1: command 0x1003 tx timeout [ 1405.263190] Bluetooth: hci1: sending frame failed (-49) [ 1406.547787] Bluetooth: hci0: command 0x1001 tx timeout [ 1406.553172] Bluetooth: hci0: sending frame failed (-49) [ 1407.337774] Bluetooth: hci1: command 0x1001 tx timeout [ 1407.343199] Bluetooth: hci1: sending frame failed (-49) [ 1408.617766] Bluetooth: hci0: command 0x1009 tx timeout [ 1409.417775] Bluetooth: hci1: command 0x1009 tx timeout 12:53:19 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000004007ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:53:19 executing program 5: r0 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x1, 0x101800) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000040)={0x0, 0x0}) write$P9_RGETLOCK(r0, &(0x7f0000000080)={0x24, 0x37, 0x2, {0x0, 0x81, 0x7, r1, 0x6, 'vcan0\x00'}}, 0x24) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r2, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) process_vm_readv(r1, &(0x7f0000000340)=[{&(0x7f00000000c0)=""/213, 0xd5}, {&(0x7f00000001c0)=""/174, 0xae}, {&(0x7f0000000280)}, {&(0x7f00000002c0)=""/86, 0x56}], 0x4, &(0x7f0000000840)=[{&(0x7f0000000380)=""/161, 0xa1}, {&(0x7f00000004c0)=""/112, 0x70}, {&(0x7f0000000440)=""/14, 0xe}, {&(0x7f0000000540)=""/17, 0x11}, {&(0x7f0000000780)=""/159, 0x9f}, {&(0x7f0000000580)=""/56, 0x38}], 0x6, 0x0) sendmsg$can_bcm(r2, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r3}, 0x10, &(0x7f0000000700)={&(0x7f00000008c0)=ANY=[@ANYBLOB="0400cc501ce3431d13c00c2b950a0d006f8500", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000000001000000000000000000000048ba1dbce83ad52a"], 0x48}}, 0x0) 12:53:19 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x1000000) 12:53:19 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='net/dev\x00') preadv(r0, &(0x7f0000000480), 0x2d1, 0x0) 12:53:19 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0xfffffffe) 12:53:19 executing program 0: syz_open_dev$loop(&(0x7f0000000140)='/dev/loop#\x00', 0x80000001, 0x4003) r0 = syz_open_dev$usb(&(0x7f0000000200)='/dev/bus/usb/00#/00#\x00', 0x8001, 0x80) r1 = syz_open_dev$audion(&(0x7f0000000180)='/dev/audio#\x00', 0x8, 0x20000) ioctl$KVM_SET_REGS(r1, 0x4090ae82, &(0x7f0000000300)={[0x1, 0xe9, 0xfffffffffffffff7, 0x6, 0x4, 0x2de, 0xddf8, 0x2, 0xfffffffffffff1cb, 0x9, 0x20, 0x79, 0x100000001, 0x80, 0x0, 0x1], 0x4, 0x20000}) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000000)=0x0) write$USERIO_CMD_SEND_INTERRUPT(r1, &(0x7f0000000040)={0x2, 0x200}, 0x2) move_pages(r2, 0x6, &(0x7f00000001c0)=[&(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000fef000/0x11000)=nil], &(0x7f00000000c0)=[0xd62, 0x6, 0x9], &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x6) keyctl$session_to_parent(0x12) openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/hwrng\x00', 0x4000, 0x0) ioctl$SIOCX25SCUDMATCHLEN(r0, 0x89e7, &(0x7f0000000240)={0x1c}) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x4000000000000) 12:53:19 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000005207ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:53:19 executing program 0: r0 = syz_open_dev$amidi(&(0x7f0000001500)='/dev/amidi#\x00', 0x2, 0x2100) sendmmsg$alg(r0, &(0x7f00000014c0)=[{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000080)="5d1df1286a61c9fa83f852b632e57a409d75bbcc43b5b1155ef70645961b46f7767aa392150e643406c227c2e2bc01cabf9ff253d546ddfbed3b9aad84e31bfea5d6d54c51d85ef733358dde4d67ab0187a1be3cb36794491a66ca65de5f2bec012ce7ec6778990259b627dbd742c4cf3725e511cb685242631c25", 0x7b}, {&(0x7f0000000100)="ae41d6085901cefaef9597b95ff5dfa8aab546bc8ebf031a57c2ecebd7c85094ddf134ac32d65284ef93e6823d5b602eddd0c9ee8ea40eb706ea34a677a8e9babefcfe97520c4efaeba4080784e03d6500de2c0e49d0e3373414256d250f8a5cd4c91bd8de6abd0b21f48dfaf728447837cfa5161e9e9a219076392a3f002247967e0b7cdf460c519e139516945a803ec0cab1530fde8bcc3e61e8e3e20a917ddb38e445a2e253cc9cbd14049143aeeb209068144ace65f1e868626b21f9b23ae336f895f6f8182a8912ee411878c820fe48f27ded5c602a5ac6ce622190", 0xde}, {&(0x7f0000000200)="d8b9e51467f1de2888c344f8f6577881060997f1f783d47a2246aa9acebe8ed5319c533cfa5fc2012225083dafcc1e4a2c3eac66edc99e2f823dee40e2ed3a2715d2273745c78b99134f314fb1c5b571837c15809bebfbfd78e09bfef1e38389abc1daa502fa857707dce343", 0x6c}, {&(0x7f0000000280)="b7d4163332dac4be7eef08a1479a119f937adfffff8b04ab4943e67c9bdbdcdd32f9626063003d2ac7c091f4e3599e1c2975de0f781431aafa70448e6114749f9d0a6aceb8491d06b1c761e362c0848a7810c6987bc6c654dcc5c941c66bbb0329ad7571a459006f04c4750f3579e1", 0x6f}, {&(0x7f0000000300)="f5936bd13348432af479588c821d4eb9259220992635b0b51358e6b10ac09b5c65e3a657be2925debe201854753085094e74b2581ca3", 0x36}], 0x5, &(0x7f00000003c0)=[@iv={0xa8, 0x117, 0x2, 0x8f, "119e6ff781ad2a0606e70880e46d6c7d8bbf5995d08ea711413cbdef5ec0b5c192e81df00214f9b7c6289662b7cbcc8e4a983bafb69064eaac5bd5b3791a962e11f1a173b06402e81484fd562f0877d534a753c1d0a7eb716b4cc7da24026bd25d64b08ddd6f3401d4b45416a868972642bb55d9366ebe03a55b6d362ebd44ec70bace67a59437b5842dbead42ce50"}, @assoc={0x18}, @iv={0x1018, 0x117, 0x2, 0x1000, "86cb38952e16bc364ace329c9ba1bddb074308abbacfe5c3a0258568a51e10695ffefb680133ef5150c890cd458654db6164226491be6c377af11941ed4d143205f3c3bf7c54337a7ad4189b593504d82deac54946cba8b266f0cb8a4daf75c23124fc8b0dc1a12baad15169694ef0570524b860078c110d377a312fd70bcc7c8ff8ee506bec05661fb76ff5522bc787bf3bcb4eab3077387de191300f6def7159e121ee64c4d95b82d3b671f495cbf756c8d5e399f87210eea693f8ab0ba15c85bc8ea64300cad735640ad8ef150ca14a336d6fece361b238f1a890ef3a435dfe9f04369204e84a84606ad127016db3868f3f6ebd677d6f0aa1e13d4b7d253022b181a59e4941c033c71227aecd0a6fad0b424072125a3becba8607b2cfd4979fc6c2f7b45b1680d43fb8ff48a41e9b6e0a473e4f7dcfca2e2dfb8930a6e954188c2ce2f585a2c6d5961b8e1ffcc52864b0ed34030bb547ee1a71230627ee4ef6349c8caa292e6937f169db51e62a3c888600c2554f870ce7aefbfededaf34a5775297cd516c28aefa9c268246b779eafd83b1944e54492e93c06281be44b60aef5ec8062041629423d7dee96f213472f8306ffad85dd2dd1b359c0bf69472313f9bb5d63638101228d158b795935a7626dc50f8bb06d4762f4bd9fa97ebc1de387f05ccdad992344200e98920333fa24273567ee5dd177941c9c1a88b8655760e165f3e8d8fdac81fb4355edaf7f0e44a7aed8d5a7c017f4db1ad3f755b97bdbf9d31d65747d2d99506a14e42203d56b531ad89f1cf23dc390959235b7632241c9787d6d0cc2bc3ae8fc622ec4dd9fd9454ada25c4d5e64e51830ef38cb04cf39d461b4bbf42001621b60cc4c302f692ffe0565c90ecce8fbc590efa614f8a3a84ef02f644a1d8d4777b408532b654ae79daba3a414d3c7b09eaafb5399e7d917397b86d785fbe6602d85f5d1fbd794b733e324c0bb77d1a0ec8ca9d0bb5456b2b0e14c14eb188ff221cc20fafc04d48cc59c2e97471b97c53bced9645d5c4a050bd31fb91178cffd2ea10cb70057b59aed69c8d44e51605d6511e0681748cdc45159a2cc7b9544b4b8d91af54b0bb2036c5feeb5be8ec5214f3ef608f0b05cad34ef2d99f7ff57bfeb40ae804f703af4869c001c626b61e42e1594e278002756f89acdd8867779d2d62bd93a36be9b2813836e4eb7ccc5e1c2647e054f500505aebe923678409ad617831dbfdfc5d5836ddb82ea5fb2ebb9d2869dc995aa2bc54f695b17311c00e47bca2b319fdbe9481c23e80c50fcf06d001abe76e87cee1db5ccf40dd0723d2979809ac7b61022d7ea79bc323c04ed8d725de874b6eb3aee800e95b7a75ee6f83e919b1c8473dcb6bee6463495a9836fb21fb9d02f918c271492ed9abff61633fbce1580ee3859ddc6902163f2300c905fa05f416d1b370462f39a1a36e285482c5e7111ac9a40fe345c32009f48a07a40b4dfaf777c4b5db9329626c5d0b79689f6d4896376d7390e2d9a246e6e2ea399e5e88a522db8b9fa4366d9aea6bd62ddb735d8222a429aad7770aae00fb933a47eb75f8fbcccb1774210ee297fdc8a17213f760633aa7fe33c091e37e79e5c83570879478d7572b54422dabd2957f25b10d8bdf6ec6f5d72d96b1a4b0d451a4daf259173c3f870dfe304b42814ab702323070c40d60142bb6829415c3567556a58b965cc7559f749af25a0524d7708fe4eaa28a4100b28e3e5c7a484904abc992e47a015281c2ba6ee4a804212f10b13ba62d5357a8919c2c847027e77b6a4dee711af78b74f83595d77b76fe8903a1655725b1901d27af787b44582188361c4d62f3c66034d01ef70611d191f4ad23671bfcbb45c0900e9e7d9dd426d95f355536b21e5bd7be31c1de6abad3e6b4d44969ce8e207b89613c317b52b1ef42274ce1f5d10effe93f45033ec4024c4721cbf73f25b41b0290165f7cf7ceea11bb90d3a202652e0df5f10c5f10d9f97899d31e757f98271fc0ec56095461f1d7607f00350be2e3367f830a1f191b4e01b3616d95c401eec0c043e31bc70fdf67de49138566c45dbb0014d9e9181f70b7ee88818892b91f8c7d2cc8975634df7499f8c083fc2cfe54a923f0cf8b09584b686b46fd78bfe70384f9eeaab8d328ff115d2214b5223884ee6c6c61784aba1203579aec7bf9b9f39fd058fb3bc5d6602880eca393643e052798d4f6ba46900c2036fe2a3b042ba0be825a506c6ac8efce1e051df6d30732d93d77299d3589191b16ae4496a3f8b42833d81d8ebb9cebaed93d80a04291c2b99bddd5e97b0572070f5dfcbe751ee22f02650d334f09f1536ec6eeb7e969f796ba78ccd9024752b129d969da70d9bef0cf945246f2c33316f75bc3975a24c7c4f759f0f3c0381eb2d4dc8257b00b8e0df78eb82015af88499ed7669190cc0534e151c5b3c4d781d9f14073e8a06b5ceec0a5bd67910439ec5e10150169114be0bf5a746aebb30526a684a0f2c322d58240d59580605afc265ac55d3ab746f401b544312c028b2a3242cde7221637633a71018224cebf11b78eedf6b4d1992d8e922b5e2013366544132276e49317cd4483131d40bef25a9e04b0ff7dbcc6e60ea32b5f729c7a792b754c59759f65a45e5dae9f1018a0d6078d30a5d00b9c2d49ffaf4f1c17be3d5006feee11bd69413a35e035f772b122c06a02245cf3463dda3614379f27fc2c596e6b8133777a789613584cf2b3617da8e7dbf7c5b12f0a80ce3a4e252ca6977c80c6eae413e48604f672aca1e302606b94caae91579a4ad3113552bb6c5cd05440defd1bac935d1c945d49949dd69312ad9443d916ae614dfb20b59761099d0c0ad48fae2888d13736c8aed65bc3148427db9082d6f9a1598c5feeb1ce620e5e94f0895f28770637e5d10b400c69697445c734ac80d13878145a19a19586ad9938177fb0d45d165a572a8192ff88cf5e05971fa3e3e8c0f035539f26980a5ac5e50229be64c04bdffd4de3329a9b8cd74e89017cad235311cabe26e9cb2aa32ea27aac9f89fe3bfea2fbeb15f278e7bd3da9925350c290d90f2b9a7c887ed258bf953d28889404c0358680a16717cb4a5e8c62553ba953b60e3cf5827ccc7c93572c719bbd66573e59ecc809c2185571ba01662c76d59d21e1cc5c27a6550a6fc8908823b039c94d391e69a1c45eaf3f1b2f95e685a429179460374bdcf087bceb176fb4b2d59e30e14d67a85a95209568ce6be9d3f04dc99127bc6e0f7a75e960aa33408d640798e74580036057abad35fa811a2c2eace789ab84cf178e435bb5b8afd418ddc0f81ed2c2aba5ce730caa4e18e9c11f3ed6b4cc946d4605ae76e2a589e2c5b86a00c5cad3ff819530b58a433ce00559c100232e7ae6bec4cecea535ac17b4115ec5124ce2f5a9dce2321c992e7d39b78dce29001bfe4b58bcfae0b48e256a1d0714ed2c6c586fe21dd609be12faef6ea3a8eb94f81c1be1424097b80101bae008b165ad4d0d2253d40ac4fcfc7c37ebaf56eea808dfc7ff695b6fa9132496b710d20117c3ced9c8167471eded7c69ee13ff6170bd919df1b71eaa9d630d61fe3a3d70e153ebac59996e97e3dc20e3bd556c6b3073944ff212a15b52b27ece59f4433b3dc89f716fe50ab30f3c8adad83818ce3900ec5f31abec8c32162eae8a4a4045d23f22a5aba0f0f0f891c682792bbb19d46924b543db7ee039fd41729357759f63a2f0305b89d65272275fdc6711f760b47ca16190f3c4a514a265570c91a7d12e6f864f27391395d9e12ce9ec89731f2ced787b56761b499c4902da4f11e5f8aa931a861bb6c192ff57710d2b0d3c678c530562caa802d9327d77ba3a4da0f6cfc693b8a8b890c99834ae250df1d26f8b961938c6817784719c867b73e95251d9bdfb57aebda60401fd63e7279120fe9b944c4dab21d509af1575116eae4886e11124a8683c15aa0cf29fb7b5b4487a6563d0b729edf09b097f9a863afbae58333936aca463cca3c27f28546b7ad60f98656ff57cdeae9a3c32edc4a425723638dbc54a0f70c71b21199bd2d7a2dfa07c1e1c122c678c075fac449b20aa0d09807cc4bad6d8434c4b23d031bf5de89c5bd2b26aa644ea8085b2b5c4e4fff83ce1b7dcf90d3d29bf262fce9403f41a5256fe87149383eecc45adfa09a9e5a745e2d89346ef62206961850b221826c6b18d17d920359199671be21c29782cd3073b8cd49a937f3245161283d07c3b70cf70b5855886775dc576b0e9bf84d2031f52813ff51bf89d10b3eed53d094212526cd8095414a99d5a92276880ee3c7e4d6af4042f6a822a931ca905e3b41699dd7ffe2d05eaa9d3ceab0eac7fbf6619f5c77386238c34b2ed9886b6853691e9576113013515ffd376b6e616df653e7ceed3673f380bf0509b88b89cdbd8a486e2f4c979b6022d1a647e2f7a990d1512c0f468cb75ab9bff70e4808f01f18d153d7c14cbb6cc783496fecaf1292602982665fa44214fb0f7f9bd108d8dfcfcce323dce170da5f9c95cd555dd58de4339ed9178a432b58473e65e0b30733564ff7caf078ed7216d435a66a3f79f7a8dc529547d4834aa0be30b8e7bbf833b6f8d8883dcee648e572447e87c698f61230d9f3ef705ad919a0d36a7a399d549f7f2300dcafd966c3642395ab6c9254fee3abde5875e240ad63b9db20435938e2ba30aa06f57ced76c5c5c1193633f31550c69a412b6d6bd7a736c025a33ba7191d6a58ce0ac4da503b823891e022a6f88e3c3155c6ab0f3bc03d4731acd3e70853d18831fb4ea59e0faffb0fdca0b89212b68f41872e2f317d826561ee62f4e558f7724c41ff5639b3609ef7e07cafc9fe64877b3c1701a991cf716271f5da4fc11318bd4f0c0fffd4b332caad431b36f33060e0219277d6c15eb757127b5fbbde4b60bad8bd199418cd393a2a6511e426d7ff873c165b065ba8f7d36d4b6fc632a20fc06e8ee78948c69be4340a38334ac6e4060d6fba2b8174b76b7106d847b75639dc50c98307f6652e4a1ac42baf13cd508a011ecf98d9fa4bf66d9e24b15a0c8d5bfa794b5a43d5780ce2dadc06232de97750aea4d09b2736e9563e07ba2247d1e296b3d4d1b40e91ceb1ab78d74b12926ccd6c74543136b125f5c0b6c82db509b1eb07f5a911796fcdb9abb7aefd2a80c874e1e6d837416a8b5e07e2223feaa66221e5c8bc6e68335029da596674b57eaabe8ac291689ce8fa6043d5be6f7475b79e8d76fed0fd3dd2c07849c20ebe498ca0dfbb04f98d3ecc985acd63a5127d087b91b5498d0941af00a34ca0d7ed91ed723366c99b2705323a397df337fea94c42a8edde4fbb8596f60fbb895898f1b4027379f708e49794bd13d9f5266e93c576d7bf56c14eca0530fefb1bd6907dc41f7c11da466c45e1515e2a6b96debdd9677335a3ce70647b605536f113ff4451df351a099afccd33f52691d4deab6bb85da994272519aefd824c4048841637423d6fcd75a52e88cb6c163af7fa5bef4236243fd887d6e21db84acfaa740c1d8f942bb55952ec99a316f29e61dfa73186355258bc9e086a90cf511d42f8ca2bd1df8dbd7fe32e8de68bd0e376c0dd83896f88dafe13a12ed92d174c63ea90ca4c629dc9373c283edaa6a7709d9396e044cb566dcab4e49d0b6d50fcd01a246404269ac332cbf27b20120588a5984a29e3ecc87d2a3a2a1ef5bed9f37c57cf79d56344427f9db11e079cc04f7cac715640b002735eba4bbf44d7d84acd35874eb567eebe70a578a5ec8080bad"}], 0x10d8}], 0x1, 0x1) r1 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x0) 12:53:19 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) getsockopt$IP_VS_SO_GET_SERVICE(r0, 0x0, 0x483, &(0x7f0000000000), &(0x7f0000000080)=0x68) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) lsetxattr$trusted_overlay_opaque(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.opaque\x00', &(0x7f0000000140)='y\x00', 0x2, 0x2) 12:53:19 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x2000000) 12:53:19 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='net/dev\x00') preadv(r0, &(0x7f0000000480), 0x2d1, 0x0) [ 1413.972278] Bluetooth: hci0: Frame reassembly failed (-84) 12:53:19 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000f00ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:53:19 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x40) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000000000010000000000bf00000000000000", @ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fdffff00"/191], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) 12:53:19 executing program 0: openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video36\x00', 0x2, 0x0) r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) [ 1415.977714] Bluetooth: hci0: command 0x1003 tx timeout [ 1415.983296] Bluetooth: hci0: sending frame failed (-49) [ 1418.057775] Bluetooth: hci0: command 0x1001 tx timeout [ 1418.063219] Bluetooth: hci0: sending frame failed (-49) [ 1420.137831] Bluetooth: hci0: command 0x1009 tx timeout 12:53:29 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000001000ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:53:29 executing program 0: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x20000, 0x0) ioctl$sock_rose_SIOCADDRT(r0, 0x890b, &(0x7f0000000080)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x2}, 0x0, @null, @netrom={'nr', 0x0}, 0x6, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) r1 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x0) 12:53:29 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000380)={{}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff2}, {0x0, 0x0, 0x0, 0x6}, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f0000000100)={0x1, 0x0, [{0x1}]}) 12:53:29 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0xfdfdffff) 12:53:29 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x4000, 0x0) ioctl$GIO_SCRNMAP(r2, 0x4b40, &(0x7f0000000040)=""/97) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) 12:53:29 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x100000000000000) 12:53:29 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000207ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:53:29 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0xfffffdfd) 12:53:29 executing program 0: prctl$PR_GET_TIMERSLACK(0x1e) r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) [ 1424.193428] Bluetooth: hci0: Frame reassembly failed (-84) 12:53:29 executing program 5: r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) write$apparmor_exec(r0, &(0x7f0000000140)=ANY=[], 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r1, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r1, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) 12:53:29 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000340)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000000280)={{0x80}, 'port1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00'}) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r0, 0x40505330, &(0x7f0000000200)={{0x0, 0x20000000001}, {0x80}}) [ 1424.301762] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:53:29 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x100000000000000) 12:53:30 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) open(&(0x7f0000000000)='./file0\x00', 0x80, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) [ 1426.217765] Bluetooth: hci0: command 0x1003 tx timeout [ 1426.223198] Bluetooth: hci0: sending frame failed (-49) [ 1427.017740] Bluetooth: hci1: command 0x1003 tx timeout [ 1427.023134] Bluetooth: hci1: sending frame failed (-49) [ 1428.297737] Bluetooth: hci0: command 0x1001 tx timeout [ 1428.303132] Bluetooth: hci0: sending frame failed (-49) [ 1429.097749] Bluetooth: hci1: command 0x1001 tx timeout [ 1429.103153] Bluetooth: hci1: sending frame failed (-49) [ 1430.377722] Bluetooth: hci0: command 0x1009 tx timeout [ 1431.177759] Bluetooth: hci1: command 0x1009 tx timeout 12:53:41 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x3f00000000000000) 12:53:41 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000001c0)={{{@in=@empty, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@initdev}}, &(0x7f00000002c0)=0xe8) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000300)={0x0, 0x0, 0x0}, &(0x7f0000000340)=0xc) setxattr$system_posix_acl(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='system.posix_acl_access\x00', &(0x7f0000000380)={{}, {0x1, 0x4}, [{0x2, 0x3, r1}], {}, [{0x8, 0x1, r2}], {}, {0x20, 0x4}}, 0x34, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r3}, 0x10, &(0x7f0000000700)={&(0x7f0000000000)=ANY=[@ANYBLOB="000000000000000000000000d83f0000dcc99ae86fb2183701fd66d7deba59c0736e4f86bd73f74c68827c827061d30c04fa977c13acf50c63ed63c719e669f5e5963b5c98f90850945c919fe8e800bcf8593dd1317e0dabc68256e7d2c74eec2006376df7ea96c69532bea1af758b088414a9ccfba1249329f727040ee45047aab32757a495abf2de9c1067cd64a88df26abc9401", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000000001000000000000000000000048ba1dbce83ad52a"], 0x48}}, 0x0) 12:53:41 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'eql\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xf2\a\x00', 0x10200802}) io_setup(0x4, &(0x7f0000000380)=0x0) io_submit(r2, 0x2d2, &(0x7f0000000bc0)=[&(0x7f00000001c0)={0x0, 0x5, 0x0, 0x0, 0x0, r1, 0x0, 0x3}]) ioctl$sock_ifreq(r0, 0x8914, &(0x7f0000000200)={'eql\x00`\x00\xa9[,\x00\x14\x01\x03\x03\xf0\x00', @ifru_mtu=0x1}) 12:53:41 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000507ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:53:41 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) fadvise64(r0, 0x0, 0x2, 0x5) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, r1, 0xa28, 0x70bd28, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xffffffff}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x3f}, @IPVS_CMD_ATTR_DAEMON={0x28, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @empty}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40080}, 0xc080) 12:53:41 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x200000000000000) 12:53:41 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000002507ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:53:41 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) fsetxattr$security_selinux(r0, &(0x7f0000000000)='security.selinux\x00', &(0x7f0000000080)='system_u:object_r:hald_log_t:s0\x00', 0x20, 0x2) ioctl$BLKTRACESTOP(r0, 0x1275, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) r1 = gettid() tkill(r1, 0x12) memfd_create(&(0x7f00000000c0)='\x00', 0x2) ioctl$RTC_VL_CLR(r0, 0x7014) 12:53:41 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0xfdfdffff00000000) 12:53:41 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) connect$can_bcm(r0, &(0x7f0000000480)={0x1d, r1}, 0xfffffffffffffecb) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000700)={&(0x7f0000000040)=ANY=[@ANYBLOB="0400"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="00000000000000000000000000924a61c0f1d8c7a8c018c0939e"], 0x48}}, 0x0) [ 1435.723438] Bluetooth: hci0: Frame reassembly failed (-84) 12:53:41 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000005207ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:53:41 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) mremap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x3000, 0x2, &(0x7f0000ffd000/0x3000)=nil) [ 1437.747717] Bluetooth: hci0: command 0x1003 tx timeout [ 1437.753294] Bluetooth: hci0: sending frame failed (-49) [ 1438.537814] Bluetooth: hci1: command 0x1003 tx timeout [ 1438.543217] Bluetooth: hci1: sending frame failed (-49) [ 1439.817752] Bluetooth: hci0: command 0x1001 tx timeout [ 1439.823369] Bluetooth: hci0: sending frame failed (-49) [ 1440.617744] Bluetooth: hci1: command 0x1001 tx timeout [ 1440.623248] Bluetooth: hci1: sending frame failed (-49) [ 1441.897749] Bluetooth: hci0: command 0x1009 tx timeout [ 1442.697757] Bluetooth: hci1: command 0x1009 tx timeout 12:53:52 executing program 1: socket$key(0xf, 0x3, 0x2) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) 12:53:52 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x4000000000000000) 12:53:52 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000104ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:53:52 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) r2 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0x7ff, 0x80) ioctl$DRM_IOCTL_MODE_GETCRTC(r2, 0xc06864a1, &(0x7f0000000080)={&(0x7f0000000040)=[0x8001], 0x1, 0x7, 0x0, 0x3ff, 0x200, 0x1, {0x84, 0x2, 0x6, 0x5e, 0x80000000, 0x200, 0x6, 0xce, 0x4, 0x0, 0x7b, 0xfff, 0x4, 0xff, "fdce91cd6756f75df44dad8fee4ab30d215a7da1b350943b20ba558ee16c79b4"}}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) 12:53:52 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r0, &(0x7f0000000a00)={0x0, 0x0, &(0x7f0000000940)=[{&(0x7f00000000c0)=""/142, 0x8e}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x6}, 0x2) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0x73a0b1b, 0x0, 0x0, 0x800e00549) shutdown(r1, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001780)=[{&(0x7f00000001c0)=""/231, 0xe7}, {0x0}, {0x0}, {0x0}], 0x4}, 0x0) shutdown(r2, 0x0) 12:53:52 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x1) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:53:52 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600), 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) [ 1447.154707] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:53:52 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x8010000, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x9, &(0x7f0000000000)=0xba, 0x4) 12:53:52 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f000000010bff02003b54c007110000f30501000b000500000000000100cf", 0x1f) [ 1447.212321] Bluetooth: hci0: Frame reassembly failed (-84) 12:53:52 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_TIOCINQ(r1, 0x541b, &(0x7f0000000000)) 12:53:52 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000000)=ANY=[@ANYBLOB="01040000000000000000000000000000d1a95a7a5f978b7eda23270e9762636b43010000000000000061dd75f26103a5bda6feaf3448a4cd", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000020001000000000000000000000048e83ad52a"], 0x48}}, 0x0) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000002840)='/dev/mixer\x00', 0x2, 0x0) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f0000000080)={r1, 0x1, 0x6, @remote}, 0x10) sendmsg$alg(r2, &(0x7f0000004ac0)={0x0, 0x0, &(0x7f0000003980)=[{&(0x7f0000002880)="52214f0467d56e0b9ebe1f052e6ff83131a099168ad673", 0x17}, {&(0x7f00000028c0)="29823642fe2bbd8c61adc112f039599e130300223bb0e5e60d7c9e3d7ca62ada58cc305033bf4b2d583892bc6607c8463c760cc16d76cf049563aecc55a08c4f95508671c6e28a3f6064ef9a2dab02105e953c6aaa90f337336499fa7421d30f60f8812552a19520389f63a8a7dd9b1f5c9200506f17cb83667867565ce9ebd7a04a51a5a6c234e483cb6e7ce6860225a6ce45b425c772b8e58f24f31dde4fb442e0bc54e9f368f99828ed1b43f8f7c7a18275bac1b6b6c603891b4ab5edac484554659c6c17998642e67c4ddfaf749ba2b947a1cc8454295cb0f4720d98ada9d5cbbfd65faf9d36f036f82ee3e6afdf06a7c620a463248543fa0dcb8cc8829432209a12494589bfe3e2a1c685685dcebf45f82f6d137a8c4f2460802b9c547ea68fafbb6922583d243dba152b0ef08c9a4aa5f8f9f3d80cc0f7300eaf659cae9f0e2ccac4c8298fff4c1f38c32f289b29681b0d92ff30dfaaefc3746d25281fb845f3f3d7e57f920cd6f8d07336429e424a5461b625395a43a47faefef7cdaaa8a27c06bda0a02b379b51f437b673d871ae491a497c2db33de29c8085ee93030580daedbf5c3ddef8a33214481e9381b2104b8b22bc3ee7550962d3cccc8ef4953250dc10b914aa14b0190a9468facda2c2f619ed0052b94097755eb958636544467841afddddf1e3933ad04ecc3761e01e8bce09914daba0996c1eb19f9623f328b0525365b36996af25012ac855b728c1163bc610df296591e136d6758621b1fbad573b4737cb9da7e91d6819134fe21ede47006e05061b5d2395920a7062aeed1daa0f4b15271028cc9f1a4e24bbb3cd7d25fcf568c2a68923924e8a55521e5faa1a39508b918c6b01b4adc6c33c22b9672ea3bdcc8d0eaa1475769e119b6b729a872102529292d560e6b5c73e0921b564e97c8ca4368fe668a795c4050928f71f0ffcd4bc8e172d7cc92c88fff19942ea857db3947043919da6351b2ef37933369d2cb8dc7686b8b20ab067ebea879682bff4dc3c7b237b0775f480409b18f4689cdb22e5d684ae135be4bb7e0a3489fa9d082295c280078757af9e8079429c7375c2718ae5d38db4b016a86638a668e272080a2bb6f2b2f9daeed6109a0c8e5e82525f962110e2dec0e54b1128daf89c7adc8f71947c911af7b615c2e91ba1f53ef69da4f53d148b077c42ea7709750dc10d33d058221df359679ce257dc4de0c76a85b54ca44750a8fbac581597178f172db3dddbb6ecec2d5001446acbd274d050fbfbf1cac8bf3f84662aace5116a947af90e1389c3e4104c5275dd174d7f28b2a51ba383ae1e2bd7be5f2e714405b20f2cb3667ddba1e9ef54a7b8368d35c26afd45a0473b6111dd78ba703ece95edc36612201b0666b0017e11948d049c3f609407731775703f2c6758b149620eb11909d523b8202f994a77bf848a0e76bafa46018d66b31ccf76431f328a8d2896310159e0ef3660817ca49dfc6af745f32b1db43f670bbc8e43e9a4b25d02a74b83a518d7b88540971949b0556e523a4c57b9805428b66268c3ed76a308a670ffcf4449458faa323ca61366dd9fbac76127c19c6708481f1d21bd540b19f288a6d74aaf1bdd867d261e82cd0a11456eca5e657e7a839f0a544764502689aa19743f5602164eee5e524af4c9d89903bb79df90211e3b5663fe5e710e28aa95727c1e1b67c22da7416cb52d117e8e1c5e3f029bbd40d27f8f4eb0b391c9719ebbd97f378a544a5bb1d7afee1325e2d955b6ef16f8a5f57bec1c773f873249f1ee19cb04cb975a7f1d0603317181a969710a85d597ed5134ea5c21496958c67593f46d8eb7441e045951eaa4379965c02b544e0d77df98a24011e8678f2492edb739cf6798d8bb6e81b00e8384bda7c69e836d697c9d86cce124539854e4de69f0426eec7c015cb00e12064366b9407b1c3271592a1dd3435a48e50c4b0d45822dd06b53788e1901230df4315860997774db066e6bbffdbb4763712faaa803aebf4b59d0f9fa0c9d96c069094d6bc87ee81012e34b3f2adaf5db94356bd34da7c5c9acb0e9433b2eb0ca9a41c9ea758b5cdc01d4670c097d503d190e42a8951d338cf2df76732dbeaddf50f41e5d9be66f0cd57a28551d0a9b353ed99af9374c6dd0b0fd298268da8b396fed1c9f7fc91aa0bee7a84e4678aaf4c46260e2c5af1b8036393b15c8f21edab1c802a0e5fb38fef1b32efe80801536c9a5157567faadeeba602d92e5ff52428ff9fb1c292e2d17ced7dbaf4e2baead186734cd1fb577b78d438c34bdb6652b9c131cdef35523eb896f7ae2b4797f85552675f14668114d33ca39195333c4d6ec8308b6048b7558ed2093e09ad68f66f699e4b66241c2f7811e4524443d5361ac228518fb3dfa1704da2522b16e065aaedfad5612387db7545b29dae95c179beefb120b8e1408ec8b4917f18b5a4bd188ef4ce2dcfe313326b1ef459387a46ebfe61853ee04e892f1705af9123712f443a11ba707b45bae62d79077437b5ce62908b134fcf3c64c61d11c65d9ccd8eaab7d15c734f14539bc26aad5f587e56021d5e1eefe24ee1e1cf47a0d955841ce8d4291733ea1d5b7367c07795a3157c425ddcaf74ebdb19d05b305230ed21cca81172c440e1748f91b996e352e6b31b1df89e9dd3691c0fd8c2531dd69a8128775056ce2548749917a40b398e60eca6a2a8cbfdbb172bc5f5baba9d2bb9445ad3e7ba89ba3bcc445c085f84e4f1b879eea7b568c7c01c53061fdbcccf12561a7f900076381ec7f690381db81d2bf800d9d1599edd12e6bee117f78fc1e44a4fda83908588dbbe5743f04d731f2ae684003e04fe65a51d937a19270ed01daeb169e698e1b01ad4f4262eb6b6697a9f87bfd910de426efc56d92ae17bb513957f11b95dbffdcc1bc73fd4a1557938997732b74678b5290ce470d2433b45345c5fe6f647e760c32b0e0fe9267a7cc423792c3aba02d59aeaeab325ed22583f566969dc0d60244bb8d619b2e356efd9a0b8bb79eb7ab0d28b706e1c4e8b4aed960f6143f6caf8d5212f737c83bfad08782c34f77a552de8c853b44a83f3419fb45940f3f0126d65f6177c0893e8fd20ed6d4a73998d1cad1d3921d9b34467afdc9a0051e487541f3b85274ee3279825751fdba16dffab8a5d708d87d6390fa5244d5331306df56e37c9fb94b98cc30e31a9180b1ef0de30313d294d3e4720881155fd9e796b1281c495b56e7b7b42a553c973823828958fcc4541c880e1cd49e03a75babe71f1ca3a719c9bb89011869d545ec2ea16a14e4ae48bc153ba0b2df5a1f627757438984c4f5f8fd69c63bf8b485e488b76c7af5c5a251588c7adfde367b33de52a7e2b55d1183c3d616a1e0db909e4ff4d2f50a08ef33b7940f3ad684b609cd66eb9d5362742d8b99de3c933982ccf52e6bd37b712eebb1d6d05212551006e1ebe4f3b444bbb84c22996570c06a72da374fe387fc662ac5ad4d61efd958ecd37ea6e812cbef2c8cd163b2acaea82aeefc7f0702f14578a5cb9b2295dec60326f83481023751498c164a9ec5bd6f62f3efb8521343d74b621e54607590580d284c93c9a849d4578d21338e8f20ffda2f7312b2ed4daa5812b3a8da8cfc359840870475d865c8d5f80ae0db55aba1bcf499b94e8892b99941b8a845bd667d7ef5862e25f959ee4c94462d4f1b1f5e00b15eb19563bc668768ea6ba1260e52ee73a3b91aca37288ebcbe2323d859340c40c37997a722efc09a7e284ff8d1f7267a4ed194b27d0539480f2798d149af2b7058b97c6c9a6f986140ed230291a9e64a6c3b9e835b6fc05259a2138aa418bba60f4593a25f761a8a71a68fcc075d2b48dd7b0b71e997956034abe76d7a91f7a37f8ccfa019acb31440803c12a2c2e8969d89d219f9290eb3a09c22a5592e3ea979d7c1073e7cfa89c02f46e35acdae631ac517b38a04618af1f163364a3792a5fa17659d3a666f8cd49c30572f251e23a5b5066b40c2988a8c35ff2b8ab74b783b40aa4de13d4639880432202bdfb5c3d4ef9dca274b04310de88b604ee62f6e026a3239cbeec130064faf647af945966386cedebe134d3e1d14c0ddbe477671fdfcb5df1e53b09cd993c1277fb5e0f360e01d3ec1ebab499c9691243dbe25c7e462b542fa3a1a74e8c107f3f0ab2782b4e13e4161926d02287be5d88776319eb7e6306326acc74ccc38814905d8f70e4ef1faf0b3e239f0a012866b5ca5ad201bd28613601c4f296f6e816b23835e5d8f1ddf311446384df27d1376946eb7160271054347e4dbe484f2af78b55f10298e6c8b05c3f6c81d2326a0064ecca8e5b3fd4d1419b5c90ed753e03c8e360b104ce229308c66f241ef8648dfff5a141aa2acb8f8b1b9686426afcbdef28dde44adbd42e19f2bca5d8327caf08f8dd2a47b2603e0a272ae23866d5d1cb95b0f7c02cc127b0d237be36494dfd0635528b9a916741b88162601e7f8a1bd135787fd7573d51aa8f34cba7cb5e96dc93ca979adae68aff75a2d63f1e154f8a2bcb4abf60a5b0f3046ce61a238dd2651f05c85334944faa7e9fb576dc9a2f42b76ead557d2b0678bb4698570f010db7e1119ba87e5991cdf737cb819f00a58628220fbf1af8404199a645e51083fca1b4ff4b7170c897aa1ada8783b167fa51f7ab92351a1f560b307373487977d539070061f6e210fea7cde813ac3b2f2a86379158561be6f36acaf16fdbabfc05bce85da8a9d1c8342dd407b33c12b99eaa1e8f0b2a475c5b121bf6c08004854240c3137571c6ec4805d99b48a8dca0a25bd3ef1ec6993d98de403fda014eaa4a8544b01099367694de27db0507f95ec0ff58278ce6fb082b4dd20a1b236e7232b745fd0c23d1fc0b758ef2dd4bfafd5154c7e007d694a798ffbfc8c3b4b7d41a2dfd12ab716284327fdf277d5b1529d581f9787bf0b0127030df528196c2ea7613ca1e7e7d20db2cfbb3c504219321890905e057a9aa4245b088bbd184faa154816874a055ea7f17e3e340e4d2058fb307642d1a898554deb0d0fb0d0f421ee061c5019700a82041b0d7a54036d09e1822c877f54116912c2ccb6ce214d491e4e4d10993057e7d2d053fbd8856c3b2ae4df2de369a77c4e9789168d6db0d5a22d5959fef323a9b90d96fca4f0fbafc009831d5ac5c4a774887726b6d7b02ed058f26523a4eab7a8f343ae12d4f3f42732de5f5c4decbc98f6b4d5bf9fd7c774eb690a9d1b7b27a9336d4584c76201c516b952a47d8080015fe2224cb1fc8aa065a31f227ba46c2b1b02aa1f13a9a99afbfeee4d2c8329a4514a79d5dc69902201ad485131d6801daf1933f60f110eebbbb9c39f5d5ba7285ac308f6cdf7029fe1cd3ad8b32902541cb636eeaffaa3a2b704ca33400fb9b622c50c96b185fd7f4d21d2c805f2dd4ff5d408671e9a9715197c06267043bbea90cf7600c5f47ee45f9445420639ab86f236496ee81257a181d16e0c8adfdcebeb6ab759298eab064633d3e4fa7531f7f045318ec883307ac1a8137c5094190a6c15cd312c87780351798a3cc9e7d392f066f860798aa3d634d207ea84635aed54a259accc93b44ff5b8b9eaf96a6ffe75362f0880cb70b215d45abc429041d9caf3da4e8510b626d247f0aac0ec44015ff997adda7b06af5da3940c8c0f7df9101e004a34fd4d51ef46fff8e094ed7686cefaca5471559f18832517c1e25834fbcfbbe62df635395f1a8a86dd7d1c5f804af0ddb57dcd17ec5fcdb741fda2924f194271392d3c4581882e814a6953", 0x1000}, {&(0x7f00000038c0)="3de1470422559fe4a992d40719e05deafd22d44c", 0x14}, {&(0x7f0000003900)="bb63eef87ef58aa6cc20b81af70c0e74be9ac0dcab5e068e7df462be9227a0b8091b736a32d15a2a2079057a818adc7c89057c7d4fc21c04fff50183e972369712c18487d3993417e769d19e3568fb2fd9", 0x51}], 0x4, &(0x7f00000039c0)=ANY=[@ANYBLOB="18100000000000001701000002000000001000005ea6351aadc3a9f124456b38426c362b41507adf1807be982f229b229176b807888bc39cb9566d9d0c6ed24de0eb494e6fc797ca4934d1bfaaefa2b66e6860cd7885b06e5e084c5fa2c3c739f743b8713dbe30d43d282480304fa34de59d2ce32b5c8d9aa11ce5410922204192e88b8ba2405482482fbc4bf2b2bf08065d7e7c41a296a1d9401d33ba0b81485cad28bd95f938561ae3c7374470d65b05730da42c2de9194bd7272402e735da695424c9fa91e00d33e237fdb3155ac14aa0a6504daec3eeb01c96eddbae964de9dfff7abcc56ba35c6135dea4833c5b8224e8f32036b62b8b7700d7fd4f510b6e5b9fb7f10d66139b1bff8cb39d3832c743bd29048ee82fc51c19c88f751bff18f9b9eccca8151d2c05652ac39252f6171e572196f8aaa46dc40e04cc02069698c26da84db91a8c20e9d02f461feb23e2f9f6b6633cf9c452c1382239342c6b9e42fa513371e629f901de8031aaae4c9d52310d13966bfd68f1781a38e9399cb7549ba2195a640e6511cefa1563df62d1d3c1567f7c8ed992ff558f93e35c7ff44b5fdd75d850701ddff07bd64f180e58d9a738dc95446c536734b77e4369b6f0f2ea947227f73e8aa1773fa728fff7bcc1892099b6770e03681b97183d9c373e66ff269a3e8b796b7e33824ca866d74a8b724f93ff36a5d099a7b767d30587c5d6059c085d18fd2faecd9fbba6e22612883cfca2ee2f3a60dd145147178c31b0bccd63f625460226d22b8e862a35f8aa76ff4869c00ad3b054a51e33de06bc28e87981420ffe2426f7a08a8ed17f84e55bdf71a742bb9e769320674107a373f67b2e0e9dcd0d97f9babc68fc32127b9e98d858f8698b94eda2f302c69de2f0b8d37d725d8e758404268aa73cd40cca12705c242eddf71d64d3afda69e8b1c04e1b21311e1647d80e64beff7e359acae75519d8632547ae79693f923e9e881051104ae4f70d6a819578e7650621904e541dd516f000c1995a6fe28162c76991df484d2b60ed38c03dc0b40e49d745a395bde241c931df64b989b1ee8ecef1c28473480849cc55518898d0eb283e2f0afbd37a31caf17764d556d2d087f1814b7b3751368d83fb621c97dac866a2d8d6d1570d1b12b913f71ebdbf073c1d771ed8a9f1bc0dd5646635e53349a1703a89e111dc99b8f83b899b27ce9ed9e0dceddf8413d07e0e5657b9751fd3057a3a6ab6b4a5329c85fcd3b413834cde18322a745884a5000d86b89953cdb6941893fa0e0ff5136b0732e349132b56aa436aa48d7f18a9dd496917073502f5fa550b93ba44d2856d17db99994786f833aba1380ce1a64c49494f41af57e9703cecea2562831e5e7a620ad2730e92204e3fbe48a3f0bfef70550e27aa286af8e4422a3b65a19ecca8efc6cbbf924f47f2a6563aeff49a581a19a1fc44a904883da7dc4a9c2cab259e8d39a8b8bc4f4f2f91f51ffde667ed58c23001054d9679f886e83e0c0457eaed0591ffcb382ff20503d9163dd17da75a9e337f75523f0cb0a3f4c2aa4bf984bb437a3500dd9d9b1da6f7ff5fe7aee4f7d1f66b3769c78a44bb06ef751b81b5bfad49b635cec767eb92aceb2784189b58e38723a5e0a10a761411dca174a0ee660be1370c3f7101959bd4bce388913723692b58dbe99db92729c750ff6cf1c0ec99e7e0ab289d44fd9dc8020ee85270527bafd45456af832b462640d1e53a9fb6d4dd3de4a35aaf0d1fdca2f8dff67becf0e70ff8feb6cef55b0ad0b8ff14eecc677372fa5a03d3e09502785787d2bce3f0c7d52f7e92ce7c8c703e9008ccfd7d62c71b66833b4326c6b72e5be710a332080fcf21a0225570c0e0493cd3fc58ed1a5b8a71e8cef9416218c8865930b8d725c5cec07f4778ca4ba66fd41f1247d83a02ec082640cedaa1667935f3534251109402cdd0c9c5d94cb1f2d3d91878d66e35cbc209394e7cc6078132c6520e38bb10654e10972d09c3697e4235a02a556bdaa6e065e7de27ee33e9869230aec3ca72171c3f891271cf24b6cebf21492f5ef2c780aa8877990417a6d5133d70cf42f0a156cafca3bf38087eb7b31beff54f4e63e8d8a38e9b5d719b98568a3bad3c8c7690b159efc8a119ebb2eef361831fd43022245460125f009750d1a8f137367f7ba8fd50fd28ec28bdbd2a0c40d4be8a611cb677c67a1dc57d2037541547cda377724ff4783011ec19b279458b063cda83ddb3c170952e088339fcc26caefc4205b2dbe0b33b6b9e7d6a2525d9a89ef184610fc7391e218695636e772d607a3747950dae7e75b7ec02a5e118f2cf8ab94dbf1d20f857ce6baed93bc6713a06703b19588232d5650413857db13f13cabadc9e7d039c31e3daa64fc0dcfac888ea50f81f7197821cb0dd357f17ecf13dff72f4b9daa6b969cf839d7ca4191b25c929304734cc339ff38cc256c8fc1e18f925701d31e7356b233002cf4f73d27d72f44389e21aa2ac3a120f3944f1478f7398b601b2ee8a9c5efc73432516cbae78af1abfdd7c8adaaf00044291958b1f162aa345414e9bf1ef37a5109a5fbb8392dfb8cc3aa20ca05d96625bd60bea240a871accff01980cb3e5f9a8f5327ced4bd3819382b6cc9fffc0824dea8ed4216e3c60b6afc1483ee4f6043de208c970742103f4dd43c68f5f169e306cf58f28959dcad151d5442de547eab6844afade59daeee17390b83717a881d593b48c9590e123e851c495ed2d8b6db6368865d9997a5be6f6cde8d853aec66208b534cb75f37739ee4c39e896e6d089c268fd8640cd43be7fb3f26a5ca25cb6f47b8750f18b336a95b1933a211953146501b72e7e4836074b3baa9fe96665a2faa5dfac2453592b680908d596c1a440e708bbb9a690d83f1424beae532cbc958d5474be76f859a2377680a180841341b260d87cc06df59fe80186a36fa6ebc1ff90af0ae67bb75c5ad5007d3cf6eded978347769b9b3974bbc7a3b1f866d3ec0a7851501d6df7d5f49415cc3750912b3f22c5539c163ab0b4d8ad71fba120117db6c753d190d87aba57618b0d804df246b3c333a008ecbf4a81e6304698c130418a87d561368eaf5208bfc0ba50a5434142b0ce9b43bd039b8d2f346b98b0938fde27565efa8a221f15ee6e6db71d3e8f69306b130b0125b8630325ea3bc8e97b91f2b7d4ffeb63b6d6825e1835dd23282f82f88c0ae4b69c6b16974ea797045379cb720a1cc639a47c1f85463927429cc22ec9fd1d72cac2ea26b9b3cc41bb2dd846bb2b9b4ab3e6cd8d8e31f0a860aea97a3ee8a73f8e6f6a16742e43dbdb3ed079d1a2318a27861e6caad471753a35d10d22ff2a049976fd823b8f4c2f32dede12bb0f519cec62456402ae6ca9f803d527ca00372dd5527e6ec5cc3b9223c1ca41db7e3f5c7cfe4fc99ca8a1b2bb7039395a328a5d121dc7f8bf2270dc23fd30d8cebabbd5ecc1e28e9a164040b662be78d3a9e3ca10651ea8bf813d9d8fd216631f0bfbfa6cc4e3cb142a6fd5929c594e9b7761ef6866e6a44e840be78a341f91c608dddd52fbfd91e96dd4f24c3476704c92c2e15ef46e0d9907990a71d7b4c512d9aff3367a31594422bb5dce8db85264ed6602bc068c5472340c9c2ff8d18ea3bd74576116fcd2bca0835503232b5f86896f59c967d937e9318ea69ddc36fa6bca1b11d53f02a5388d815740dcf5fef71ad838d56231bd56103a146fe0147e327558566ca37fd218fd348c163a9a97b94ce891b01021f3b72f6a01374c77949dc25ad9654cd21fef4adf7d44849946014873df447d84f338429362b24b204420d5e9e7b8e71e4434b5105d73a745a77369f42f90b464948600e92d4a2eb40f9541a1b8bea47bebdf0f1369dcb1976a003645abae447255c6b64b81524863ac202c4fdca9bfc772b1cfd2fe2e3ef75232cef59d27d3e22ed8812e0534d7bb4bd28220723467b32fc8e9acdd4cb38883605697b28ec3aa65c4dcd34eedacb40fb05f778922d1f4fbc229524a2b98283ca1afbe9a0fc51a21bdf8686dd09516e2348674d20fa0e9384f1e0eb1cfcc5e2e8676aed1ae405699f3df2586abb9a8680914e011dc5281b7038f377cb1320ede7c4fe8231956c93985e43ef0baef8056c354979b777e9eaf25a8d7cbb0e0c6b67c4502e949cf63464e3225bbbb14fd6be833d39a6562e92ec7aab8ce98845942434bd9835db56959d480e4423c51b901b7c506e192d6186742f3aae13020567e0fcd6f760a3c1341b71ba1372aa7f273e84092c2aafd0e0efd676806f18c82bddfab8a62f971b8869522abf6fc5f16c60deda3e15e0a617c4418c1e567f24f8ff5b54d30d7531073b106873caf6217a78e5c500377728ebe9034b265ea46fb5087124edff008764380ce11dc7f4b2aee457f8c11950c56038f92eab5a146056274f768d3c67eae823fe9298089839171083569e44ce09a9bbcaf3df313640b0c5570169d1769a7f4eb0f2b677482c1b19cf0a6493a152985d9093a4214e54f07df32ae610250b588e0b34f75a7e7da32809757d7294b759bd4cf8a6697b113f485c06ba9fd971f3f3f02be28aeac038bb79ca14626dd888256090dfa7dd7e9734e9f56b7f2b3cad096acf5e12ea8b4f3416aa7d4c2dd5c028b9798e6bbc3eef4bb5c1fd63f2ef1465191ca1a5111d0a292c992424917b5ed3ca57f1e9d42078a2f011d3496c39ee87c2d450c141c01e5d0966e0bd5523eef82c57064ee47cc17ddd408fe48e9c75575dcb505ae4df31b7dd6eef89fb87b281252cd3f1a769d5cbd3a1cb4e4773b2e84be971e8d5d92d8e595699c3b7aae776cecc775341106f2c79fe8f8a8f6465f788ffd2ba0c873bc6bcdf9396e0c656a1d3d5a57ff9dbe63605a8ab60e5436e67d42770ad72ac8838d5404be01eb8905a6ef641e42051660a82e6905187fe5687bfa56351f3f191d0866d148fb7f4e23cf767e6f5abc8b7fda9fbfba9df0160e6795f9c8eafd2dacc7e53bce359063ef796e77a5c2f45e30394353f0a32624ab35b15254fbb92fd6278ff68439295db9f10a60629fab5414ed6b4df0f7b3718a6e20e7bc705744be5035e3af0bae2ae0dc270f752d6a9b11b33f0d7948e893f50b24fc9b0be1bab5586f96b2fc56f8c5bddde3a791300bd3c60739e869583e104abd48ca9e313caa4a601c7abe46f47f4646a3fe11ddec878e32c541ef4bed607df32976d74cb8954e18a35f6a36b5d6932af5e8719b19facfbaacea42e54fe5392e1ad9a2298b03e2ed6c1fc36558c67867f71851dd8d3c7bf628cb3caf6ec8efd070eea1d4761e951213b5e5b21aa118b9ee6a992b4c6f8d1f03e9b2a3733932faddf3f21c6e276f81e8facfc675f017a1d70dae39050dde76463e1fea1843a2c8e31e8d9d27dfc8901a7c3b19c1f97bbf18e9050eaeb4979338f41c58699cbbaf320f0fa2360bb08fb273cd8036c7937b1b649359ca925ea7edd563d67fc08dd1093d1ee25edd7b5a13d057a5eb1f8ca40ab85ffad676117746d5e0ee9d495787f835b962d39d9c594a82001f457bb5cadbe60da5bc6cac6895b23e5d2f71ad8c53b71b12c3bd1efc3e9a942d3b7025ed5717bda46496695717eb48328c2ab3492fa33665b797d1beb24ca2bd0d6138066d34504086483effa15197fe93dd840f868476e3b572d1e4926446eb27dab5b645a4ffa8c63ebe7e0abbac2c11923116e48e330ce8b73c875971f5170d90778d52dd90b17fcf82f937f74e06acf2328facae3876bd9362e334482aa8f0bf3307e62623a3fdcf0d319633fb20823df3d1f537291f2c00000000180000000000000017010000040000000200000000000000900000000000000017010000020000007b0000003813391f8ccc9b2111aa70494f63e48e9d5c8c440562c10692789a752266c6c5f82f0477cb327c139720cf4bb7f67b5020d1dff805728ed1fd0508fc7fff3da78e53b8ea98e00d76c009e949423671a9b39c9d864c3d51640ca28f17a161683e0b98bc028022b62476fc2b75878328234694228963f87859bc06ff00180000000000000017010000030000000100000000000000180000000000000017010000040000008100000000000000"], 0x10f0, 0x4}, 0x84) 12:53:52 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(r0, 0xc0505510, &(0x7f0000000280)={0x9, 0x8, 0x2c, 0x2, &(0x7f0000000080)=[{}, {}, {}, {}, {}, {}, {}, {}]}) write$binfmt_elf32(r0, &(0x7f0000000300)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0x7f, 0x1, 0x9, 0x2d, 0x2, 0x7, 0xff, 0x30b, 0x38, 0x10e, 0x1ff, 0xb10b, 0x20, 0x1, 0x1, 0x4569, 0xffff}, [{0x60000001, 0x8000, 0x1, 0x2, 0x4, 0x0, 0x1000, 0x200}], "7d6fd3d0c1cec73aa1e54a973f0dead3482a2c6ce8116be5d485a28ba9a16f4d7f8badfd12b2bb1fd6058f666422f9f28a056ae5c7b833554ce3e7cc65712f064a0d6dd0fe3d66fff238bef7eea935291af178f1657602d36a399180a63090dbf4d7877d31e1c7b90153f76484e45e2424e0aa62575d0217746607e51dcf6d22b31842ca8dc6e3c5a4460717b8c3341ebc17417d", [[], [], [], [], [], [], [], [], [], []]}, 0xaec) 12:53:53 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000110ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) [ 1449.257709] Bluetooth: hci0: command 0x1003 tx timeout [ 1449.263138] Bluetooth: hci0: sending frame failed (-49) [ 1449.977776] Bluetooth: hci1: command 0x1003 tx timeout [ 1449.983164] Bluetooth: hci1: sending frame failed (-49) [ 1451.337866] Bluetooth: hci0: command 0x1001 tx timeout [ 1451.343277] Bluetooth: hci0: sending frame failed (-49) [ 1452.057764] Bluetooth: hci1: command 0x1001 tx timeout [ 1452.063200] Bluetooth: hci1: sending frame failed (-49) [ 1453.417824] Bluetooth: hci0: command 0x1009 tx timeout [ 1454.137800] Bluetooth: hci1: command 0x1009 tx timeout 12:54:03 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0xfeffffff00000000) 12:54:03 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) accept4$x25(r1, 0x0, &(0x7f0000000040), 0x80800) 12:54:03 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000000)=ANY=[@ANYBLOB="0400"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="00000000000000000048ba1dbce83ad52a0000000000000068cee508bed8950c7e0a68c01323046814204268913dfc18d868da623e86c7fa3a1618274fbb5d17c26c393d2fb7021aa608e4c2b38f657b77e129cbdca1f920628093a0d110fbcc2d6e47b0ea9edbe85eceee6b334cd5e902df8a4fd101ccaa23a7ded5d7e98da63bea5c832200"/148], 0x48}}, 0x0) 12:54:03 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x40000fffffb, 0x0) setsockopt$inet_dccp_buf(r0, 0x21, 0xd, &(0x7f0000000000)="bd0b215204018ba0a1e5949c0ac8f1a0be36ff602ec06a5612", 0x19) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0xffffffbfffffffff) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:54:03 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000152ff02003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:54:03 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(r0, 0xa87b) syz_emit_ethernet(0x2d2, &(0x7f0000000100)={@local, @link_local, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x8a00, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd]}, @local, {[], @tcp={{0x0, 0x4e20, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}}, 0x0) [ 1458.027490] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. 12:54:03 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x800, 0x0) connect$unix(r2, &(0x7f0000000040)=@file={0x1, './file0\x00'}, 0x6e) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) 12:54:03 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff03003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:54:03 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400, 0x0) r2 = syz_open_dev$video(&(0x7f0000000100)='/dev/video#\x00', 0x7f03, 0x0) ioctl$VIDIOC_S_TUNER(r2, 0x4054561e, &(0x7f0000000000)={0x0, "1190fa5ef636ac7302f98d7494a8a8e9bf1558e50a7d72a62c4b348315a7d450"}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r1, 0x40505412, &(0x7f0000000040)={0x7, 0x8, 0xd03, 0x0, 0xc}) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) 12:54:03 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = open(&(0x7f0000000180)='./file0\x00', 0x80000, 0x0) ioctl$TIOCGETD(r1, 0x5424, &(0x7f00000001c0)) setsockopt$inet6_mtu(r0, 0x29, 0x17, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000002a00)=[{0x0}], 0x1}}], 0x270, 0x0, 0x0) r2 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000280)='/dev/ptmx\x00', 0x0, 0x0) dup2(r2, r3) writev(r3, &(0x7f00000023c0), 0x1000000000000252) [ 1458.101598] Bluetooth: hci0: Frame reassembly failed (-84) 12:54:03 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x37) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) [ 1458.203538] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:54:03 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000d80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10080}, 0xc, &(0x7f0000000180)={&(0x7f0000000780)=ANY=[@ANYBLOB="e0000000ad9e77f36083e21c40daf526bbc4b61e392d451f5f0d4edbbdd83d77caa778437811814d86dd1c439e9f2ba7c34005c2f239ad6fd72ee2ef62cff4ab9c6719af2f9bbca3039fb4b4cbe68ca32b37ada37ad5d97889c634a3c5e85febe82633dde86f971b3484bc78adfe9aaedccee1652f34e069fa0b8bf43b545e6aedeb4ad9638468adfbad7b24fb48572602d4dec970bbce58ecbb5701b22149ca6465fccdab91a31a35bebe4a4ca69a6cf358d684f95140f0baa498aabd496d0258e2b86db9975d317047a43d010cab64ceb5d3c3d0c1b8a31c38ed305122ccaf22c3ecac14d9e22b8ccc57504ac6af36e18a5981746e6d2db18399232a841cd86e03e7bd518744a17d60846ff2ee99964656c8386c70c27cc451aadebf1dfdec4f3fb7984c5c947a9f3aa2311e576d2237a1d7c6c24efd4e8ad0195666faaeb405000000000000004e81628b53e3e5ea7ea07b79c4eac8244a32d87864735baf633d6cea247454bed8e43c1d07e2fbcab1cfa051a0ac6f091d0dd571a3295a61f6b8ea0cf86887e44b085d9ec5bb48ffd096783ddd0b6ca22dce423e5aac8733e3d89e7685e2bad1e466da2b34ad37cef8c8dc5adf2137fbbb88891642a639ff42234b00f8441669cba2e0caf8deeea80977624b2feb935851aede353d3ae7ed406d879f994770360bdd580e9429a39603a40c28cf9929dd8af5a3cb17b14314007cbc79168945fa746d52882edcd1f5552fc5406aae3e87599733da616249ca8706c22d027edbdfea2dcab57672cf8a9b15584ef0d2bf8d7c2e04e021bc09ac72f0e911d0a04fbebb1ebf7ca81716af6a00815cdd", @ANYRES16=r1, @ANYBLOB="000828bd7000fcdbdf2505000000cc000500080001006962000044000200080001001500000008000400400000000800040008000000080004000100000008000400ff0100000800040005000000080004000200000008000100060000002c000200080003003f000000080004001f0000000800020000100000080001001600000008000200010000002c00020008000200ef00000008000400000001000800030020e40000080001000200000008000200feffffff24000200080001001a0000000800040003000000080001000d0000000800020081000000"], 0xe0}, 0x1, 0x0, 0x0, 0x40}, 0x4008041) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000200)='/dev/full\x00', 0x2000, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000040)={0x0, 0x100000007}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_MAXSEG(r3, 0x84, 0xd, &(0x7f00000002c0)=@assoc_id=r4, 0x4) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) [ 1460.147732] Bluetooth: hci0: command 0x1003 tx timeout [ 1460.153159] Bluetooth: hci0: sending frame failed (-49) [ 1460.937747] Bluetooth: hci1: command 0x1003 tx timeout [ 1460.943145] Bluetooth: hci1: sending frame failed (-49) [ 1462.217858] Bluetooth: hci0: command 0x1001 tx timeout [ 1462.223258] Bluetooth: hci0: sending frame failed (-49) [ 1463.017844] Bluetooth: hci1: command 0x1001 tx timeout [ 1463.023238] Bluetooth: hci1: sending frame failed (-49) [ 1464.297735] Bluetooth: hci0: command 0x1009 tx timeout [ 1465.097768] Bluetooth: hci1: command 0x1009 tx timeout 12:54:15 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0xffffff7f00000000) 12:54:15 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff52003b54c007110000f30501000b000500000000000100cf", 0x1f) 12:54:15 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x7, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$IMCLEAR_L2(r0, 0x80044946, &(0x7f0000000040)=0x4) mmap$binder(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:54:15 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) ioctl$KDGETLED(r0, 0x4b31, &(0x7f0000000000)) 12:54:15 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000280)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r0, 0x40505330, &(0x7f0000000040)={{0x0, 0x1}, {0x80}}) 12:54:15 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) socketpair(0x1, 0x4d62edb645abd238, 0xff, &(0x7f0000000000)) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') 12:54:15 executing program 3: open(0x0, 0x0, 0x0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000002a00)=[{0x0}], 0x1}}], 0x270, 0x0, 0x0) r0 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000280)='/dev/ptmx\x00', 0x0, 0x0) dup2(r0, r1) writev(r1, &(0x7f00000023c0), 0x1000000000000252) [ 1469.551898] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:54:15 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02023b54c007110000f30501000b000500000000000100cf", 0x1f) 12:54:15 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000000)=0x0) syz_open_procfs(r1, &(0x7f0000000080)='net/snmp\x00') mremap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x4000, 0x2, &(0x7f0000ff9000/0x4000)=nil) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) [ 1469.630279] Bluetooth: hci0: Frame reassembly failed (-84) 12:54:15 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) stat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000280)) r1 = syz_open_dev$vbi(&(0x7f00000000c0)='/dev/vbi#\x00', 0x1, 0x2) ioctl$DRM_IOCTL_CONTROL(r1, 0x40086414, &(0x7f0000000100)={0x2, 0x5a9c}) fsync(r1) 12:54:15 executing program 5: prctl$PR_GET_PDEATHSIG(0x2, &(0x7f00000003c0)) r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1f, &(0x7f0000000240)={@dev}, &(0x7f0000000280)=0x14) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'nr0\x00', 0x0}) accept(r0, &(0x7f0000000400)=@xdp, &(0x7f0000000640)=0x80) accept4$packet(r0, &(0x7f0000000680)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f00000006c0)=0x14, 0x800) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000780)={'vcan0\x00', r2}) r4 = syz_open_dev$sndpcmp(&(0x7f0000000140)='/dev/snd/pcmC#D#p\x00', 0x5, 0x4000) setsockopt$inet_tcp_TLS_TX(r4, 0x6, 0x1, &(0x7f0000000180)=@ccm_128={{0x304}, "74a484b99081c7c3", "6f6774ea8cb6b2126ce3c4c41945a4d4", "4e3f73ec", "e1cbded94fbad85e"}, 0x28) sendmsg$nl_route(r4, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=@mpls_getnetconf={0x1c, 0x52, 0x8, 0x70bd2b, 0x25dfdbfc, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20004080}, 0x4000005) ioctl$KVM_SET_GSI_ROUTING(r4, 0x4008ae6a, &(0x7f00000001c0)=ANY=[@ANYPTR]) ioctl$KVM_GET_IRQCHIP(r4, 0xc208ae62, &(0x7f00000004c0)) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r3}, 0x10, &(0x7f0000000700)={&(0x7f0000000000)=ANY=[@ANYBLOB="0400000000000000000000000000000004cf78073384b151a569544b2bea8b6bc99ba25a3ac4108a5b7a912220da19982e8e4d88601f466ce2342933aee7766bbb118f893a8835c310000000842ff9ec4af36f266fd9c35f40ec3e00c7270ba6d8e21b76d8a66357e4f03b1ba32e6e96b1acc8f4d0c8b2a617900800818a0ff5e4b7ac948af0df875b98165b5decccd8d4aa0bcfa22b1eeffd6f0c928cd56bcb38b4d5e34bf103e71284fc116486fcf273c25a32e0d5a51d4cfb18b9cd3c2c1ed16a633d859a8cc9fa56ee4f40a2fefaea95f004e8cd9f8a7fed4543973edf7f09fa94d6d3d1d35444b2b95e56d91fff681377502b08a5784a25312ccd14cf9dfa69180633390e", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000000001000000000000000000000048ba1dbce83ad52a"], 0x48}}, 0x0) [ 1469.705828] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:54:15 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) r1 = getpgrp(0x0) syz_open_procfs$namespace(r1, &(0x7f0000000080)='ns/user\x00') mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r0, 0x84, 0x19, &(0x7f00000000c0)={0x0, 0x3}, 0x8) mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) openat$cgroup_int(r0, &(0x7f0000000000)='cpu.weight\x00', 0x2, 0x0) [ 1471.657773] Bluetooth: hci0: command 0x1003 tx timeout [ 1471.663193] Bluetooth: hci0: sending frame failed (-49) [ 1473.737827] Bluetooth: hci0: command 0x1001 tx timeout [ 1473.743562] Bluetooth: hci0: sending frame failed (-49) [ 1475.817802] Bluetooth: hci0: command 0x1009 tx timeout 12:54:25 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0xffffffff00000000) 12:54:25 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02033b54c007110000f30501000b000500000000000100cf", 0x1f) 12:54:25 executing program 3: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x800) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000040)={0xffffffffffffffff}) setsockopt$IP_VS_SO_SET_EDITDEST(r0, 0x0, 0x489, &(0x7f0000000080)={{0xff, @local, 0x4e22, 0x2, 'lblcr\x00', 0x7, 0x8, 0x79}, {@broadcast, 0x4e22, 0x10000, 0xb3, 0x1000}}, 0x44) readv(r0, &(0x7f00000001c0)=[{&(0x7f0000000100)=""/177, 0xfffffffffffffe11}], 0x328) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=0x0) ioctl$sock_netdev_private(r0, 0x89fc, &(0x7f0000000300)="45dd94b80393d9b37cfa2874c5a794395097027729873aaf59eb8cfb70912429cc4f99e74dcff258a2a19c3f15d933d989bbbd69a3106153494b9b6a705625bfd76776") syz_open_dev$loop(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) prctl$PR_GET_FP_MODE(0x2e) r3 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r3, 0x89a1, &(0x7f00000000c0)={@local={0xfe, 0x80, [0x600, 0x3ef, 0x0, 0x3f00000000000000, 0x100000000000000, 0x0, 0x1103, 0x0, 0x0, 0x0, 0x0, 0x6]}}) ioctl$sock_inet6_SIOCADDRT(r3, 0x89a0, &(0x7f0000000100)={@local={0xfe, 0x80, [0x0, 0xfeff0000]}, @empty, @loopback}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) open(&(0x7f0000000280)='./bus\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) dup(r2) r4 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000200)='/dev/qat_adf_ctl\x00', 0x0, 0x0) ioctl$KDSKBSENT(r4, 0x4b49, &(0x7f0000000240)="f6d9f95adcf31e0303052573e578ab762ef82244022ba5556ea627f22183a44dde258f2440cbcde93fc735b24c0b5ad281b784cbf31304502d329e74de2bf3aa7d3e7352f70aa2b8b054f140c9b4f596f1498ff449dfa8e83c152ca7828892177b4d58d7f6aa212ca0a871d8ebc9e36755aafaaa6778fc8a08650b9af9081cd65211d0ae8d44d9e5d828d2c54f6742017954cb123d39a4a16c5adf7085c7ee3504377e819a25") tgkill(r1, 0x0, 0x1) 12:54:25 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) 12:54:25 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r0, 0xc08c5336, &(0x7f0000000080)={0x8001, 0x6, 0x3ff, 'queue0\x00', 0x4}) ioctl$TIOCGPTLCK(r0, 0x80045439, &(0x7f0000000000)) mmap$binder(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x1) 12:54:25 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/schedule_icmp\x00', 0x2, 0x0) ioctl$VIDIOC_SUBDEV_G_FMT(r1, 0xc0585604, &(0x7f0000000040)={0x1, 0x0, {0x3, 0x0, 0x3027, 0x5, 0x3, 0x0, 0x3, 0x5}}) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) [ 1479.786882] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:54:25 executing program 0: r0 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x10001, 0x20000) setsockopt$inet_sctp_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000080)={0x800, 0x1, 0x4, 0x90000000000000, 0x100, 0x7, 0x1, 0x9, 0x40, 0x8, 0xff}, 0xb) r1 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r1) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x3) 12:54:25 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) ioctl$TCSETX(r0, 0x5433, &(0x7f0000000000)={0x7, 0x7f, [0x0, 0x2, 0x0, 0xffff, 0x3cf], 0x100000001}) 12:54:25 executing program 5: r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x438e00, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000040)={0x7, 0x0, 0x2fa2d9b532182825, 0x8}) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000080)={0x8001, r1, 0x10000, 0x9}) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r2, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r2, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r3}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[@ANYBLOB="0400865b00df9dbf6f6cb5c9370a0000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000000001000000000000000000000048ba1dbce83ad52a"], 0x48}}, 0x0) [ 1479.829398] Bluetooth: hci0: Frame reassembly failed (-84) 12:54:25 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02043b54c007110000f30501000b000500000000000100cf", 0x1f) 12:54:25 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0xfffffffffffffffa) [ 1479.989058] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:54:25 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) r1 = accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000080)=0x60, 0x80000) setsockopt(r1, 0x3ff, 0x2f02, &(0x7f00000000c0)="509369ff72a330dc4f172389afd9b9f3d511ef7198ae5334efbdcf3062d9ed307f5b23ff0f601f89fb339e7a2694ba51c70b0d9b2d687973871c9a1293d6ce7653de66ea61076e1388df6f91db92853960e53a52489ac6da", 0x58) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) ioctl$PIO_FONTRESET(r0, 0x4b6d, 0x0) [ 1481.897734] Bluetooth: hci0: command 0x1003 tx timeout [ 1481.903163] Bluetooth: hci0: sending frame failed (-49) [ 1482.697731] Bluetooth: hci1: command 0x1003 tx timeout [ 1482.703171] Bluetooth: hci1: sending frame failed (-49) [ 1483.977816] Bluetooth: hci0: command 0x1001 tx timeout [ 1483.983242] Bluetooth: hci0: sending frame failed (-49) [ 1484.777781] Bluetooth: hci1: command 0x1001 tx timeout [ 1484.784077] Bluetooth: hci1: sending frame failed (-49) [ 1486.057734] Bluetooth: hci0: command 0x1009 tx timeout [ 1486.857739] Bluetooth: hci1: command 0x1009 tx timeout 12:54:36 executing program 2: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x200, 0x0) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000040)=0xd86) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f0000000100)={0x0, @in={{0x2, 0x4e20, @multicast1}}, [0x81, 0x1, 0x206, 0x1, 0x400, 0x7ff, 0x6a3b, 0x2, 0x7, 0xcf, 0x7fff, 0x6ca7, 0x101, 0x100000001, 0x1]}, &(0x7f0000000080)=0x100) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000280)={r2, @in6={{0xa, 0x4e21, 0x7, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0xfd5d}}, 0x3f, 0x3}, &(0x7f0000000200)=0x90) ioctl$KDADDIO(r1, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r1, 0x5437, 0x0) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000340)='/dev/video1\x00', 0x2, 0x0) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000380)=0x9, 0x4) lstat(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0}) setfsuid(r3) 12:54:36 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02053b54c007110000f30501000b000500000000000100cf", 0x1f) 12:54:36 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$bt_bnep(0x1f, 0x3, 0x4) getsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, &(0x7f0000000040)=0x1, &(0x7f00000001c0)) readv(r1, &(0x7f0000001700)=[{&(0x7f0000000280)=""/214, 0xd6}, {&(0x7f0000000380)=""/4096, 0x1000}, {&(0x7f0000001380)=""/147, 0x93}, {&(0x7f00000001c0)}, {&(0x7f0000001440)=""/222, 0xde}, {&(0x7f0000001540)=""/179, 0xb3}, {&(0x7f0000001600)=""/201, 0xc9}], 0x7) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}]}, 0x50}}, 0x0) 12:54:36 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = syz_open_dev$dmmidi(&(0x7f00000004c0)='/dev/dmmidi#\x00', 0x0, 0x100) sendto$ax25(r1, &(0x7f0000001780)="d9e07fb26543395dc187e50c7de17a7c49545f0d457aaa7f8a36be88e045fb12f21cc280b83db718c4eebf4c442f2383967a372d8149360cda81f0016d3a75b75900e51239ce910ecb1df4d7370974a60795918e97cc5b13baaa137b08528dc0f4222795489fbfb49da4e6c44f1d96c2ba966bc412527289fc00a3cd416ab03dab68a34093208e63134b2de0ce485b433b8e117faeec463204cc6261a879c954c44d9a6828369ca18aead7f436f4fa7424fce0b84b694428724e56cfffd404011ecb9a83096336fd476c3409ab1e83e3118cba2389b37f667c104e35f907624131", 0xe1, 0x0, &(0x7f0000000500)={{0x3, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}}, [@bcast, @default, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}]}, 0x48) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[@ANYBLOB="0400"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000000001000000000000000000000048ba1d02e83ad52a"], 0x48}}, 0x0) ioctl$TIOCLINUX7(r1, 0x541c, &(0x7f0000000000)={0x7, 0x3}) 12:54:36 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) ioctl$VT_ACTIVATE(r0, 0x5606, 0x7f) 12:54:36 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000000080)=0x3ff, 0x4) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000580)='TIPCv2\x00') sendmsg$TIPC_NL_NET_SET(r0, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x20, r1, 0x300, 0x70bd29, 0x25dfdbfe, {}, [@TIPC_NLA_MON={0xc, 0x9, [@TIPC_NLA_MON_REF={0x8}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x90}, 0x8080) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x94, 0x0, &(0x7f00000002c0)=[@decrefs={0x40046307, 0x1}, @increfs={0x40046304, 0x2}, @acquire_done={0x40106309, 0x3}, @exit_looper, @release={0x40046306, 0x3}, @request_death={0x400c630e, 0x2}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000240)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/69, 0x45, 0x0, 0x1c}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/230, 0xe6, 0x2, 0x2d}, @fda={0x66646185, 0x3, 0x1, 0xc}}, &(0x7f0000000000)={0x0, 0x28, 0x50}}}, @request_death], 0x56, 0x0, &(0x7f0000000380)="87738779ebc5f9bc64064c4592e8abe2bb721a1bdd912a28833303a62c5de0a7234780f7f8a782c1e4c6fe860d3ad1a019c742164557774943606dad08f637aec7ea3a2ff0cbd48625e89c83816aec11e96efc9d5660"}) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000440)={0x0, 0x3e6c6016}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f00000004c0)={r2, 0x6, 0x30}, &(0x7f0000000500)=0xc) [ 1491.312440] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:54:36 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00'}) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuacct.usage_user\x00', 0x0, 0x0) ioctl$KVM_RUN(r1, 0xae80, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000240)={r1, 0xc0, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=0x9, 0x0, 0x0, 0x0, &(0x7f0000000080)={0x77, 0x2}, 0x0, 0x0, &(0x7f00000000c0)={0x0, 0x1, 0xeab, 0x6}, &(0x7f0000000100)=0x35b, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=0x4}}, 0x10) getsockopt$inet_sctp_SCTP_AUTOCLOSE(r1, 0x84, 0x4, &(0x7f0000000280), &(0x7f00000002c0)=0x4) 12:54:36 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x3) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x20041, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) dup3(r1, r1, 0x80000) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/enforce\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:54:37 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02063b54c007110000f30501000b000500000000000100cf", 0x1f) 12:54:37 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) r1 = syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x28100) ioctl$DRM_IOCTL_IRQ_BUSID(r1, 0xc0106403, &(0x7f0000000080)={0x8, 0x1, 0x5, 0x6}) syz_open_dev$video4linux(&(0x7f0000000000)='/dev/v4l-subdev#\x00', 0xf9b, 0x40) 12:54:37 executing program 3: syz_emit_ethernet(0x140, &(0x7f0000000040)={@local, @empty=[0x7, 0x4, 0x1004788, 0x0, 0x0, 0x100000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x21, 0x0, @remote={0xac, 0x24}, @local}, @dccp={{0x0, 0x0, 0x4, 0x60, 0x0, 0x0, 0x2, 0x0, 0x0, "e57044", 0x0, "cd98e8"}}}}}}, 0x0) [ 1491.483028] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:54:37 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) r1 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x3ff, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r1, 0xc008551a, &(0x7f0000000040)={0x0, 0x14, [0x2, 0x3f, 0xe4, 0xff, 0x1]}) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) [ 1491.574313] dccp_invalid_packet: P.type (REQUEST) not Data || [Data]Ack, while P.X == 0 [ 1491.588903] dccp_invalid_packet: P.type (REQUEST) not Data || [Data]Ack, while P.X == 0 [ 1493.418553] Bluetooth: hci0: command 0x1003 tx timeout [ 1493.423993] Bluetooth: hci0: sending frame failed (-49) [ 1494.137918] Bluetooth: hci1: command 0x1003 tx timeout [ 1494.143331] Bluetooth: hci1: sending frame failed (-49) [ 1495.497888] Bluetooth: hci0: command 0x1001 tx timeout [ 1495.503392] Bluetooth: hci0: sending frame failed (-49) [ 1496.217851] Bluetooth: hci1: command 0x1001 tx timeout [ 1496.224221] Bluetooth: hci1: sending frame failed (-49) [ 1497.577839] Bluetooth: hci0: command 0x1009 tx timeout [ 1498.297854] Bluetooth: hci1: command 0x1009 tx timeout 12:54:47 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x400000000, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x19) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$KDADDIO(r0, 0x4b34, 0xbd98) ioctl$KDGKBSENT(r0, 0x4b48, &(0x7f0000000040)={0xb56e, 0x80000001, 0x20}) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x100, 0x0) setsockopt$inet_tcp_TLS_RX(r1, 0x6, 0x2, &(0x7f00000000c0)=@gcm_128={{0x304}, "c3501254e73a8d87", "f5e61714ae41eda45864f4fecfeab06d", "c09607d2", "b2460521fddfbaff"}, 0x28) ioctl$TIOCGPTLCK(r0, 0x80045439, &(0x7f0000000100)) getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x12, &(0x7f0000000180), &(0x7f00000001c0)=0x4) 12:54:47 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) write$selinux_access(r0, &(0x7f0000000400)=ANY=[@ANYBLOB="753a6f626a6563745f723a6170705f646174615f66696c653a73303a633531322ca6c4f3e4f83ab74b14b35004c0d46337363820756e6b6f6e66696e656420303030303030303030303030303030302e303833000e018dab1c811f8f022d225b26500b000049e98dcd71af77f555a37a622377813a6ec6d628779b398bf3318f541c8d4d3eb40b219ea00ae7a943eaffb1415cf3fb531a7bc818554a1eae72f88da8104d195bcc841217e0706270fbce3da3f7500ab31d68a137c000a2516a11e0d833d3653281f820de4bf50923a8f3875b611739fa9a31e20005355dcbdc"], 0x46) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000140)={0xffffffffffffffff}, 0x111, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f00000001c0)={0x10, 0x30, 0xfa00, {&(0x7f0000000100), 0x0, {0xa, 0x4e21, 0x401, @remote, 0x3}, r1}}, 0x38) write$selinux_access(r0, &(0x7f0000000080)={'system_u:object_r:mnt_t:s0', 0x20, 'unconfined_u:system_r:insmod_t:s0-s0:c0.c1023', 0x20, 0x3}, 0x5e) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f00000002c0)=0x3) ioctl$IMGETCOUNT(r0, 0x80044943, &(0x7f0000000000)) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0xffffffffffffffff, r0, 0x0, 0x1, &(0x7f0000000200)='\x00', 0xffffffffffffffff}, 0x30) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r2, 0x10, &(0x7f0000000280)={0x5250}) 12:54:47 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02073b54c007110000f30501000b000500000000000100cf", 0x1f) 12:54:47 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000380)='/dev/ptmx\x00', 0x10000, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/enforce\x00', 0x200000, 0x0) ioctl$TIOCSLCKTRMIOS(r1, 0x5457, &(0x7f00000000c0)) getsockopt$netrom_NETROM_T1(r1, 0x103, 0x1, &(0x7f0000000000), &(0x7f0000000080)=0x4) ioctl$EVIOCRMFF(r1, 0x40044581, &(0x7f0000000040)=0x9) 12:54:47 executing program 3: fchdir(0xffffffffffffffff) pivot_root(0x0, &(0x7f0000000480)='./file0\x00') mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000000400)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000080)='./file1\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000780)={{}, {0x1, 0x3}, [{}], {0x4, 0x1}, [], {0x10, 0x4}}, 0x2c, 0x2) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x1000000, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) 12:54:47 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) sendmsg$can_bcm(r2, &(0x7f00000000c0)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="0400"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="00000000010000000000d52a00"/24], 0x6}}, 0x0) [ 1502.202529] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:54:47 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCGPTPEER(r0, 0x5441, 0x400) openat$mixer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/mixer\x00', 0x2, 0x0) getsockopt$ARPT_SO_GET_INFO(r0, 0x0, 0x60, &(0x7f0000000000)={'filter\x00'}, &(0x7f00000000c0)=0x44) 12:54:47 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000000), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) 12:54:47 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) write$binfmt_misc(r1, &(0x7f0000000000)={'syz1', "201dd65af521aeca80c6e1d8b08107b9498b539b88f7d854e150"}, 0x1e) 12:54:47 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff020a3b54c007110000f30501000b000500000000000100cf", 0x1f) 12:54:47 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x8) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000040)=0x2, 0x4) 12:54:48 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000000)=ANY=[@ANYBLOB="0400"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000000001000000000000000000000048ba1dbce83ad52a51cd065807930fe86e55f5c23e04ac65cca5ca8b356fe76d30bf1a7ff43f226508ba3ec8b99e6532e46addd6a8fb00eb53535626e1160b1ce30c1acc5ce7e4a5f481d889ea676ddf3c97aa318e30a8a821b9caa63075101b304e3beb30bd00ea3a2382ca5287a3c505af08f2b864431a3331e0fff62abaade9f37f45b3eaa4f39a0f98c65f20f776a38e5c58e904b69d6a35bc067639eca6a4c992b7e6b18819f26540007834f2cfb1cadf0f6e70ea7dbaf68d11821e52c8649ab2dbbfa036d1e6d067a81dd8b75e65ffdc174a7ab598c876"], 0x48}}, 0x0) 12:54:48 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) [ 1502.420314] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1502.429112] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. 12:54:48 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000140)=0x80) getsockopt$ARPT_SO_GET_INFO(r1, 0x0, 0x60, &(0x7f0000000180)={'filter\x00'}, &(0x7f0000000200)=0x44) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getpeername$packet(r2, &(0x7f0000000040), &(0x7f0000000080)=0x14) 12:54:48 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff020e3b54c007110000f30501000b000500000000000100cf", 0x1f) [ 1502.571385] overlayfs: filesystem on './file0' not supported as upperdir 12:54:48 executing program 3: bpf$MAP_CREATE(0x400000000000000, &(0x7f0000000040)={0x800000000000007, 0x0, 0x0, 0x6e, 0x0, 0xffffffffffffffff, 0x0, [0x15f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000]}, 0x3c) 12:54:48 executing program 5: r0 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x20000, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x5) r1 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r1, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r1, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) 12:54:48 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_DROP(r0, 0x40045730, &(0x7f0000000000)=0x6) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x1) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) [ 1502.658282] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:54:48 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) ioctl$sock_ax25_SIOCADDRT(r0, 0x890b, &(0x7f00000002c0)={@default, @default, 0x5, [@default, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) mmap$perf(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x100000a, 0x10, r0, 0x63) prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0) ioctl$GIO_SCRNMAP(r0, 0x4b40, &(0x7f00000001c0)=""/197) write$apparmor_current(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="6368616e6765686174203078303030303030303030303030303030345e0047504c002f6465762f62759f8038d3622f3030232f303023002f6465762f6275732f7573622f3030232f303023009591a750f991ef15a35b2d402973666375726974796367726f7570217365637572697479706f7369785f61657430706f7369785f61636c5f6163636573735e656d3100"/157], 0x9d) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$sock_ax25_SIOCADDRT(r0, 0x890b, &(0x7f0000000080)={@default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x5, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) 12:54:48 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff020f3b54c007110000f30501000b000500000000000100cf", 0x1f) 12:54:48 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) 12:54:48 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) [ 1502.847088] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1503.274208] Bluetooth: hci1: Frame reassembly failed (-84) [ 1504.537777] Bluetooth: hci0: command 0x1003 tx timeout [ 1504.543190] Bluetooth: hci0: sending frame failed (-49) [ 1505.337731] Bluetooth: hci1: command 0x1003 tx timeout [ 1505.343134] Bluetooth: hci1: sending frame failed (-49) [ 1506.617900] Bluetooth: hci0: command 0x1001 tx timeout [ 1506.623390] Bluetooth: hci0: sending frame failed (-49) [ 1507.417769] Bluetooth: hci1: command 0x1001 tx timeout [ 1507.423172] Bluetooth: hci1: sending frame failed (-49) [ 1508.697794] Bluetooth: hci0: command 0x1009 tx timeout [ 1509.497759] Bluetooth: hci1: command 0x1009 tx timeout 12:54:59 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x4c1ad8c1db9e5c15, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r1, 0x404c534a, &(0x7f0000000100)={0x5, 0x1, 0x4dd}) getpeername(r1, &(0x7f0000000180)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) sendmsg$nl_route_sched(r1, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80040}, 0xc, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB="2c000000250010002cbd7000ffdbdf2500000000", @ANYRES32=r2, @ANYBLOB="ed00ffff0f00ffffb2000e0008000d0009020000e3c82beb7e63c65051313af57ddb4ba9ca75dbf87ea50f7eac2aa0c0b3f2cd7552722a453d7e3517170da70ab95f21876be61a9c948bb4a9031168df3f2df8913e7fe31fbc0759ab9268ac53524ab27378b43d4aada31e331e52a0fbacd12d5a9c0ab43395b57464dd2829ac82c4b20c0199cc4be77c92624710bb18328c20f66200ee21ae5300220edcb3a606f82ab8640e24f680a11be9860300fbc904e1fd62aff65bcf92c73df5d5b1a04488a46aded29d60f90d722118a192817bf969b6b3b1a8f40490a399484c30a9031b1bf74331474243b09acb0f836aede029dea40e2987d2a03888aa208ef8befaa3939eaedfb1f17ef35ff1e35e66f1996068f65e94e242688fd5ef5e2c7bf5b764f61c12250ceabe6cab27210c91898c976ecd3fed7c7d96591743b69274fa2e1a4b9a167489d448d0"], 0x2c}, 0x1, 0x0, 0x0, 0x8000}, 0x4008050) close(r1) ioctl$TCGETS2(r0, 0x802c542a, &(0x7f0000000300)) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r1) ioctl$KVM_GET_DEBUGREGS(r1, 0x8080aea1, &(0x7f0000000340)) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:54:59 executing program 3: fchdir(0xffffffffffffffff) pivot_root(0x0, &(0x7f0000000480)='./file0\x00') mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x1) mkdir(&(0x7f0000000400)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000080)='./file1\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000780)={{}, {0x1, 0x3}, [{}], {}, [{}], {0x10, 0x4}}, 0x34, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, 0x0, &(0x7f0000000280)) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x1000000, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) 12:54:59 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02483b54c007110000f30501000b000500000000000100cf", 0x1f) 12:54:59 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) setsockopt$l2tp_PPPOL2TP_SO_REORDERTO(r0, 0x111, 0x5, 0x5, 0x4) connect$can_bcm(r0, &(0x7f0000000480), 0x10) getresuid(&(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', r1}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000700)={&(0x7f0000000000)=ANY=[@ANYBLOB="04000000000000000000000000000000043f568c2bee327bebbb12024727bb1aa3f31c39c49cd3b45e9f470674255b31553fc41c837c625796f8aeeebada4a2d0fbb99b62f1a651ec4ecb9d8d6f486cc22de77b221dbd965092666a030707fba151dad23a15cded5b0e4fac89c17afe04af5ea8b3418a8e281e182c168b6703579d01e4a82d2fb4112cc4e3ecdfcb0df56d86a269f598e60e6ed61f7919b4915b7c0dacd6e00e286d0a8a378f4f92fc470bb69a92edb2ae055c576fb16619d367c", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000000001000000000000000000000048ba1dbce83ad52a"], 0x48}}, 0x0) 12:54:59 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) write$P9_RXATTRCREATE(r0, &(0x7f0000000000)={0x7, 0x21, 0x1}, 0x7) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:54:59 executing program 1: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x8002, 0x0) mknodat(r0, &(0x7f0000000040)='./file0\x00', 0x5b, 0x4) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 12:54:59 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[@ANYBLOB="0400"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="00000000010600000000000000000000f27ccea184a2fa96"], 0x48}}, 0x0) [ 1513.701259] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:54:59 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff024c3b54c007110000f30501000b000500000000000100cf", 0x1f) 12:54:59 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) fcntl$setflags(r0, 0x2, 0x1) fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000080)=@ng={0x4, 0x10, "ebda62de"}, 0x6, 0x3) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) bind$llc(r0, &(0x7f00000000c0)={0x1a, 0x311, 0x4, 0x40, 0x1, 0x1f}, 0x10) rt_sigreturn() 12:54:59 executing program 1: r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qat_adf_ctl\x00', 0x10040, 0x0) ioctl$KVM_GET_FPU(r0, 0x81a0ae8c, &(0x7f0000000280)) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000440)=0xfffffffffffffff7, 0x4) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x3}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) r2 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) getxattr(&(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)=@random={'osx.', 'nodev\x00'}, &(0x7f0000000500)=""/190, 0xbe) setsockopt$CAIFSO_REQ_PARAM(r2, 0x116, 0x80, &(0x7f0000000040)="b6ae6734877a93248c98a2", 0xb) ioctl$TIOCVHANGUP(r1, 0x540b, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) syz_open_dev$sndseq(&(0x7f00000005c0)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$TIOCGDEV(r0, 0x80045432, &(0x7f0000000600)) getsockopt$inet6_dccp_buf(r2, 0x21, 0x80, &(0x7f0000000100)=""/209, &(0x7f0000000200)=0xd1) [ 1513.818475] Bluetooth: hci0: Frame reassembly failed (-84) [ 1513.866627] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 1513.906029] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:54:59 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0xc0de91210c0066dd, &(0x7f0000000000)={@broadcast, @dev, 0x0}, &(0x7f0000000040)=0xc) connect$can_bcm(r0, &(0x7f0000000480)={0x1d, r1}, 0x5) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) 12:54:59 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x6, 0x101000) setsockopt$IP_VS_SO_SET_STOPDAEMON(r0, 0x0, 0x48c, &(0x7f0000000080)={0x0, 'ipddp0\x00', 0x2}, 0x18) r1 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x0) [ 1513.991262] overlayfs: filesystem on './file0' not supported as upperdir [ 1515.897797] Bluetooth: hci0: command 0x1003 tx timeout [ 1515.903293] Bluetooth: hci0: sending frame failed (-49) [ 1516.617743] Bluetooth: hci1: command 0x1003 tx timeout [ 1516.623170] Bluetooth: hci1: sending frame failed (-49) [ 1517.977774] Bluetooth: hci0: command 0x1001 tx timeout [ 1517.983298] Bluetooth: hci0: sending frame failed (-49) [ 1518.697859] Bluetooth: hci1: command 0x1001 tx timeout [ 1518.703311] Bluetooth: hci1: sending frame failed (-49) [ 1520.058060] Bluetooth: hci0: command 0x1009 tx timeout [ 1520.777851] Bluetooth: hci1: command 0x1009 tx timeout 12:55:10 executing program 3: fchdir(0xffffffffffffffff) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) syz_open_dev$sndpcmp(0x0, 0x0, 0x1) mkdir(&(0x7f0000000400)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x1000000, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) 12:55:10 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02603b54c007110000f30501000b000500000000000100cf", 0x1f) 12:55:10 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x1, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x80000019) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:55:10 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x8001, 0x0) syz_open_dev$sndmidi(&(0x7f0000000000)='/dev/snd/midiC#D#\x00', 0x10001, 0x2) 12:55:10 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000000)=0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REPLACE(r0, 0xc1105518, &(0x7f00000000c0)={{0x5, 0x2, 0x3, 0xffff, 'syz1\x00', 0x9}, 0x6, 0x10, 0x3ff, r1, 0x2, 0x1f, 'syz1\x00', &(0x7f0000000080)=['/dev/bus/usb/00#/00#\x00', '#\x00'], 0x17, [], [0xfffffffffffff6c3, 0x1f, 0x4, 0x3f]}) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:55:10 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x10043, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x2000, 0x0) ioctl$IOC_PR_PREEMPT(r1, 0x401870cb, &(0x7f0000000040)={0x0, 0x4, 0x5, 0x7}) 12:55:10 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000040), 0xfffffffffffffe53) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='schedstat\x00') ioctl$EVIOCSKEYCODE(r2, 0x40084504, &(0x7f0000000080)=[0x3, 0x3e59]) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) write$selinux_user(r2, &(0x7f0000000100)={'system_u:object_r:ssh_exec_t:s0', 0x20, 'unconfined_u\x00'}, 0x2d) setsockopt$ax25_SO_BINDTODEVICE(r2, 0x101, 0x19, &(0x7f00000000c0)=@bpq0='bpq0\x00', 0x10) 12:55:10 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) fcntl$dupfd(r0, 0x406, r0) [ 1525.241755] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1525.256865] Unknown ioctl 1075343563 12:55:10 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) 12:55:10 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) [ 1525.339611] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. 12:55:11 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02683b54c007110000f30501000b000500000000000100cf", 0x1f) 12:55:11 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000000)=ANY=[@ANYBLOB="0400"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000000001dab59500000500000000000248ba1dbce83ad5130000"], 0x48}}, 0x0) [ 1525.452683] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1525.468416] overlayfs: workdir and upperdir must reside under the same mount 12:55:11 executing program 3: fchdir(0xffffffffffffffff) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) syz_open_dev$sndpcmp(0x0, 0x0, 0x1) mkdir(&(0x7f0000000400)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x1000000, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) 12:55:11 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff026c3b54c007110000f30501000b000500000000000100cf", 0x1f) 12:55:11 executing program 0: r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/hash_stats\x00', 0x0, 0x0) getsockopt$SO_COOKIE(r0, 0x1, 0x39, &(0x7f00000000c0), &(0x7f0000000100)=0x8) r1 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0xfffffffffffffffe, 0xa2840) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x0) r2 = semget$private(0x0, 0x3, 0x1) semctl$SETVAL(r2, 0x1, 0x10, &(0x7f0000000000)) 12:55:11 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) write$P9_RLERROR(r1, &(0x7f0000000040)={0x21, 0x7, 0x1, {0x18, '/selinux/avc/hash_stats\x00'}}, 0x21) ioctl$TIOCGDEV(r0, 0x80045432, &(0x7f0000000080)) 12:55:11 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x1fffe, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:55:11 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x1000000000000000}, 0x0) [ 1525.659825] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:55:11 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:55:11 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02743b54c007110000f30501000b000500000000000100cf", 0x1f) 12:55:11 executing program 1: ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000080)={0xffffffffffffffff}) uselib(&(0x7f0000000100)='./file0\x00') connect$pptp(r0, &(0x7f00000000c0)={0x18, 0x2, {0x0, @loopback}}, 0x1e) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r0, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10240}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x30, r1, 0x200, 0x70bd27, 0x25dfdbfc, {{}, 0x0, 0x5, 0x0, {0x14, 0x19, {0x7fffffff, 0x678, 0x6, 0x8}}}, ["", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x20000000}, 0x8000) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) r2 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x9, 0x8201) ioctl$TIOCVHANGUP(r2, 0x540b, 0x0) 12:55:11 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) r1 = fcntl$getown(r0, 0x9) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000040)=0xc) tgkill(r1, r2, 0x7) ioctl$TCGETA(r0, 0x5405, &(0x7f0000000080)) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) ioctl$GIO_FONTX(r0, 0x4b6b, &(0x7f0000000100)=""/83) 12:55:11 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/autofs\x00', 0x301200, 0x0) ioctl$TCGETA(r1, 0x5405, &(0x7f0000000200)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000340)={{{@in=@remote, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@empty}}, &(0x7f0000000440)=0x33a) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', r2}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r3}, 0x10, &(0x7f0000000700)={&(0x7f0000000000)=ANY=[@ANYBLOB="04006d000000000000000007004240487ed5494bebdf5eeddbf22d00"/38, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000000001000000000000000000000048ba1dbce83ad52a"], 0x48}}, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x40000, 0x7c8e9a92562178d2) ioctl$VIDIOC_S_PRIORITY(r1, 0x40045644, 0x2) ioctl$SG_SET_COMMAND_Q(r4, 0x2271, &(0x7f0000000180)) [ 1525.878953] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:55:11 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff027a3b54c007110000f30501000b000500000000000100cf", 0x1f) [ 1526.039704] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 1526.052658] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:55:11 executing program 3: r0 = creat(&(0x7f0000000280)='./file0\x00', 0x81) r1 = syz_open_dev$ndb(&(0x7f0000000000)='/dev/nbd#\x00', 0x0, 0x1a040) write$binfmt_script(r0, &(0x7f00000002c0)=ANY=[@ANYBLOB="011ab013"], 0x4) ioctl$EVIOCGPROP(r0, 0x80404509, &(0x7f0000000100)=""/85) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) close(r0) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) syncfs(r1) 12:55:11 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) r1 = dup2(r0, r0) ioctl$DRM_IOCTL_MARK_BUFS(r1, 0x40206417, &(0x7f0000000040)={0x5, 0x1ff, 0x40, 0x7ff, 0x4, 0x588f}) 12:55:11 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) sendmsg$can_bcm(r0, &(0x7f0000000100)={&(0x7f0000000000), 0x10, &(0x7f00000000c0)={&(0x7f0000000040)={0x7, 0x20, 0x1, {0x77359400}, {0x0, 0x7530}, {0x3, 0x4, 0x7, 0x2}, 0x1, @can={{0x4, 0x4, 0x3, 0x4}, 0x6, 0x1, 0x0, 0x0, "18289f679e5f93fd"}}, 0x48}}, 0x24000880) r1 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000180)='NET_DM\x00') sendmsg$NET_DM_CMD_START(r0, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200a}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, r1, 0xc02, 0x70bd29, 0x25dfdbfd, {}, ["", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x44001}, 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000700)={&(0x7f00000002c0)=ANY=[@ANYBLOB="040000000000000000000000000000006e4ae4813bb8ad0f58dece7f81d6e70700000000000000c8dc25a97e05523a02d74bde8b50580e3db872b20e6c4ca26dfc0fed63184f50ea6d47c7f58952fcda18050777f8ca77b4563e147b1e04a0ffe98a9508e3db2729cce26b07220e62b9e840750d17e663b284e134e30756916f3ce8dfc456df315cd740b354c9f0126204a24ba6c02241dc2acdb266930c44d2967f71", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000000001000000000000000000000048ba9dbce83ad52a8b3999bcf56669af8478a74215b1bad7f6ed581077f3b59d7844a8cfea46d91e349fed79ca3ea6981898b606b9579e43794dd8751410343079d1702ab4f277a69a56f4b92c2e9b20bfdb49000004c038bc7c65ece98ce8f58665e67ac6e68ad04d5ffe2dd064d158a9a2bb93488367c612f0d3e86de574b37fbf8649f2ad65125b1160f091d2d1b0faaec39b11b5748b95b592b6cff02405afd29f5b06"], 0x48}}, 0x0) 12:55:11 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) recvmmsg(r0, &(0x7f0000003e40)=[{{0x0, 0x0, &(0x7f0000001400)=[{&(0x7f0000000080)=""/112, 0x70}, {&(0x7f0000000000)=""/58, 0x3a}, {&(0x7f0000000100)=""/4096, 0x1000}, {&(0x7f0000001100)=""/253, 0xfd}, {&(0x7f0000001200)=""/254, 0xfe}, {&(0x7f0000001300)=""/200, 0xc8}], 0x6, &(0x7f0000001480)=""/72, 0x48}, 0x49}, {{0x0, 0x0, &(0x7f0000001880)=[{&(0x7f0000001500)=""/181, 0xb5}, {&(0x7f00000015c0)}, {&(0x7f0000001600)=""/75, 0x4b}, {&(0x7f0000001680)=""/99, 0x63}, {&(0x7f0000001700)=""/9, 0x9}, {&(0x7f0000001740)=""/120, 0x78}, {&(0x7f00000017c0)=""/40, 0x28}, {&(0x7f0000001800)=""/127, 0x7f}], 0x8, &(0x7f0000001900)=""/235, 0xeb}}, {{0x0, 0x0, &(0x7f0000001c80)=[{&(0x7f0000001a00)=""/141, 0x8d}, {&(0x7f0000001ac0)=""/139, 0x8b}, {&(0x7f0000001b80)=""/251, 0xfb}], 0x3, &(0x7f0000001cc0)=""/215, 0xd7}, 0xf840}, {{0x0, 0x0, &(0x7f0000002040)=[{&(0x7f0000001dc0)=""/221, 0xdd}, {&(0x7f0000001ec0)=""/125, 0x7d}, {&(0x7f0000001f40)=""/217, 0xd9}], 0x3, &(0x7f0000002080)=""/250, 0xfa}, 0x7e0}, {{0x0, 0x0, &(0x7f0000003540)=[{&(0x7f0000002180)=""/202, 0xca}, {&(0x7f0000002280)=""/206, 0xce}, {&(0x7f0000002380)=""/121, 0x79}, {&(0x7f0000002400)=""/134, 0x86}, {&(0x7f00000024c0)=""/65, 0x41}, {&(0x7f0000002540)=""/4096, 0x1000}], 0x6, &(0x7f00000035c0)=""/201, 0xc9}, 0xfffffffffffff000}, {{&(0x7f00000036c0)=@l2, 0x80, &(0x7f0000003d00)=[{&(0x7f0000003740)=""/64, 0x40}, {&(0x7f0000003780)=""/135, 0x87}, {&(0x7f0000003840)=""/18, 0x12}, {&(0x7f0000003880)=""/218, 0xda}, {&(0x7f0000003980)=""/164, 0xa4}, {&(0x7f0000003a40)=""/111, 0x6f}, {&(0x7f0000003ac0)=""/8, 0x8}, {&(0x7f0000003b00)=""/182, 0xb6}, {&(0x7f0000003bc0)=""/223, 0xdf}, {&(0x7f0000003cc0)=""/45, 0x2d}], 0xa, &(0x7f0000003dc0)=""/69, 0x45}, 0xfffffffffffffffe}], 0x6, 0x10000, &(0x7f0000003fc0)={0x0, 0x989680}) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:55:11 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02e03b54c007110000f30501000b000500000000000100cf", 0x1f) 12:55:11 executing program 2: r0 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x3f, 0x2) ioctl$TIOCNXCL(r0, 0x540d) ioctl$TCGETX(r0, 0x5432, &(0x7f0000000040)) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x0) ioctl$TCGETX(r0, 0x5432, &(0x7f0000000080)) ioctl$TIOCVHANGUP(r1, 0x5437, 0x0) ftruncate(r1, 0x3f) [ 1526.186016] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:55:11 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x213ffd) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x80000, 0x0) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000080)={0x0, 0xbf, "b34863f98a2ff76d0eaffbae169603ce09f2928ee983281a1fff8097fd92bc4a907579719853dbb724310672ca5c4a6caa4d20c716fbe247d264014eacbb773325fe9d8d736ed686c0f33a3519c87166be28c7a71cc31c2922df7f93c5f95635c5bccdb01f969814ea7e1e8f0f6c2b1efc7339c5793b9234b5711f6682769976e8b860b2dec58d0ad7c0cd649de8f6fdf56ae1b0f56ba5ccf19e2116beece347aea53d2f40d8f6fa688e24efe7967e49a103f8d82ed0864401b4f44850a9c2"}, &(0x7f0000000180)=0xc7) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f00000001c0)={r2, @in={{0x2, 0x4e23, @multicast2}}}, &(0x7f0000000280)=0x84) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) 12:55:11 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000000)={{{@in=@local, @in=@multicast1}}, {{@in=@initdev}, 0x0, @in=@multicast1}}, &(0x7f0000000100)=0xe8) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000140)={0x0, @multicast2, @loopback}, &(0x7f0000000180)=0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', r1}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) openat$vim2m(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/video35\x00', 0x2, 0x0) 12:55:11 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02005254c007110000f30501000b000500000000000100cf", 0x1f) [ 1526.237834] Bluetooth: hci0: Frame reassembly failed (-84) [ 1526.249496] Bluetooth: hci0: Frame reassembly failed (-84) 12:55:11 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) lsetxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000500)=@known='trusted.overlay.redirect\x00', &(0x7f0000000540)='}+\x00', 0x3, 0x1) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000000)={0x0, r0, 0x3, 0x6000000, 0xffffffff7fffffff, 0x6}) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f0000000080)={@empty, @local}, &(0x7f00000000c0)=0xc) sendmsg$inet_sctp(r1, &(0x7f00000004c0)={&(0x7f0000000100)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xf}}, 0x10, &(0x7f0000000200)=[{&(0x7f0000000140)="453ab4eee04609e05391ddfedadaa5e0164d31120b7fe9b3d4eb590f226b701e6ebdb181434020bc4a2d8005479648d0ac66ad70562c320f9435704dc5a715d70b032d4c8a74352016d656b03a1df21f4dd3dfde4d721f68a7c264c04b258df65da2266af6a3b75f92e687b0ff76eb91f2477d34a93774c9d14edde0", 0x7c}, {&(0x7f00000001c0)}, {&(0x7f0000000280)="bc5be7d17819ca20565fc2cefcc320ec332fee34d6ca14af448acf508a35acfe667e000dc08d6d4a8ddcae174c424643da9afd3934bc8c2ae61ff13ef6e71d5bdb555f7aefab0fdb5b7552d62b1c213c97bd5d76cf510bf9e45b0eb3043c6d0b9c8acff7bf58139555e2faf1967efefb6b7c79a7b6a8feba06a24afba4024ac313de8ab726a47308a4c279315bb1bcfadef864e02302dbd965da21419c67412137109dc8d3f02208bf2dac9946bee7ba56f1cf61ee6a08f2f9b3325c816ab61828dd2d15c15a9702c8f8171e60b7e912b8be5149ba37bba268c1e7b6b6fab821bb109e28fdc16d0d48882fbb", 0xec}, {&(0x7f0000000380)="37a8b1259c7f353fb28be4326405999eeab4d8afaba28f18ef98b9c3c9bd0ec211678f3fab403b00cf9b7eac8935775569c6c1c3cbce972fdb8a4762e3a7539651cbed14ed77e82030f0b9e5a40bb511b8e96eef112180e9444cca4de3656a634aab7da48e643732b69cd37f5bf2d4415d793767af343446e3ba52716d1f78fc2549cc1ae5b84b5c075ba6f7f78237c0f8cd134da1a79eb0a165d1cc11238e8da491c67bff41a44bd46c2acfe25714d3ca729c9a1827cb067665a24ae9ea9fff1ca64c1c11", 0xc5}], 0x4, &(0x7f0000000480)=[@dstaddrv6={0x20, 0x84, 0x8, @remote}, @init={0x18, 0x84, 0x0, {0x40, 0x400, 0x7, 0x8001}}], 0x38, 0x40}, 0x8000) [ 1526.343936] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:55:12 executing program 5: r0 = dup(0xffffffffffffffff) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f0000000040)=0x100000000000) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000000)=0x1d) r1 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r1, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) lsetxattr(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)=@random={'os2.', 'keyringvmnet0\x00'}, &(0x7f0000000100)='vcan0\x00', 0x6, 0x3) sendmsg$can_bcm(r1, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[@ANYBLOB="50fd00"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000000001000000000000000000000048ba1dbce83ad52a"], 0x48}}, 0x0) 12:55:12 executing program 0: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000540)='/dev/autofs\x00', 0x100, 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f0000000580)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000005c0)=0x14) r2 = syz_open_dev$cec(&(0x7f00000007c0)='/dev/cec#\x00', 0x0, 0x2) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000800)={0x17, 0x6, 0x139, 0x800101, 0x20, r0, 0x758e, [], r1, r2, 0x5, 0x3}, 0x3c) r4 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$ASHMEM_GET_SIZE(r4, 0x7704, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r4, 0x0) fcntl$getownex(r3, 0x10, &(0x7f0000000840)) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r4, 0x84, 0x77, &(0x7f0000000000)={0x0, 0x101, 0x7, [0x7, 0x80000000, 0x100, 0x1000, 0x2, 0xd4a9, 0x3]}, &(0x7f0000000080)=0x16) r6 = getuid() getsockopt$inet_mreqn(r4, 0x0, 0x24, &(0x7f0000000280)={@initdev, @multicast1, 0x0}, &(0x7f00000002c0)=0xc) getsockopt$inet_IP_IPSEC_POLICY(r4, 0x0, 0x10, &(0x7f0000000300)={{{@in, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6=@dev}}, &(0x7f0000000400)=0xe8) getsockname$packet(r4, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000480)=0x14) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f00000004c0)={0x0, 0x0}, &(0x7f0000000500)=0xc) getsockopt$inet_pktinfo(r4, 0x0, 0x8, &(0x7f0000000600)={0x0, @local, @remote}, &(0x7f0000000640)=0xc) sendmsg$nl_route(r4, &(0x7f0000000780)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x44200}, 0xc, &(0x7f0000000740)={&(0x7f0000000680)=@ipmr_newroute={0xb0, 0x18, 0x10, 0x70bd2d, 0x25dfdbfb, {0x80, 0x10, 0x0, 0x0, 0xfe, 0x2, 0xfe, 0x8, 0x1800}, [@RTA_UID={0x8, 0x19, r6}, @RTA_FLOW={0x8, 0xb, 0xfffffffffffffffb}, @RTA_IIF={0x8, 0x1, r7}, @RTA_METRICS={0x50, 0x8, "4a0bdcda5d89e590f9c212c8b90e1d5fdd4a8e1f65e036636a66bd7ce4f38e6c83a453d99f9b727a1c8dfa634deaa8bc1fa96f8cbfa31b9f530389cf8e7508bf7bf4ee4b1f060c61e54253"}, @RTA_IIF={0x8, 0x1, r8}, @RTA_IIF={0x8, 0x1, r9}, @RTA_FLOW={0x8, 0xb, 0x4d5}, @RTA_ENCAP={0xc, 0x16, @typed={0x8, 0x8d, @uid=r10}}, @RTA_IIF={0x8, 0x1, r11}]}, 0xb0}, 0x1, 0x0, 0x0, 0x855}, 0x4000004) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r4, 0x84, 0x18, &(0x7f00000000c0)={0x0, 0x7}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp_SCTP_STATUS(r4, 0x84, 0xe, &(0x7f0000000140)={r5, 0x400, 0x2, 0x4, 0x7, 0xfff, 0x7, 0x100000000, {r12, @in={{0x2, 0x4e23, @local}}, 0x4, 0x80000000, 0x80, 0x4, 0x7ff}}, &(0x7f0000000200)=0xb0) 12:55:12 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x1000000000000002, 0x0) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0x60000000, &(0x7f0000000000)=[{&(0x7f0000000140)="230000005e0081aee4050c00000f0000709110ecab372942b44ee4a0008bc609f6d8ff", 0x23}], 0x1}, 0x0) 12:55:12 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02005254c007110000f30501000b000500000000000100cf", 0x1f) 12:55:12 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x40, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) 12:55:12 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[@ANYBLOB="04000000000000000000c0d400000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000000001000000000000000000000048ba1dbce83ad52a"], 0x48}}, 0x0) 12:55:12 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') sendmsg$TIPC_NL_MEDIA_SET(r0, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="70010000", @ANYRES16=r1, @ANYBLOB="08002cbd7000fedbdf250c0000000c0005000800010069620000540009000800010000100000080001000100000008000100080000000800020006000000080002009e510000080002000500000008000100ff7f000008000200f8010000080002000100000008000100060000005c0007000800010003000000080002004a030000080002007101000008000200018000000c00040004000000000000000c000400090a0000000000000c000400a20f00000000000008000200070000000c000323cb000000000000006c00010008000300030000001c00020008000200000000000800010008000000080002007a0f000044000400200001000a004e2100000003fe8000000000000000000000000000bb04000000200002000a004e220000000600000000000000000000ffffac1414bb05000000340006000400020008000100030000000800010000000100080001004000000008000100a2060000080001000300000004000200"], 0x170}, 0x1, 0x0, 0x0, 0x40}, 0x8084) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) [ 1526.585971] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1528.297742] Bluetooth: hci0: command 0x1003 tx timeout [ 1528.303164] Bluetooth: hci0: sending frame failed (-49) [ 1530.377757] Bluetooth: hci0: command 0x1001 tx timeout [ 1530.383232] Bluetooth: hci0: sending frame failed (-49) [ 1532.457818] Bluetooth: hci0: command 0x1009 tx timeout 12:55:22 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f00000000c0), 0x79c) getsockname$packet(0xffffffffffffffff, &(0x7f00000019c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000001a00)=0x14) r2 = syz_open_dev$adsp(&(0x7f0000000080)='/dev/adsp#\x00', 0x8, 0x8800) sendmsg(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000180)}], 0x1, &(0x7f0000000280)=[{0x50, 0x3a, 0x2, "b6fc2ab19a6434655b8606ffd8cd9c6980333a8bf324df884a35d9dcfc29bd91d97e9f64d7dad5b4a7802635d6abc00903b077accd83ab422aebf1"}], 0x50}, 0x10) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000140)='SEG6\x00') sendmsg$SEG6_CMD_GET_TUNSRC(r2, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4410824c}, 0xc, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="884d1c000000", @ANYRES16=r3, @ANYBLOB="100029bd7000fcdbdf25040000000800040001000000"], 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x44094) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', r1}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r4}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PPPIOCSMRRU(r5, 0x4004743b, &(0x7f0000000040)=0x9) 12:55:22 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x100, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:55:22 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c004110000f30501000b000500000000000100cf", 0x1f) 12:55:22 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) 12:55:22 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) r1 = fcntl$getown(r0, 0x9) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000040)=0xc) tgkill(r1, r2, 0x7) ioctl$TCGETA(r0, 0x5405, &(0x7f0000000080)) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) ioctl$GIO_FONTX(r0, 0x4b6b, &(0x7f0000000100)=""/83) 12:55:22 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x4) 12:55:22 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000140)={{{@in6=@mcast1, @in=@initdev}}, {{@in=@broadcast}, 0x0, @in=@loopback}}, &(0x7f0000000240)=0xe8) r1 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x61, 0x40) ioctl$TIOCSISO7816(r1, 0xc0285443, &(0x7f0000000040)={0x2, 0x1, 0x1, 0x1ff, 0x7}) getpeername$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x0, 0x0}, &(0x7f00000002c0)=0x14) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', r2}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r3}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) 12:55:22 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c00b110000f30501000b000500000000000100cf", 0x1f) 12:55:22 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) ioctl$sock_inet_SIOCGIFDSTADDR(r0, 0x8917, &(0x7f0000000000)={'veth0_to_team\x00', {0x2, 0x4e22, @remote}}) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:55:22 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) [ 1536.767330] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1536.801961] Bluetooth: hci0: Frame reassembly failed (-84) 12:55:22 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) r1 = fcntl$getown(r0, 0x9) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000040)=0xc) tgkill(r1, r2, 0x7) ioctl$TCGETA(r0, 0x5405, &(0x7f0000000080)) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) ioctl$GIO_FONTX(r0, 0x4b6b, &(0x7f0000000100)=""/83) [ 1536.919469] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:55:22 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = socket$packet(0x11, 0x3, 0x300) connect$can_bcm(r0, &(0x7f0000000480), 0x10) accept4$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000040)=0x14, 0x80800) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000000c0)={{{@in=@loopback, @in6=@dev}}, {{@in6=@loopback}, 0x0, @in6}}, &(0x7f00000001c0)=0xe8) accept4$packet(r1, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000640)=0x14, 0x80800) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', r2}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r3}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) 12:55:22 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x6, 0x301000) [ 1538.857744] Bluetooth: hci0: command 0x1003 tx timeout [ 1538.863181] Bluetooth: hci0: sending frame failed (-49) [ 1539.657746] Bluetooth: hci1: command 0x1003 tx timeout [ 1539.663202] Bluetooth: hci1: sending frame failed (-49) [ 1540.937789] Bluetooth: hci0: command 0x1001 tx timeout [ 1540.943500] Bluetooth: hci0: sending frame failed (-49) [ 1541.737802] Bluetooth: hci1: command 0x1001 tx timeout [ 1541.743373] Bluetooth: hci1: sending frame failed (-49) [ 1543.017833] Bluetooth: hci0: command 0x1009 tx timeout [ 1543.817801] Bluetooth: hci1: command 0x1009 tx timeout 12:55:33 executing program 2: r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0x880, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) setsockopt$inet_dccp_buf(r0, 0x21, 0xd, &(0x7f0000000280)="aa3c272beebb02a26b554a62abe611ef006c2901ceb0ac47d9178e6d3999adb749552ba44261e1ead99102f822576bb2b7381445db0c3b464cde1082ba8edfcc1550beb80aebb55eda3dcbbf17812ad2b7c44605a9d305ba7ada", 0x5a) ioctl$KDADDIO(r1, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r1, 0x5437, 0x0) ioctl$TIOCSLCKTRMIOS(r1, 0x5457, &(0x7f00000001c0)) r2 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000100)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffff9) mlock(&(0x7f0000ffe000/0x1000)=nil, 0x1000) ioctl$TIOCSIG(r0, 0x40045436, 0x11) keyctl$clear(0x7, r2) r3 = syz_open_dev$amidi(&(0x7f0000000140)='/dev/amidi#\x00', 0x206c, 0x20800) ioctl$TIOCSWINSZ(r3, 0x5414, &(0x7f0000000180)={0x60c, 0xee3, 0x1, 0x81}) ioctl$KVM_GET_REG_LIST(r3, 0xc008aeb0, &(0x7f0000000000)) 12:55:33 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c010110000f30501000b000500000000000100cf", 0x1f) 12:55:33 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x200000000) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:55:33 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) r1 = fcntl$getown(r0, 0x9) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000040)=0xc) tgkill(r1, r2, 0x7) ioctl$TCGETA(r0, 0x5405, &(0x7f0000000080)) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) ioctl$GIO_FONTX(r0, 0x4b6b, &(0x7f0000000100)=""/83) 12:55:33 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x410000, 0x0) 12:55:33 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x109000, 0x0) ioctl$TUNSETOFFLOAD(r1, 0x400454d0, 0x12) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) [ 1548.267998] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:55:33 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c052110000f30501000b000500000000000100cf", 0x1f) 12:55:33 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$PERF_EVENT_IOC_ID(r0, 0x80082407, &(0x7f0000000000)) 12:55:33 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r0, 0x400c6615, &(0x7f0000000000)) connect$can_bcm(r0, &(0x7f0000000480), 0xfe6c) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600), 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) 12:55:33 executing program 1: r0 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x8, 0x20000) ioctl$TIOCGDEV(r0, 0x80045432, &(0x7f0000000040)) unshare(0x40000000) socketpair(0x4, 0x80004, 0xffff, &(0x7f0000000100)) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000080)=0x0) ioctl$GIO_UNISCRNMAP(r0, 0x4b69, &(0x7f0000000140)=""/187) fcntl$lock(r0, 0x470701ea9b76a527, &(0x7f00000000c0)={0x2, 0x7, 0x6, 0x3ff, r1}) [ 1548.373664] Unknown ioctl 1074025526 12:55:34 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) r1 = fcntl$getown(r0, 0x9) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000040)=0xc) tgkill(r1, r2, 0x7) ioctl$TCGETA(r0, 0x5405, &(0x7f0000000080)) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) [ 1548.418020] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:55:34 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000000), &(0x7f0000000080)=0x4) getsockopt$inet_sctp6_SCTP_STATUS(r0, 0x84, 0xe, &(0x7f00000000c0)={0x0, 0x5, 0x8, 0x400, 0x8, 0x101, 0x5, 0x0, {0x0, @in6={{0xa, 0x4e20, 0x3f, @mcast2, 0x46ed}}, 0xf54, 0x200, 0x4, 0x0, 0x6}}, &(0x7f0000000180)=0xb0) setsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f00000001c0)={r1, @in={{0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x84) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$sock_inet_SIOCGIFBRDADDR(r0, 0x8919, &(0x7f0000000280)={'veth0_to_bridge\x00', {0x2, 0x4e22, @broadcast}}) [ 1548.547387] IPVS: ftp: loaded support on port[0] = 21 [ 1548.740028] IPVS: ftp: loaded support on port[0] = 21 [ 1549.113972] Bluetooth: hci1: Frame reassembly failed (-84) [ 1549.120992] Unknown ioctl 1074025526 [ 1550.377921] Bluetooth: hci0: command 0x1003 tx timeout [ 1550.383338] Bluetooth: hci0: sending frame failed (-49) [ 1551.177722] Bluetooth: hci1: command 0x1003 tx timeout [ 1551.183112] Bluetooth: hci1: sending frame failed (-49) [ 1552.457813] Bluetooth: hci0: command 0x1001 tx timeout [ 1552.463252] Bluetooth: hci0: sending frame failed (-49) [ 1553.257755] Bluetooth: hci1: command 0x1001 tx timeout [ 1553.263178] Bluetooth: hci1: sending frame failed (-49) [ 1554.537820] Bluetooth: hci0: command 0x1009 tx timeout [ 1555.337760] Bluetooth: hci1: command 0x1009 tx timeout 12:55:45 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x40800, 0x0) ioctl$SG_SCSI_RESET(r1, 0x2284, 0x0) 12:55:45 executing program 5: r0 = openat$mixer(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/mixer\x00', 0x40, 0x0) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(0xffffffffffffffff, 0x84, 0x10, &(0x7f0000000300)=@assoc_value={0x0, 0x8}, &(0x7f0000000340)=0x8) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f0000000380)={r1, 0x76, "5b6c8eb351c8fcd63589d8eb957846e431333abe46676fb23b942032a9c5714ceb94fb57ed52a8f9d1c3189b539bc87656d51b1d341bea98fb39e33cdb06d2caf1106c736148202bd92cf9ea395efdfa69fe8ea58851fd60893989f33c6e376c50aeacd76942d617467d367a5bb539ec30c30d19967c"}, &(0x7f0000000400)=0x7e) r2 = socket$can_bcm(0x1d, 0x2, 0x2) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f00000004c0)=0xc, 0x4) connect$can_bcm(r2, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendto(r2, &(0x7f0000000180)="a4e7909076ecc4e0d9662def538eefa278b87ef374266036a88a789a5227849159ca2673e3445d4731c59cbe6116454df5b34ea93a1e368b290049d5104d18315bc06568923cbad1e96de1806b186e6d82aa46330624998717d3df027dc9324ad39e591b10081831e8cad20a5c9c62256256113c327cfeb1425084d12b07d69cde497b76a1436f66ad9140bf33a5a55708da5fbffa0360fa655d7045a964ffa3b719a35d11cb13", 0xa7, 0x10, &(0x7f0000000240)=@vsock={0x28, 0x0, 0x2710, @hyper}, 0x80) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) sendmsg$can_bcm(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x1d, r3}, 0x10, &(0x7f0000000100)={&(0x7f0000000080)={0x2, 0x200, 0x6, {}, {r4, r5/1000+10000}, {0x3, 0x1, 0x80000000, 0x200}, 0x1, @can={{0x4, 0xffffffffffff8003, 0xfff, 0xdba}, 0x0, 0x3, 0x0, 0x0, "6c71a04c4c3ffcfb"}}, 0x48}}, 0x800) sendmsg$can_bcm(r2, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r3}, 0x10, &(0x7f0000000700)={&(0x7f0000000500)=ANY=[@ANYBLOB="0400"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRESDEC=r3, @ANYBLOB="ed00000001a20000000000000000000048d52a"], 0x6}}, 0x0) ioctl$DRM_IOCTL_GET_MAGIC(r0, 0x80046402, &(0x7f0000000440)=0x6) ioctl$sock_bt_cmtp_CMTPCONNADD(r0, 0x400443c8, &(0x7f0000000640)={r0, 0x8}) ioctl$UI_BEGIN_FF_ERASE(r0, 0xc00c55ca, &(0x7f0000000580)={0x7, 0x400, 0x4}) 12:55:45 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007520000f30501000b000500000000000100cf", 0x1f) 12:55:45 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) 12:55:45 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) r1 = fcntl$getown(r0, 0x9) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000040)=0xc) tgkill(r1, r2, 0x7) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:55:45 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x1, 0x0) r1 = creat(&(0x7f00000000c0)='./file0\x00', 0x8) ioctl$RTC_AIE_OFF(r1, 0x7002) modify_ldt$write(0x1, &(0x7f0000000100)={0x1f, 0x20101800, 0x400, 0x200, 0x43, 0x4, 0x3, 0x6, 0x9d8, 0x401}, 0x10) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) fsetxattr$security_evm(r1, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000080)=@md5={0x1, "053a5ec0a9ff68874edfb061bc5b73ea"}, 0x11, 0x1) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status\x00', 0x0, 0x0) [ 1559.771072] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:55:45 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110200f30501000b000500000000000100cf", 0x1f) 12:55:45 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000000c0)={0x1, 0x28, &(0x7f0000000080)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000100)={r1, 0x1, 0x8}, 0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) r3 = dup(r0) pipe(&(0x7f0000000000)={0xffffffffffffffff}) bind$xdp(r3, &(0x7f0000000040)={0x2c, 0x6, r2, 0x8, r4}, 0x10) 12:55:45 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) unshare(0x1e000200) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:55:45 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) r1 = dup3(r0, r0, 0x80000) ioctl$KDGETMODE(r0, 0x4b3b, &(0x7f0000000000)) ioctl$TIOCVHANGUP(r1, 0x540b, 0x0) 12:55:45 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) fcntl$getown(r0, 0x9) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000), &(0x7f0000000040)=0xc) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) [ 1559.928657] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:55:45 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110300f30501000b000500000000000100cf", 0x1f) [ 1560.119508] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1561.897730] Bluetooth: hci0: command 0x1003 tx timeout [ 1561.903143] Bluetooth: hci0: sending frame failed (-49) [ 1562.697746] Bluetooth: hci1: command 0x1003 tx timeout [ 1562.703143] Bluetooth: hci1: sending frame failed (-49) [ 1563.977839] Bluetooth: hci0: command 0x1001 tx timeout [ 1563.984045] Bluetooth: hci0: sending frame failed (-49) [ 1564.777732] Bluetooth: hci1: command 0x1001 tx timeout [ 1564.783211] Bluetooth: hci1: sending frame failed (-49) [ 1566.057744] Bluetooth: hci0: command 0x1009 tx timeout [ 1566.857818] Bluetooth: hci1: command 0x1009 tx timeout 12:55:56 executing program 1: getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000006c0)={{{@in=@initdev, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}, &(0x7f00000007c0)=0xe8) r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x0, 0x80) ioctl$sock_inet6_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000880)) syz_mount_image$msdos(&(0x7f0000000000)='msdos\x00', &(0x7f0000000040)='./file0\x00', 0x7, 0x9, &(0x7f00000005c0)=[{&(0x7f0000000080)="81dc6e02477815620e", 0x9, 0x10001}, {&(0x7f00000000c0), 0x0, 0x6}, {&(0x7f0000000100)="1af2ce40d6caa2ef7f479eb0167f3c43e075c7227df567c15bfc28c6518e1329663d2eb52a32314be23053469191cdfa828c430d7c86377f56aef0745781ff17006c6af822126c317ea1f4637b4bd0bdab6fd9f3f494ca16e1c4018f4e4e35563f39a310416fe066743f50a5ede3c98368bd2d430f97df4f0c2fd26dd8dd6f7bc718678128dc63b20a65cb76209bbeb4f42320e04ad7ccd56d180151699f0d106b6adb8416f48b5f27b7da644c742e068f89e86b1f42bb6c7ffa80b87c20c6e2c0b9f36c1f6cb0b35b", 0xc9, 0x171a}, {&(0x7f0000000200)="a7c39a6a3167b02e3dc0433fc1464f45f6da04e084855b933a3777d49be3c7f5d96ef8aee5b862d20e9c63cf5ca871827b312934bc26d4fa661c7a1d4439", 0x3e, 0x329}, {&(0x7f0000000280)="3b8508df3f83413d852140409cce22beb13598d16ea005a950bdfe7ecd3f641cdd53e8dcbc7bcc2d76767878ea01ff701ba0410011ffe5bb63aae2809be8d4b94e4dbf260cd1c8848f9b0b0ef34b0e34fd80bdf04d346b082d3eb0691b0a2f7ba11b543238e89522b512ee4c9c35b2e74220fb84d1ec6f0751bf42ddda676ab2a4", 0x81, 0x8e}, {&(0x7f0000000340)="a75b38e517dbbe5e68134aca2b84837e7cd93fd71996c0bf5f5e027473b39448cadb32bb4dba45fc7543a45143ce36cd1bec710891e1e516e756f6f9f1fe45eca9d79ad5", 0x44, 0x5}, {&(0x7f00000003c0)="9ce68be464bc63f0851118edc64acc0a06b6b0a6400b37f6d8ab453a8e847bfab8d87f402a1668c415ced3ed", 0x2c, 0x1}, {&(0x7f0000000400)="15edb2654902a3b4ee0d5675298ebc5f7fd5da78915f61784555ff469b67ec870e5a3edaedd087dc313f622451e9d757c35c15f71d8cdf068b966a5cf2e040bc85069962c83999eb388b91a09cd3f3467af75c660b1b125fc310aa242d7cea963b5f8992996f51c10d6e15d7be7bf511a9ed9245fb8da909694238fbf03ce49219", 0x81, 0xfffffffffffffffb}, {&(0x7f00000004c0)="745009b3c6ddf0a32a5b89203a756529f3b4a74ceeda6df463e5f0198f7d06798943c71b30b8824b7398d70a05292697b5773c5c0bd26cab9a7f26513d7eb17ca4cbdc7916da3bd512c217ef9c2773d2de69f73e0821fc7f70c4e31bcae95d8c1cccd955f372d6f362ad8a327691276601704535ed24f7ecf1dd7172ab80cc53b7123ff34f775445b057e4cdfa31e175314d17bc78d4b33984b65efdedf29bb0bd299a29625dc5f5070824934fa29578940fbfcdc36c5289ec91d21ef186462306b4af95f86ff71fb715c65c59bad470416ad123dd117868ba38f9342ddac3955be218c533263b5339dd56d2fd8b2f14f54bd2528ba86c8821657c46fafd", 0xfe}], 0x104002, &(0x7f0000000800)={[{@fat=@flush='flush'}], [{@fsname={'fsname', 0x3d, '/dev/ptmx\x00'}}, {@dont_measure='dont_measure'}, {@dont_measure='dont_measure'}, {@uid_lt={'uid<', r0}}, {@dont_appraise='dont_appraise'}]}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r2, 0x540b, 0x0) syz_open_pts(r2, 0x4000) 12:55:56 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x200102, 0x0) setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f0000000040)=0x2, 0x4) ioctl$KDADDIO(r0, 0x400455c8, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x4000810, r0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:55:56 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$SG_EMULATED_HOST(r0, 0x2203, &(0x7f0000000000)) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:55:56 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) fcntl$getown(r0, 0x9) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:55:56 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000040)={{{@in, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in=@multicast2}}, &(0x7f0000000140)=0xe8) connect$can_bcm(r0, &(0x7f0000000200)={0x1d, r1}, 0x10) getsockopt(r0, 0x1, 0x10000, &(0x7f0000000240)=""/184, &(0x7f00000001c0)=0xb8) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) r3 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x20800) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r3, 0x84, 0x1e, &(0x7f0000000180)=0x80000000, 0x4) 12:55:56 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110400f30501000b000500000000000100cf", 0x1f) 12:55:56 executing program 5: r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x0, 0x2) getsockname$packet(r0, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000440)=0x14) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000004c0)={'vcan0\x00', r1}) ioctl$SIOCX25SDTEFACILITIES(r0, 0x89eb, &(0x7f0000000040)={0x0, 0x4, 0x80000001, 0x2ac, 0x9, 0x17, 0x1a, "e10bc7a3c4aa7b96bbb05f66009ff20f03f40e67", "07ccf98b0a4d38f4f51be887122614706a064008"}) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r2, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r2, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r3}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) [ 1571.287890] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:55:56 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x400000000000000, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) 12:55:57 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110500f30501000b000500000000000100cf", 0x1f) 12:55:57 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) getsockopt$IPT_SO_GET_REVISION_MATCH(r0, 0x0, 0x42, &(0x7f0000000200)={'HL\x00'}, &(0x7f0000000240)=0x1e) mmap$binder(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = fcntl$getown(r0, 0x9) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000000)=0x0) kcmp$KCMP_EPOLL_TFD(r1, r2, 0x7, r0, &(0x7f0000000080)={r0, r0, 0x3}) ioctl$VIDIOC_SUBDEV_ENUM_DV_TIMINGS(r0, 0xc0945662, &(0x7f00000000c0)={0x9, 0x0, [], {0x0, @bt={0x3, 0x8, 0x1, 0x2, 0x20002000, 0x4, 0x101, 0x2, 0x6, 0x4, 0x4, 0xded, 0x3, 0x764, 0x10, 0x9}}}) futimesat(r0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={{0x77359400}, {0x0, 0x7530}}) 12:55:57 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) [ 1571.348049] Bluetooth: hci0: Frame reassembly failed (-84) [ 1571.353890] audit: type=1400 audit(1564404956.949:81): avc: denied { map } for pid=2188 comm="syz-executor.2" path="/dev/ptmx" dev="devtmpfs" ino=395 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:ptmx_t:s0 tclass=chr_file permissive=1 12:55:57 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x200040, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f0000000040)={0x0, @in={{0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x25}}}, [0x20, 0x7ff, 0x2, 0x2, 0x8000, 0x8000, 0xffff, 0x100, 0x1, 0x3, 0x1, 0x7fff, 0x4, 0x1, 0x81]}, &(0x7f0000000140)=0x100) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r1, 0x84, 0x6d, &(0x7f0000000180)={r2, 0xef, "141b18725d87b738dac24f7db5e25569b211b565140594b68c930674ebb76e91bf4b20d4c38fc333815d6f07a9c9a2d6a1fb439c018d9f39bad0505d0ea46018a3fc43015d7fa4a096f71dbd3c8502f556414fbd1b706f0600945889b4448391d42ff8f9d67ade848d5bb0a237d5ddbf6c9c549cc08a3e31e26f3e1e242720a5eb47a3db78e19cd765faed0c1c8a33f969562161d4ae8aa67b0266ff31306316b3993f3da700171bcfa12ed40f8620aca5e60f2dc2cf64a92b0707026536131b783fad9a03c383b6dacffdf02f8065799a5dc6eca959399f8fb27c960420197df956090facc9c4fd86ba103830ce25"}, &(0x7f0000000280)=0xf7) ioctl$SIOCRSSL2CALL(r1, 0x89e2, &(0x7f0000000340)=@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}) ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, &(0x7f00000003c0)={r1, r1, 0x5, 0x21, &(0x7f0000000380)="b3fad722a65ad29e181617def995f0da0b8ffb43835dc04b20c0b63d96a00010fe", 0x8, 0x6, 0x6, 0xffffffff00000000, 0x20, 0x3, 0x7, 'syz0\x00'}) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r3}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) getsockopt$IPT_SO_GET_REVISION_TARGET(r1, 0x0, 0x43, &(0x7f00000002c0)={'ipvs\x00'}, &(0x7f0000000300)=0x1e) [ 1571.453060] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:55:57 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) fsetxattr$security_ima(r0, &(0x7f0000000000)='security.ima\x00', &(0x7f0000000080)=@ng={0x4, 0xf, "1a739c6b0839d0"}, 0x9, 0x1) [ 1572.133145] Bluetooth: hci1: Frame reassembly failed (-84) [ 1572.139520] Bluetooth: hci1: Frame reassembly failed (-84) [ 1573.417742] Bluetooth: hci0: command 0x1003 tx timeout [ 1573.423398] Bluetooth: hci0: sending frame failed (-49) [ 1574.137725] Bluetooth: hci1: command 0x1003 tx timeout [ 1574.143247] Bluetooth: hci1: sending frame failed (-49) [ 1575.497819] Bluetooth: hci0: command 0x1001 tx timeout [ 1575.503295] Bluetooth: hci0: sending frame failed (-49) [ 1576.217817] Bluetooth: hci1: command 0x1001 tx timeout [ 1576.223297] Bluetooth: hci1: sending frame failed (-49) [ 1577.577851] Bluetooth: hci0: command 0x1009 tx timeout [ 1578.297843] Bluetooth: hci1: command 0x1009 tx timeout 12:56:07 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/autofs\x00', 0x100, 0x0) ioctl$RTC_WKALM_RD(r1, 0x80287010, &(0x7f0000000040)) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:56:07 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) 12:56:07 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:56:07 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110600f30501000b000500000000000100cf", 0x1f) 12:56:07 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x40, 0x0) ioctl$TIOCSCTTY(r2, 0x540e, 0x1) socket$inet_udplite(0x2, 0x2, 0x88) 12:56:07 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)={[{0x2f, 'rdma'}, {0x2b, 'memory'}, {0x2f, 'memory'}, {0x2f, 'rdma'}]}, 0x1c) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:56:07 executing program 1: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x0, 0x0) syz_open_pts(r0, 0x101000) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r1, 0x540b, 0x0) 12:56:07 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r0, 0x800c6613, &(0x7f00000002c0)={0x0, @speck128, 0x3, "4ebf00c1b35cf64f"}) sendmsg$can_bcm(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x1d, r1}, 0x10, &(0x7f00000000c0)={&(0x7f0000000040)={0x7, 0x0, 0x0, {0x0, 0x2710}, {}, {0x0, 0x1ff, 0x100000001, 0x10000}, 0x1, @can={{0x1, 0x6, 0x5}, 0x1, 0x3, 0x0, 0x0, "8da40b7c0c74abb7"}}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x40) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/avc/hash_stats\x00', 0x0, 0x0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0)='TIPC\x00') sendmsg$TIPC_CMD_GET_LINKS(r2, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0xbf2f83945bcb0f79}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x24, r3, 0x300, 0x70bd29, 0x25dfdbfc, {{}, 0x0, 0x4, 0x0, {0x8, 0x11, 0x3ff}}}, 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x0) [ 1582.174196] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:56:07 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x2000) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:56:07 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110700f30501000b000500000000000100cf", 0x1f) 12:56:07 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) [ 1582.225289] Bluetooth: hci0: Frame reassembly failed (-84) 12:56:07 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) [ 1582.304533] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1584.297856] Bluetooth: hci0: command 0x1003 tx timeout [ 1584.303398] Bluetooth: hci0: sending frame failed (-49) [ 1585.017826] Bluetooth: hci1: command 0x1003 tx timeout [ 1585.023247] Bluetooth: hci1: sending frame failed (-49) [ 1586.377852] Bluetooth: hci0: command 0x1001 tx timeout [ 1586.383711] Bluetooth: hci0: sending frame failed (-49) [ 1587.097846] Bluetooth: hci1: command 0x1001 tx timeout [ 1587.103315] Bluetooth: hci1: sending frame failed (-49) [ 1588.457787] Bluetooth: hci0: command 0x1009 tx timeout [ 1589.177757] Bluetooth: hci1: command 0x1009 tx timeout 12:56:18 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, r1, 0x100, 0x70bd26, 0x25dfdbfc, {{}, 0x0, 0x4102, 0x0, {0x10, 0x13, @udp='udp:syz0\x00'}}, ["", ""]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x8010) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:56:18 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110a00f30501000b000500000000000100cf", 0x1f) 12:56:18 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000280)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) ioctl$VT_WAITACTIVE(r0, 0x5607) r1 = syz_open_dev$mouse(&(0x7f0000000040)='/dev/input/mouse#\x00', 0x1, 0x100) r2 = syz_genetlink_get_family_id$fou(&(0x7f00000000c0)='fou\x00') getsockopt$inet6_mreq(r1, 0x29, 0x16, &(0x7f0000000100)={@empty, 0x0}, &(0x7f0000000140)=0xd) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x24, r2, 0x204, 0x70bd2c, 0x25dfdbfe, {}, [@FOU_ATTR_IFINDEX={0x8, 0xb, r3}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @loopback}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004010}, 0x80) 12:56:18 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[@ANYBLOB="04361a816e0000000000000000fb0000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000000001000000000000000000000048ba1dbce83ad52a"], 0x48}}, 0x0) r2 = syz_open_dev$usbmon(&(0x7f0000006980)='/dev/usbmon#\x00', 0x0, 0x40) setsockopt$inet_sctp6_SCTP_EVENTS(r2, 0x84, 0xb, &(0x7f00000069c0)={0x200, 0x114, 0x2, 0x6b83, 0x1, 0x2, 0x5, 0x100, 0x6, 0x5}, 0xb) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000006940)='/dev/btrfs-control\x00', 0x4400, 0x0) sendmmsg$sock(r0, &(0x7f0000006740)=[{{&(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e23, @loopback}, 0x1, 0x1, 0x4, 0x3}}, 0x80, &(0x7f0000001840)=[{&(0x7f0000000080)="d8e3d2e9e278af70b90e6eafddaa499923834b7a892f9abf21803d76191af017095e10a52bce", 0x26}, {&(0x7f0000000780)="3edc428b4997c19d114ac6f3989025af49b6c4aee3b3ab1218a8f96b0979ae34c7b8a8bc6368d358b8e5c9d887d636ee49a0b191493906f1babe164cb252b772858baffab4dc70d39667c1c0fc830378170e7466cb55e4c70b0c30915e56724098705c40722e89cce3d488c97e07432504466d9ebd07f7b540867312f0049391ab09b639a63f5dee61c789000a6f23c4c6ef1a1de96ef57b76c71e33b9e9402cf54c9cb0620bc45aeb4b18d25b51b386b11bc073cb355d0b6c4f44dbfc160ed66505f503808a46d2625726ddabd16e1a6bd134a05c1bf35fb03f4a2a536814e0beca02e2e6975a8e56b45e09233d085de89131ad30e6878f6116c152a8051106eaa082321bf89f9fa1531c75aae651b5fccd30400097492d358116c848d442c0f26ea79b305b7ddaffb71f4b5c1de685ec87a6b5d084f5c891f3574826395073d00a32ed64cf064267ed93ee18100c055960310fe6742e4efd3663915b6d9cd7cd87d203e9bdc8a179d339305ef747c5ed66c7a88a97ec063e9afb8a51e2ab68d42f8f74744bab02324cfb1ec94b6e4f9f77e9832259291fc912964a341fdd063225b90acb9c5e896b5a8b72e376cad6ba39ce9abac876fe85eedd77bc46b76a41d341c34a68f8eb2874319ca5c9c491d38e73049249d9cc650c8d1ebf991a3baa995f2a591508421fb101fd874ab86daee3470aae0771bd0bf09d5d87ecbb9a24d965736165782d37b05f9b3ecb703fda48c73adad643e0e78569fd08b9c327a619cb8ce93f86d23ac9347ecc2aaf2f1505e4f580573360ade89a98facdd6f5f39b6450ff69a878140b7d86e3e55ad1b146244ddd7cd865530d18619d5d4d4ae19ceb7ba7a7113f99c42afb21801de58d9236b5b795d0e14a733e42aa0c2b0f7e96232a115df0a5ec0773836088d0f50985c0d8ae7b3d66c14899ad7180bdf4da4f729d60932cc0868ad293ce3797f514a68b855fb06369969ceceac956b66346167a41c843955ad30eb75c7f006bbcb0ae72ffca421d38729b8622a1385b6f9a8ac71943ef383b93ef0d988ee25de02bc5b748984f917e0a3de4bae6c777adba4a94a91672625d0924c2f9ae3a726cb5e54d30a9bf71e47d7c8b5cb14ca2d644cf4b48c520a8a6380d6314ce76d42ff8dab928a8dc9f371185f487e7e10b6ef918e8ca8ddae68a150cf1bdd6032abe872549943786f9098fd55e258cf4ec457233793f457d1c7ab87082c248ef134a1812ddec12f0d546c0af8c72cf63410f54342d6710346fcf996abe9b6090921796244bf3af0626819844509abcb1fba1003b7224a8b4bea4535437b1be7d8617540c5f58118ee22af6ea1b2d006a0e657ce7aa75432851dd3dd0cd4be1101ba4c90ebf04d9b54ad3f5ce99093e2b6840eb4023e64a764450846dba506d1087fae7830eea726c0e014d2a3941b76ce88f05e4cf83e5f6d9fdd995b0c831b19d31e789e54e728d70e84be69c7f3f66a4b340f7a89899a1aa9959ae19312575dd7664b7d4de929eec0eb2c52c23ade8b27ec95804133eb01fbee812827bd29f4fb952412296d2fe98f17ab36978a9919e4f98ec99aafaafb330baee709cf1fd33c68d3a6d5415895e0300226d8b7c0b16ba63e49fc62b99c20f10f52d599d7f925615382aaebe44951db73302b969378686b3fb754a5d577f3a8d16cb33801782ade8248950a1801911b26bb6d50e0cc868b43f87060022ce7bee20e53cae1d509cf7b29c620a130a9c507b1277570c1f9a3aed39d062c95b36db6851fa910f2072c5ab19d16187dc06991d1a2bd02b04624a5a216e7d9f2c958c20bd07784f61fd36916a2f3349606f99c67f791ee714e44861caad9207e743f702421c7fab225461b2f773dab7d91c35e0d1bb6981e578002cd018cdcbd980fdbf5dbb060bc9dd4480a19d63cf2f29fccdcd6942494d0904e7eb3908355ba2163cac18b31cfe5434e61d42696b9331ad454a22e994d47896d9823375be2f961164363c02513b0f951d0c47a3cad0d495047c143aa9ee8c6efd03b788a4ceaa29a9f1d8bc94f60dacfc8facd056610e10eb3b58276c5cf4e16264cecebdfad282342effc42256e17a912b9af7d5698e2a7b93b4a0ef2da4d02419ad967ae3a3060e177308ea24b6bf86e0e9d7884bf47a2b030eab8db021ae38cfc1851f2c305bd0ced9a85743586ea9b332fd5fca237fa74dbd7287b4dee4e106ad5785269d3f661161893a8cdef30766a463dcdbdd11900c8147e7eb0d95859942e91f075e89ef303fcbf17ccdfc0e174384dbcd27ab36011527ef9bcec1130486943ccc09beac95fe1be07a3492e9355dc6791da688b2bceb7e57cf3e4cdd7eb6e31405ede0c6777098c70a382f6ab715d162cce25c3e87e424b4d004679a314af8c289b9e718804eb48a6340ce9194d6b52196485e93229a6a5be38ef945a78a5c84871bfc81882c565b33e92f4fb679572cc1fbf5efc0ab0bdbddbac51a585733bae57a8358d43134324643ddfad2d8f12c979bd608c881aa8e71d7b134d03e4156c3d80a465e83252e3a9945378871419f31de9c11a6dde571bff798f5b0b355cbdbb94364e3fcdbc223ac90814310c16221771952de696ea9d4c7cb2cd8c96dbe12b745638b9d90685ab0b8ae56facac625a07ba41a016bcf53c6281d7d95e3b1705947683d7a6488ecd15f2b4338d0f4ac66cf3e25b3e62fc5c3965d97c765aebd14a9cbcf3b97a0ac31f04351596dbd303acdb181e0f17e3f0b65008384e1abe3c9a2baf98defed9114850937941a28ec8686b581c39801936727b9ca9d0b11c3ad850aabd6b768af1875168811f6f0b6346147a371c12ad3c9c3b1822b3886c3d25f2b2bc2fc46eb72d7d161fb22048e7a7e006d0fda22bfb441e1b15b7dc0d7c145c8e18515a19b1dd441e1a194a265d3c4459e86ef81231cfba905572e3c72b313ca116b003c523a88c490a788bf5a0634d71983ec0966f4d0aa2eda8aa405288631c6e653925f934dac15af51b8b38de24871362a418908e9886fdc1af7f680714a7ec358ae28c170db507af5aed5ef019526af011966d0b366d99bbef692eccde1a0afed730eb8cbfd01faa3408bcea5b54d162382ae41b789853a78741bba29fdf04cd26e4b3c197c44075faed38effa3cf207c8bbc5328898fcbd1e632ab321bb49ca3133626505d17911629b84c6041f62a2d86a6fbf6f4cc6b25fcdd96fad8b73b39cb6203347ac7548e04691f10e6105076cd4a530d091c5abeabbd7692ff4f21993e638d46d5b7677d1408355467624be0f93094637ccb3d261bbe62544c72f4e1236b526bb2235c83f03767a3d3761c46ddf61854e01cc3616e39de5e09094db6324c44efa3832007223fdc304eb27174c56910c81eea56061591bdd341cc966565dace3f71f9b17c4cd592921728633517a5c1b7218ea646d0671953e492027225c5f752f7769afddf6eab3fab4a0e58c23ad9e5a3c66fb9b6f7d1323053de7e7d3366f00d8450019e15975f44fe5c1c25347359971127b9d0081bf73d1d33a9695d1c7e6bc15fc07e4d01ea58cf9bcc68d6cd84e8257c40d33d61182f7d8dcad9b8973f474d3a285636aa477bb9a9b979d6c703b7fea8ff71cd0bd90a74003e07e1cf5c459d3683aa31432b14c2e8232da58b471173c37841c18e3fff3d1ab49012a5abeb8dc22ddc4f1fa9f8be331eb5ed2e04edde5be347c29793cf9673623250cee9b6dc3ec7f0e8b8dfcc18e37076e78e25a1ff00e0dee384a412d3c8120fe23e51aac07ef96be9550372c8bc188881d67844c828edee00e95da482299f88522e8647c81765a1d69bf06d687e0cd91a95a280d1013e0208f4dd05919ea0b7568886fa5318286c44da1aa3677e1f07851cef5fe99f47f71f87e1dd07560a45e7a54ea91106d68ebf09b01ded1f4d103a108258067f56526a1ae28a08bd0eda21a1ca86e3c9bdcba2e3176646a00f791b6f21c482c6af431160a838c88b1705b5f04348bf5e57d3ffcdafa92bf18bfb5a0a59ec106f1cb556645fe0b165fb5954f6e85ea28aec308e22cf35296ba15a8b08997857b3be0b7349f86034f7ff81b822a8cb416c5f4c67d37da31f0c40ad855ed706109be985667bb72fedb222d4042d64dd087c15e91337ec075eb4c142a446ba1de8e69ab7cd3ea27566aadf83daed889ba14c182556a3bdd3c0c90796a0a60fa20b2a859f7f35a4f9bb1fb0591d0a3926a0d8247ddf39428f7706630ac81fa77051592dba2a181ce63acce3fad6c58ee91065eb1d8ab19e0a413c6eaf079fc6dd5058d73da713ee43205f4512088c08f9f2035fc5fea9c52d98607f49b4064590f69c7fb59dd5136b44c41e43df0b7da5158364c4db71a4a794e5b14c790e875570792e5feef60acdddd45ae817d9751a4cd1ed6ab640bd2e7b7eced126d8df0ddbe35e2a92a6514dc2f44559f2ca50e7b27f0af5b6bac5b10aed70d648bcd9a77441dd2d5841ddf2a45e14227de1a3743c93461bc892907a1711dfc75f4b3ed7a081bdd67753372a211244d3e74f3148e015c3e9d7763660a9845fccb2deda66f78494dbbce972534623fb57648a5cebe1d31a6e585f01bddd2b9597e743ab382681b70701844b1657891646481ac967ef4bc5170f2d8ae4a2535465d14e095711fe54eb06e8552133e1c4c1dd8ee78ff5b6f9add9988056c12c3860a8ab0dd9fb300667b9dcaf57cb3918d5d23a0199a91e09c490b7797ae964cca45fce6b66455c7b834bbd4eacfe9f2b99f1c8b8995b4608ee699f14f7ed2ae595f99a317c9aa224578499cac5ec8a58ef73f15fc2d698ae010daa0c97edd26d60c9138fd3ad61c31c555ef38e3d21f326c78c049906cc14ddfa07ea09e330596f2cd6ceb3e359499c7f287242e0126a34be48aae1618db14bf947896195c26dd0dc81c788fc9e203633cfd76a58a80618ef5baa1bd257d1fbaf3a8d926087d181b53b906d86cb5881ea108eef6fffff99c54b20b4b43b6acb3fed8baacb19cbba8c0338b14e89029256b1a3f18f82d62f5259eaaaa42a24aa8fc4bc16ea3a776567ec31f2b97b5579e37e923b757285556ae1d1aeb21faee5a0fc6b265d2e43e1f479aa52f3d7d833dcac9eb347cd5ea369eeb87ccc31790635eac78fe96d4e3338b8a509f23283b00157e23457323ced2101932480fa6723014ac763266bd30df5b982555f564d4cd62015515c0c154d6c47b9a45611269f8dfa058874ef6d6c344ee27513342c03d304d5c7dd3e187149a2f11a85d1c3ffdc3c57eec0aee4910c9d5585c4c0b744f24b944c56db1c609b2d687a080793d6f1f981e258c87f4ed5c9021f5db084293d8d2c32f075aa4e6358afcc01cce621137b8aa5004fc75ee50323c1357212e11f7718adbc0fecb30abd4b18c71273d9098c124c76ee4f890e2dc0e12f3805e1940118023ae692dbefc4d812c5d3e9aed8e43b6f670b0a6d99151af72f6a27b06aec13c3af73758cfcbee0999db8eee861679141069c3230f27245c97a211d80ee8b0bfb71ae2e2cc120489bbfebe05d4982aea3618f92e4992edb8e55866221ffb1a1929c3f41a647f6522b74681bde034f9bfeb529b0751cd7aefe01d294725cdca70327a0895f34ede83ebb1b2395a2e7fcc2f2c3d3120b7b1f8cbcaa284799a7024378199e58836c5f2c1e73c1c4efffe3821fc33be6732a0015dbcc23e935e588bf034bee46dbda6208ec718d7e31279610624ae4d625310c93254a69664986be6ab86b8386a68fe5854fe7be0c28a8d8ad702adfc935d2", 0x1000}, {&(0x7f00000000c0)="e848a6a9e1f76af57c073ee4b94893380034b51c2293798a0b6748167f325fdd1e54d4bf67d3aa6f67a4cfb8b9c9ce339935669ef596dedc7b2e018f346f2e23a04a449a045820c3ddcb8589dc1deaf49fccac44aaa1f636e8139519f21201161565c3dbdbbe2316e6e5fcc66add8eae036c021d6bd7fec1e020351ff24945024c9cf88aa203e3cb14cd1964d4537a307ad9ca5c236c907076d3c218daf6da703fcc25ec851c53f52eb1f5149f9f9f8624cd2a91600b", 0xb6}, {&(0x7f0000000180)="27941105c1be836cbf98e504503f8e3411a82d2dcf5727016bb0e43b6dfcaf71b82395bd4f763d1875618306ef744e7bbb2e79164b9264e84a46a2a1757f199cfc9023fc14aa45062cb057bd", 0x4c}, {&(0x7f0000000200)="8c8a7af69d4c4e4f4abf3aa02ac3503374cbdd07e7d9a543bd2a7142495584ee3459caa1c64c332cc33f6850490dd4fa36c58ad3dc7bff41467b54ddb6a353edc92f38bedb4c3640967a54d1ad51ce0f1367dab24abe4d23fa8060ad5daddbddc9c3035af104d8d5ffc33ea8164a252f20537f12e0620cf8d5b3d6ef302f8772366c1cf3ff8be7fd", 0x88}, {&(0x7f00000002c0)="5f1be30a7ffe44bf8caa9ece9b4dfac855681fdd3e9fa295e26075b6c6519c15a79a297de387134a24ef2ef426e846cddb33f3a767eff26e8a633035279f4ac3e8810306693eaa2d7fdb2cd029bc73c78c8b3f959d38d1ed117dfc0b9160ad17497fc9e137228dc6a999a3083c8d30e4eea5e4ed99b7f47ffc8329331d07cb1bb03a3f14f2c473fea5f7b3281a7234f42029eac69c22baa6b86aefc517d13b5b99d859b7ced30b7ffcae5a717e952989ef0eb4c53f7dbc6c19b861cae6ff52a4fdb663137dcd93640b0523031e893d2335c917464a17514b93fbddf74d57af9c8341d638e64411da838c51e2f629d482a57cc1ba8cd4ef0c39dcaf96a62d", 0xfe}, {&(0x7f00000004c0)="850e0c03a037fb51632eae874835d002b83ca7e84a83ce9caa94926d67f93f73f65e55c55234bb87f5628ccb2c1577f066be3f64c984d9b4017ddcf793eb6338b332b58788251260d4a83282c497d465eb64ce1a36570e01d3565c4b0386d0ebf91cb00b70faeac808586c4a5e869a9d65d3be10e917a1664838292d0ab8c245f9cd933ac04b0685be42ad9fdd9fb01f017acd49036ca02b754eda2a8523182f8e26993854464f6408e02dde8c32be62894da832890185964741bf5ac9dbcc2a648dcd623c0de0692e63a6d1", 0xcc}, {&(0x7f00000003c0)="61f2e5eca0074889025853724dddc4dd4ef8194bba15f459326ca121b478c9f1e5d8c6c46d400fb3a1cfc07da6369224ccb250bbf1525ec3e8b4dbf0dc218219076fd8fcd532d9f6d69d996f45029c077d53864bba4f2536185af7b78ceec8a79c21d23b1e89558fad8ccd378c8f6abd8d3b8ced5fb84896b9170d76b1ab6ada94683aa4ebf4a51911ecbba623b8c2f6f049f6e3cd5ef6e4b8a0a1f2a946cbdb380ad65a4fae05dc4a3e", 0xaa}, {&(0x7f0000001780)="e6732e35c6e3b74623333b91953d5f1273d793f538a135832c2ed669b5f36a4ce9a187312207e30cf330ec7c574678969d4db0a36e23c3d10a4257cd6013728e8ba47b3e2c6b84cac050aa1e394f7d4d8badc9710f51268557bc0a64936180ae9c2e60e4a006d7b01305ee80b5806ee481d2e40638bfb56d75bcadc32232b9f2f0d363ca3f90949778bf0b61fb413f13cfbf813281788f38adbf777c497fc2f02fc67fd06b8356ca6997e4fbfaa0b8f98225d1d0949ad1620c9bb832f652", 0xbe}], 0x9, &(0x7f0000000640)=[@txtime={{0x18, 0x1, 0x3d, 0x8001}}], 0x18}}, {{0x0, 0x0, &(0x7f0000001bc0)=[{&(0x7f0000001900)="c461601110394ef519c24ec4817369adb4a3edfd3760a3743e4423eff67c409b43ee5988c5ae2cf0de2e502d928e4d320f5aa3853ed297609bac83698dd2acca894bd35d6494f3054881cafde83c0f7135f3fed7104627ed28bea93e8faa12e8762ee3be067396f1211a640232bfd2", 0x6f}, {&(0x7f0000001980)="1d6e38a9bf1e2f33ccf40a5f25cd5dd0142641e112ea7b6ee162b7f357637d88054df2c33fa28be6d05d41c8a740005e4d4c4e625e6e4fda1db43164cf90aaf4089a01722cd1f70ab3c521b5a450104624af36ec17e7c31d99fe5553a2bb9c08ef9ce9e5c04fdacc468e29a6dff050d5a0da2771b557235d13f399", 0x7b}, {&(0x7f0000001a00)="ee96be5f74c9e9df55e75766ce25d31706bdd92d7125af37c6fa90e304a8dc7b15fbf385dec38909e66b2011ad364e598ad6260704a739a049711d1ac69416b0e0458a6005183578aa2e538745ed8505bffe224a215fa5d37f240212171a9fe45618b590ea9f20e16400ca61", 0x6c}, {&(0x7f0000001a80)="8523e05ed96b7881cbd91d63c2507c66b80c2ef1daae50697abe801048bbd260c55dd746f8a6437f1a6ddd39a83f481e448c4343425b07c4ca309ea11df34c31b776f06098432b647526", 0x4a}, {&(0x7f0000001b00)="c6f7bc118deaffd47e7069427a430b093088aa47274841b83e7096efa3014c0b9282c816de9ceaa0ed62579cb2836e441c8fa3200827b6b90ef937e6d4318850f3bc07609eec0301bec8788c08376302744fbdbd517068a266ac889f4dcaa4042af0578c09f6913cf8b1b543cf3fb99b4500e91b8fe4ba75b85f3b1942942b988ef7b6114aba9ca5d7702a8f6ab3080115c035ceaa626b5c309ab307dab7c90cb93c3fca14fa8a", 0xa7}], 0x5}}, {{&(0x7f0000001c40)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e21, @local}}, 0x80, &(0x7f00000021c0)=[{&(0x7f0000001cc0)="c54cd420acfe2911de95390eecbf10fc0c5a3f9117aaa765b6b689db4047a90fada2d60905701f005d85cb3ea41ac7f146c67beb12a7905fa0a7d74f0c0d4cfb9b8a5903be66aa74c770df6b198d33cff7a452d9df324070a8064815628b5cde463ec9033c3bc244b67a61fe8fc5236ff6566bb85025e7f3c22c81004dd20b94e5253874f220a80d74a87c4d9bc3cda58ec9199afd08beec3952641d36c86726eb946643e067b2590a6a15937e80a90090c6b9", 0xb3}, {&(0x7f0000001d80)="d22ea5c72910997861683d0feee8bb85247e81a45b78af15e58823553e6de706e6eb94c3178dc84eec7ea6a23e652d246568c2e0261a7908ee321d97318d534687ee28fc94e3cb8058e4938d820b919e5f393c098954437ba5c5c57283237a36d44f18e23c72ae", 0x67}, {&(0x7f0000001e00)="16d3ef5542f8f032c6bbcfbe53eb75fc97f3905c0ec46e424b7ee57012233fca045de11ad069c045f08b47f731", 0x2d}, {&(0x7f0000001e40)="5c5289a388e147094d32e96037f2aa97924821b891ec", 0x16}, {&(0x7f0000001e80)="5656b18f200b6c2702112ac89913093d5dbee118fda25d18359f89fddd682b351e3446ca7d71acb1d971692b681009a6b8d4e0c2c27ce24d55c0d5ab8af2bec1b8c3cd5fb00c72301c1d10", 0x4b}, {&(0x7f0000001f00)="f31248daab832182f60c224881e51f03bdce932a80ad4bfcd0ad5a9e9209c3acda378f9d925e83476dd9161246cd86f3eaec528b8f19d08550801af1fb227e94cd0a298dafbac7d39336478888195c3c192a21ad4a269abf1280d98d6c2720831aaef469c46e8510d15d536a3934c4f070f5f053670219e9392f2c942424ec5b5c8ef75682c62ea33f09502fcf2623bff9b17f129ece66d3c8a433736a7f1520ea0bbbc4dc31d524d362317336a2b2", 0xaf}, {&(0x7f0000001fc0)="8741d62047efb7f1d1da3862395217e8d43297f83830b90ffd0b169ae79a708f089b62fbe0efe9249321b2318d3d09d30c6e415317790d370bdc2fd0d6ddd8798523ee6df69173879f2ea008ebfb9ac409cd2558bb8f52b1f91f5a4c4d4d656e73476a71a691784d77db99a7cc12c6ea4f947753b8dfe2f5e5cf91b2b2d12183b3dd39562c29d637f2b00f4e8b722d3c506fc25780f770e5e65dd262d4d8", 0x9e}, {&(0x7f0000002080)="bc0b3063c86359ef15c9efec8ae2e1533146c28802fd226fc149f24b9e04be09", 0x20}, {&(0x7f00000020c0)="530d33269cc0513f1baf85340c7d1bb5ee9790db6e91c14889541d3cb512cf8bb460c0d63add8215ae11e8f54562de1e274a6755273e0408df4e5cf4940f0857d79be946e554ed6d76020b08dbfaf00d5175068ae1261c31526b18d3b89386836e35c7ada05919db0929e5ef7479ad853baaf34705aef11bf1d22d951a049fb2612dd560c1af651117e02a0b63e65ae1178d23bca857c08c691d46f11bba5c466428b654c224e8f460578ac32c555f671303a9adec01d87610f748e41e965ff5c56590bb674efbf9c3bb77d95794a0fbd20e762cf7c85c9a414a", 0xda}], 0x9, &(0x7f0000002280)=[@timestamping={{0x14, 0x1, 0x25, 0x37}}, @txtime={{0x18, 0x1, 0x3d, 0x8}}, @txtime={{0x18, 0x1, 0x3d, 0xfffffffffffffffe}}, @txtime={{0x18}}, @timestamping={{0x14, 0x1, 0x25, 0x7}}, @timestamping={{0x14, 0x1, 0x25, 0x7}}, @timestamping={{0x14, 0x1, 0x25, 0x1}}], 0xa8}}, {{&(0x7f0000002340)=@pppoe={0x18, 0x0, {0x0, @broadcast, 'veth1_to_hsr\x00'}}, 0x80, &(0x7f0000002540)=[{&(0x7f00000023c0)="8ed833069cd8c09b97ec3b3f18aacd69b440dd565e46c964cc975e4796085ec3f7df52c73b09a28f8978de39cb40e39466258bf9fc505d597d8d68a8f83cb01f89b15ee6f7fc5b43fc09f78ba4331e054a088caefa10293b59b426ad3e18dd6f803c9a02db650212471459034f27ba6f2d063bdcdee95af63675d6349007d3f75117043d7eb24d3a06a1d0ce7ff496e1baf9de81061b24b2b395761e38b45fd8bfd08ed0e6935e8e514056fc273cce9e3265b319ca54525fe9766ed29c9b98971fd2d79b35fcfd4601968d4696155a97d04896db0e3cb325778a02b6a421ac5d433627", 0xe3}, {&(0x7f00000024c0)="2f7d3de6be2aa64c613b19c7fab994a80a83279671a14e952752b37ddec0a8897195f2f7c6f8f9d9fa4831194b6043ed4882f318e3ab25fe08a0cc89197d8e7f02d5942f5fc1a1861e27b3e46a35a88f3ae952117bdc5c3a022c86b1c48fb8", 0x5f}], 0x2, &(0x7f0000002580)=[@timestamping={{0x14}}, @txtime={{0x18}}, @timestamping={{0x14}}, @timestamping={{0x14, 0x1, 0x25, 0x9}}], 0x60}}, {{&(0x7f0000002600)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e20, @local}, 0x2, 0x1, 0x4, 0x4}}, 0x80, &(0x7f00000027c0)=[{&(0x7f0000002680)="0d10c07a765cc065c71910455aad3d475817d759601bb2120c65f754beaeaa3521ca3eccd80d79b3c8f974c05a0d0c148ceb4a442debc0ba2438e1aee459f2124aa344325d4afda936b202a798e2", 0x4e}, {&(0x7f0000002700)="24b1023e6d1b243965ddcd2af7106bdcb3b90a66459452a38d", 0x19}, {&(0x7f0000002740)="b48fe550ea68d8934d39b129be439db33e6978ecfc025db5e4234c7638569a001d1291c4063c24f0a156e373637e46430c17f5570b0a3828f5f07adf520465a14b42024789334843f81910a68ec2abb463187a116a2b341d3bcd3a25d6992314a288", 0x62}], 0x3, &(0x7f0000002800)=[@timestamping={{0x14, 0x1, 0x25, 0x9}}, @txtime={{0x18, 0x1, 0x3d, 0x400}}], 0x30}}, {{&(0x7f0000002840)=@isdn={0x22, 0x4, 0x7, 0x9, 0x7}, 0x80, &(0x7f0000003ec0)=[{&(0x7f00000028c0)="ee3fd8f6898b9ab051590fa82a013c0bcce4020652e82ecc76efb6b509fd2a95e572c3ae110ca19da9473ee3bc0a786565ba9fbb5f077ef9075e5bcf0956a9488eb54ecbd4dac36d55206d903a72fe9c18c6f60117ca08db8f68e97e344b06559c15ad7330b4f4d2e9f9f8e8a3a69920271502ba6bf8f1dcaaa5e2fbeb6e6a3f0464e07473469af105d03c4d12a4a732809e65428997f01228dfe7bf989df54d03f523126e5297461fa91f0b9c527f88729f7a4e72bbfa6883a1f80db02ce4863926a2578963951e8828c172307fa97e11e00b5f236bb6378aafecb3b8c05c6fef4b18e67f2395aa947fd84d8c5ce050aaa525f2eeeb035d922946df50b83ad449033ba9b93af389a91eefe7f7320c0aefd2a90e9f18c6840363d4eb04640468917da992be58a5a400488a52859ffa2cf48ad3a7c91486179695e8c549cfcf59b43a1749a60f2978c015734253824d09cdbd03d1c4f5a2a49ec47f2ee9b1d8be13251b8ed28ac36a2a9c79a9f9aaa7c7ba632fbeb88b61311a4110cf4203c14c33347bf90f2aa79b12cc7021c7c37ce3f3cd5e5535ce54a60591bb86913f8f67eca5d746f16ef1e22572832bf2f6e8f3f639a725b90635ef6d39cdd00edbc09aacab04571c9cb20ad46055b218177179d8ddb45593ec172504d912294ac3cde2303a9f4efdd6aa20b077abee106ea47fbc65846f807f40a83c598515717dfe37341d09a43832f71a53e934511878ae2b4f28553f0f5b86358cf0a8232f3a2b261a95616cb9537cdfff15cd002022a0d2a2b65443b6d3fb2db655db0d378d1785078636d162a4b3977acac0a2f77e4b497ae165d2395b231809e56c1e3135be3b49a6b38d5c5fa6f3fdad6daa2f25bca5a3162c6d760057395ae15282a624408d397e1240ca5a280b785825ccdaba692707d2f0da008e23aef96e9b7978700c0a994199332ff83ba9c77321f6f990dba82ee2a6ee11fa4a804b0ef1b777f84b8508a4add8daadd91fe865227076a7fce7b0af6670500d795cb0b75b4020825776ddb952289c2edd1cf5402724cef2f54d81957d29e6ede9d2009736448c06bba875df78f2c118c660515b652268f00570d6ae6c7b5f339b7bbc4cf7e57dfcffe751f180dfa3a57a0e5e4d62d9a3d8b83c0625f585d8708b078eebc886c07c918f1dbb9cd4664c7d90ad8ea2676918ddc22b2d7825bd660246c0c1aa115b3152954cb68a1f0d2de5cc37f8cc63513e3fae0ef3b453a522e3a956d299720e338e4e234ca9ebc61ba45781e533d721a15134180c25db545171bea1611e6f9ba9141d611e1c96ea2a06e3c46db1eefbc57adac79c125d29d19cd96d47a10aa8d24eefce49707979d465741dc4b8eb621ebf06e8376266633cdff461f935647338f32f1b2ba8759af7a98c2821d922049c664a433b0e87f6f0d4e3aeb1c6b9635e59e2f259dc6f97d7d00e4483c2283a75f9b2e21c0531f9f70734991e2c73fd288bb21bdb068918123d70db11ff0ffdee75d7c5064714cbbbca7ee87077ad9d70bbe877a673f25b82903b7e3ad9d8f465fc4ef5a12a1d54a7f4bae933a414e5684f12e034d1b157b580562ff512c28a095ca1bda2f59a7a936271bde01cfc9d7c645a436f5f6ea72202e2be24d2b994ae063004788f60bec1495bac5df26b64392758ba4ede888008e8ec88610416ede7f28fffc6f155f20d430fc9308be224ba01c4807b2a6fbccfc59a87daf1d1306477f206fbb7e67ad00ec0556f465f0fa2acf885fa782dc08c47574c86c50f1fdd5ffa020b06a904bea6a3fac49a529310a6ff8cdc6f3e80319a9c56d0a7c0493f0688c49947ed6ae1571b1d363b392186fa02578ff5e0dfd317f09abb8ea31af90f3c62824b5696926fee2837521f9254645390172ee442a8d8c0be0f9545a092be3d7ef5cf59e0445490d3b57f65deb00e712e6d94ec351a0745154e550c05ead825c14cb031e4f2303da326db8fbf89f1ae933e819940f5a2c0bf20b9bfd455b86b7f39f438de322990cd87ab9336263e23eca14cf5ac3c51f6ea4fc45c8342fb528532739bee834ea9ae33725f48407c3f4589e5fe82d7da7b089694dc2164680fb734ced0929f791c6c214cff05beb39b3eafe67e021f278fa58947680160d6c405abd6cd7f324ae8b96bf561b933fbc1181ea2f0d40aa26b10abb396170eea6e9c9f3998101c0b07e3f8db4f92982ed5d23512c0c1cf5674dfd6219d58e18de23abaf5591cbec778e9cf2002db0d292b680af8e54e401e980f015a57bcf89fa88f9f9f24d5168c867185c8f9a3fa75b1965a646630b153991496debadad863f08e339f8de43d4ea06441c15334919df400c7d5c84322630c4fa236d87e3560b6b5db524c540b738a3136cd5630903e3011f22c50ba6f6ea8cba75f9ff8327433c517bea09ca1f63b298e64aac5d254db8657e4ca506fda7e9ec0f5fc68a5e13ae23b246092e549975b2592315985beac7f17a375f2948137403edbe1ae0befb713cd0fa53f4b7ad4ec98f4aca128b99112e43357d5681fd34abd82e349acc2fa880a7495fe181a6b9c9b8ed75118d26be9c60ff567d6b693e2d4c90bb40a8a34d0891b8c91cf90abe42635313f04da13ddb2e8b5e5641614feafdf3fdf3b082c376fb4fca4f4e3185caa53ed6763f82b84fede1f566fb3e25619461238aa82394ade48ce4888cc70d04fd00041d4daba7f84137e60fb2de85cf3e5dc4d43cdff764c1e6c5ab2108b44a2c2c92de288f1cee3bf94f52ccb3299c67b6ee9eecdbd25e04b0c940fff425d4b0c3e5007a3a2a05903f4bba4e60c8a7e9a69959df816283688c8bd81ad7da5794fb4865954757863d4645534a609b714e5678712f03de5744f82a81b254fbeecd11107ec2edb5960c3bce291416424b1f478ee9d7a3ec3868022db2411cd06bd1cca23c6ec08846d08f76dd99323013078af3cb92889a0b896a194e1f223b42fd4cec967a5c9e4b7081eabb85f35352b8e369116c9e0beb47f67e8304ccf7ff4119973dafc214ad96089074660f3c40f416bfb52d195cbbd97ef3b617796da3269d8ab6680546e5d9f0a9e9efcac46f2ec29e1ceb7147475dd303c277316b87cf5c0ea766e360a6f316dac794a208d9ef97ec1cc8a18906d0895ab82b33db862c01f685e9f64188a477cbde8a813d83c05e717b4f732d640e6e8320a454b4e4cd2cefb3292f9ddfeffcbea218efc1fdb52cdeae6100950cbb0296fc9bed83f856b15f7c642023012c40af117c3f1f61e8cca447b20f4f21801605dd9cc6bf2885bb94b43790195a751d091b5a2af8dfcba85700401ce43a8ce9addb670ee489461d235fb66a7a0432d8936161833618f1083d9b81fb996f35d476a268d4ccd2ad7305e4ba7dbc4f20b55cf0703978d02d75a4636d4842bbf6f5ea122b1fc8f53e79284cebdbb5cdab3ffc5f2f4596ba33d1de3369b51de8aea30da2e4ae0d27c232c2dbbe295c75d2ac394533b72c698bcd5fbf2a2a5a5bf6bd6629092a7cbe18b61e1baf80f176f8c5e045e640957fe74f8c9ea98ea43605890048a587963a93c46bcf16f76b6eabe47e35ff3a13e33281f12c9320945fc6b5a7efbacd29ee1a47fb073d8deed105fa6563bfc589fbbf35404c58367e37c1e5919f159213c025ddcd1e81ec14df60dbc0444e556ea8df2f0574359a1371e700e523e324829ddb040dfc47a7a32180d24cf83c028032dfbe9e426384c1bf0c5d6a45b65d71f33a11870089479195ab03fd9ac8ab1fec2a2c6cdd9896b624414e77ae0d40a55aacdfa21323e58f233b6dc373445b32d0802234cac575d73f37b48e0b715a9894072078588ff7f08e6a995e839647f0c61b3b543f79ba04a46c412f3e022bb66d7322fb0f813ed7f0548721cc28356b60c4c87b3b34fc3cdae5ec8c07bf53f3cc0d61f5f493f0647e26bf72e00369f6b4fd21d157406e4eb931afb6e5776ac1e34f4129580ff3d78766918d3c91c39709860664b3b8b684bf6a50a280979b4ba5fda5cb2a42a9cf12bf8dc41c205325d42ea7591c91af50134df3fc7498f34a2bc5bed23e93c37a037e95a2fe03b52247baa9b27efcecb45e2417dee8e5bffae6e43f3af2628695edffab7ee684d5bf6abfee59490fc87911aba0d18a5177d39597ced0946da1f13b315a59c1d9061060f2f3dff22008101c1ce9393a8228e488eda371eb253f8a1a07cb25ff9eb77399ac44bc0a5419673652e13bc758631a9e3911100ead26092569c941af778b0be3d327865847d3eacee64ea94cebf12a99e9ed155716eac9d80ad24bab5d560e379deb956fa9a1d913112452679e1091c8e7cffd9f709cd411657ae4eaac93c44db09f0043826a5fce34dcba86570e71afcf94121434ba2d8d755aa688d13d0b32f57a4474a8e6dfd4abbfc679a3b68db9988a666003fd0dfbf7bc29ebaebcd67cbdb6db656f381330b926856dcb3da34c8fa5b0effcdbcdba48997b9ebe6fbbba2c247b9338e0ce57d3814a84789895e5488d0cdb2524a7e9ed6be51fefc010a2b4ad43163e8123e83c267e4cf65ba3fb74f0e02799d32990fe59e1753d126bc4478be5d57fe6fe96777200dc4d10aaadab23454551e5af023a507bf462784f44ca95feb8a5634a4a63d1775ee02cd5a8b3853aaa4dd6f7262cb9c1eda82ec1aacc1ea7dadcfe19f19c98edcd05f5ea155816442557aa3033ac7fb7f8af8ed6acf43bff77498531406294a8f71663014760bb9e81826a6aa4556698e2bbc26f36784adf571061851369f15265dcd4f908a4fb6ee8651d64f6842eafd9e3aa6b8adb79e1a6de42b64f9bbea1a15660a015bdd71eeb5936bf89d23653172162372942f4697996819b281afb2a0329fa15a96fe75ebe3cf8037dd5a7ad6ad7ae6cc48c91999e7a7537f5ddd9d08e0329fbd66186ebd6e9a884a28def24820218936e95277fed144e215db8cd42c73537f94ff3728e586c05c4ee31e65885a1fc8b6a9bf46c551dcaf74aa30bdacd6c460de703ab3a5c6aa69e8ba4cd934065008dd89c83776aa25df3141f65e444168ca7af5e4e09dd1a670821bcb2887c74798f865a1410984ebee09324e837105bca2d0fce143aacad42aa9b09a43420821246e46ee703e6556d2950f2feb374d3e66c49238da1e631da499fe5a5acbfbbeb0c86e43a5b189a3e30862ad6863dfa7563434ad9095243a2541bba80994e352abe50b4ce2a9155a8f4e4568cbcba15930206bd6508ae23c40f1072b1740b40253d0b13b45c07a51cdcbf2dac1141115568054ee3019d8b88713fb207c58f4ae9a6a99d4cec4b1f0ce94dc9034cefbfa555230456076cc8d1f879f7346bf126e0e215647f05b7392a6d987f7c6ad12e47e1c3f798cf9189c5b4e4b6882bba9d8cf8c29446c168ed8e8ecaa2131a899c08fbf2d98cbb013ddbfee16df0db11567250ef3b342389b408fd7f93bd9ed58d2f272ab9af59628dfdb12ae390dca988ab0ef7a5bcccd00ff79d1e6c70f3144d57cafa69999151cd5c93561ab4dc5ba395912867db687ed44bcbd628d372b2a5a600649d286fa2c2da71ecf5d2df25ccc122578f4a4042d774e2b6b06377bfb146622f0c434facfbc05d4a5aff6f787c84d98a418cbc190fa8d77901d51750d0392dd1f6829cb1150a0350ddcd75f4eb8cd0437f3099dfe031d81cfe63a92befeaff6470ac284571ce86bb741c1a6e41f6cea8277dcfadee53fa1365114785fb3c8a420cb33d42bf4ca833301ce7327f9b0c6e6581274a16b1bb82be97162ee489635a59702dab11623", 0x1000}, {&(0x7f00000038c0)="6a52ca23f67912a4969cf5f5f39b7beb0b800494fb25461b98c8f9f88f73f65ec4340d20899b31f2604773d75486436ce6e48ff96820292d01937769e7331ec0fc16824db20678dd10443afb060a2cbfef8f2e84b44ef6671a872e5ec7d7898b14fe73c253c6a78bdc0ae61b36d96c53cf33aefe9d0e06bc9e6ed95821ffc6ae493f9c1f82ac1061039a51a251150490e74335ed8ddfd07f372fdf35", 0x9c}, {&(0x7f0000003980)="ebe94d34bdcc0120c51ab36ff55902e37640b607a4ed02b1c7892dd82345d829d87b1ee46ae4bb422ab3d8dfe76b2ed4830d6300153fd8c1d201bf361ed647cc4e91c87ab2847ae0658bad25f8bfbc5df516df897e7905b51772ea2c287f17d8a841651088b22f09735cb3ca80aaffa0fe6a664c207527be731a6229157d920ec1aa1eef13b6526c37760c5b9fd2176abc0cd6188b3dc814beeb78e3ce259feec5288fbd5e85916595438f6b5f569155506996d6110ddf9e438e2321faea1dea397105f75493a70239a0b5c8bd36c0136278", 0xd2}, {&(0x7f0000003a80)="35fe609d2104e9c12de5137a1e67bd5fee176ad3899f6d532a08c7d6e08d1519ce2946a9761f701ad7b2c05256a17d8e00145c860725749bf2f719091613a795c416d3a7bf47e01614286011699c831aca65f656ccb6a5264fb0df615476324a8cd5807625", 0x65}, {&(0x7f0000003b00)="bc10decb7a942b4daee4f18c9492b9c49567641ec49fcb0d8fa3e309319dfec62ecd99355564985782b0f9beb471ee49a94efd133a0064c07efa39ccf8b3cfb3ec624162a54f85b90af79f9b6ef84769b6b3e4223a09d1b7b8d61e9f0ba20125230619383034d0c951232027338de4ff865189602816d853942a296770f5a68f70202dbfa233b9cd8a1f8434df831915956509f5ba769af379d9c29b019aad58302c1fd796858e5a0166f0c1e595dc3d477151f95fad60257f17456b660108558648c9c3ec62dac81f470756eeb11a77250372b0e1852631ddf77b760e35833b727c822e07", 0xe5}, {&(0x7f0000003c00)="5b6ca1b0b2a66217f0817c2f44189b2029d12195c5a50fc726155f29a0f195b5f69c3783117625e6fac0a1c50fb082b82d7e6328bc73c74e5068524e6bf85c970eb068fdbda09357c91243daeb5c098559347782ec8d953422d22778311e6a487cc025eda5d89b3ae2c0e54ec5a565c592cbcaa05aa5171eb0830176ebb4bb5532983caa4d319bc1e280fb2f18bab249cf063a93115fb563165ff9cbc5399e8b829e9e851a3a75508e101f9826ee532ff549939e97089896a8a427b314aa8a5145e51139a85d397f709be92baeae10cb221625dc39c86302dd36367a891c0ce6b7e4ad89fbd2615ee6db993259c273e7a8bd8a95790fac04950f", 0xfa}, {&(0x7f0000003d00)="d8d9b9d8df301c2cd7f2bafb85defb9bd8ef0bf9bc0ac3b49b6890fc03fb9a970177893893a4ab3433f839d0edeb3fb7b60a64de3d46aea28191fd99bb12f7668c3f83cc8a056a4e300fba456a716961138e21aee15728449db7a7802923ac766f77d3eb508b443891b3e4e502347bee6468f61efc374a703abd574bc08c60e3f0f313aa83585f321469ad8615a1c615b6c14bf915a26e484cf7c98e7cb65093b11134fac8c5ef0400a95fb2137234cb2af91c85bc6b", 0xb6}, {&(0x7f0000003dc0)="ed61b3cf72c4e8aba85e2794e50197df724e4a8cc761bde661422864851ddca9835c8589d4195f7e7862ef423d58691dc7ea5366975f906270a110e04c1d7ea161d17f149b3b661390fe072cf26a199325426a9e05f85a50cb52939b7a32b6da3023e71b5d74802a32f172e97def5890d9af014efd5b48f827f6a17dff0bac3d887f8299b1d7a2927e29abe5933560bdf8b6000c6bf47d8cbe1c7a480114a0d16b8236c79979f3380de98d4f9209cea7b4a828fc5967c41190a0a40de550e94858d9fa442bd46c841a5f93567f48c09520b718ec859b1166a921920eac15d3fa62ba15d9630dbe724ecf", 0xea}], 0x8, &(0x7f0000003f40)=[@mark={{0x14, 0x1, 0x24, 0x2}}, @mark={{0x14, 0x1, 0x24, 0xfffffffffffffffd}}, @mark={{0x14, 0x1, 0x24, 0x100000000}}, @mark={{0x14, 0x1, 0x24, 0x426}}], 0x60}}, {{&(0x7f0000003fc0)=@nfc={0x27, 0x0, 0x1}, 0x80, &(0x7f00000063c0)=[{&(0x7f0000004040)="a6aefe23d14c03b216793c94da650ed34e776a65dd81b8edd412c847682ad64fb81f81dd494d315c982eedf33faf666658f3f1f0e19eacc12aba4285479aca8a", 0x40}, {&(0x7f0000004080)="cde6925119a2e4a11138a4d5228ff059a0bfd0470c2391f5540897c6b6b7bc92b7e638c8877854dede", 0x29}, {&(0x7f00000040c0)="fadd0e9c6e5b1c", 0x7}, {&(0x7f0000004100)="167a27e7367b0d440cc28dc53ef021cd564696fbaa652dec938c670714c23552e34307a6971346a53738b1ac2497f0683b9ac83449b81a84e28229c7e684e28b77e8f89cda0422c95192ba722ae4eb2850e976ab9879fa45e2b5a7258642c5204d93fcb1538b57fcc78324eafe7fcc11247022bcf4b68342307e1ace66557b09bb2d917114f5194a2c2b7090aef902285e601cbe835167540f5b", 0x9a}, {&(0x7f00000041c0)="121869d7c435a97dd3571f4640f9e294d24c9ee546c2102e19db4f617e33f1bc81fd86924b72afab469f514655a5c05463946dd31869192d9c6169e500745aaef40eff0427c975bdc2b1cb124ddf2a93eaa68b9bf3e59746f02fd47ea6e61e7d9859e9e9f6efbf276c859b3fdf1b83f657321e", 0x73}, {&(0x7f0000004240)="53d9a094a06a4e2d2bcb364a7298a9d93275dd1b071cb673826589435f84d4b5f123866bd67fe63affa97fdfe88f323b46335465570c6204c278bd26740aa094de2f0f64dfc20893c6de1f6178e66c63bfacac19ccb165eb6fbe0036fd2d36204c435d5affb16fab21436544dea1c51530a244a0cb9b0a785efa3bc2ff231bc0e7", 0x81}, {&(0x7f0000004300)="af6be4435c154a0a68d27ff22a6a982562b7ca715d9c80d18bb8a7bf98bcdce233c3071ccc38367fe9d551af345adf9674842eb10d7e61d433f907281d59bbb5737616773ede8ccee1df0d435b4e6d42106708d2c05d600a883c98022e8490102836782b61e380beb853e35c0f6e95a94f555cef3350da3087d6dc359e268ec5798d2fc1ba2fb882ec61b05c1c1e631345ca3735bf7de5d82f13aae27e07986c0b61bd7544ca71acd455d9dd4db7da3d276937cd73c831f834c66e0d8a4d2e3174f37bbd208e83583cee3187cb593d5470a14fced1b600ecb8be7d680e24d999ac58186c0032f352194034ddb75f8a029137621bd0b934ce80786af95ee9bcc8824dc4d15ee3ddc639e81cb79beb1325074225566e4000735b52482a8ba365de08175feff8a062a01e1eb459122413d9aab6e8f21b4b0547a45af80da3eadd22c7f39efc1763f96a8f608b793c137306e29ee7a62637e1b52c42fbccc7adb5c1526beb4145d276c9e24c71417f02dcb05769305abf332f1ea4ff15f48a2949e50bcd894eacb54d61c2d3498ce0e5c5df0bce33ef151ec4265504cbca89b880cdf9463e91e3b48ce4dc56dd20a040b8647f5841e7082e70fc48c83a71233ee7afbcce4f554b0b211ae12ab62d35f7d3ca71530efeb378c0a184517085616bedddbebfcf7b99080172856297b0deeb40e1b562cc9bd28a7552d7eef626003ecb6082787262c54f991c5db2b4b02cb24f13d5e452874a1c0952d1da7dfae7ab50f3e80fd5ec358da2795ac7b508d637bc318f6d03cfaef8d65fce553f019d6f7e138a19610936808fe3e8696f28afe88aa9bdd16bfdf75325f88eab21736b99c82271c6e243bb70424987ab3526375fd218791ddd49dec6a301828a0c0afd5be50f735f85fc93f5b219f3f5af494e6ac0be6a397f96cc0e8a815bcafc67e69c9b3856224671cea2eca60563482618f6fb90350118feef44be142074580ca53051e19af883a2ca89ed294f2c244ae0b9e7360519be83a5263ba9f1bd605554c3bc4c58a015c92e6cfbac0234ae8da3c57f33a7f6f48ff87ee031862f4415b876584b4272d81065433649a7b0cb44dddb7bf3cab946e52bf648cde3ccc03efe5ae4c30651a17215cd754640026148542400c19437dda7a235795a37d82fc42cb0d0698aa7da0301a14aefa00332f66127720f4bed3532c36a4e0f5c5262cd116cb10df682a3cae0d41a5fe0aa62bd5e7ebfd065971d5084bce49d9bd0d6c0ca9c3ddb2fd90cd5e94067c21f36e31f2e11358fc55c51a048983c5774eb0352342c8c87b1093697fac67919e2e743397a59a27dd73dc86ca9af5718e8012f0fd4ceb84efc20435ed1650ea16192b6d80e81e1a94aca5242d5faa791296520af732a9ef2048e686a39f388fe7d3a4a413a19a3c71b8b902ae7f29250b1cdff38462393787ae688d8438463bd876350e45670dad8a4835ae13fd6407f11e222ee83c48a38c1190f91f04d1129f899f9f536d1255516154f55ebd66ff998b187c3b44202bf8064b277afa4a7febcce880eb06c9186cc5743ac8e76f421dd972933342c88f588bd4ffa815c86acc210038f80607f86f24909ede7ea26eb395da44a68af71a7e03b8352de26363e6551d8adf887cecc4832a8bacdbfa035175e38808fad25bfa827668721d77c25c0e314b33bbed64a581d062dea20be07c4045aafd2437c1444ba8184ddebf9dec41e28666fa7e6326bd96921247566902b6d9db434f4905508d0c7e63788149b87d8af6f1934e8092b83253579c374e3c879a230ddd652faea62fc5eccd39898b4faf4182e41b3c87a92e4771c02998432e070f515a75275d02826246a2c0090ac362c02a76afb8f527f9db4b82cf703e759ee4eb9f21e7df52bde7dc2e683722e463e2b893376aab575f3abf590d52d2e00e4408408b8d4f9a468a9f0c5c09cd2a8dc070eb02052afcea37bf1ca2a6978824f02ea642386d794bc1fbb5d3067ee9ba6f96f697006dfbee2268857816d169516055dc9f059742236a95c17af41394a5599a802bc70acdd5929f170e7d87723b1251feccccdccfbe8e701047f9fb127c1b82d9113e1ac610b0641c28995af9adef203ac82160b78ae53628c3786c70e8dcbc6698356b159710f7f74df88878b2be39ca5bb9a12621a1ffbf2dd57ca0cb21c8980542a38b2cea50e24ec819ae409c9e7e78fafe9bdf1b6dc2aa3fa17e8b87f77f6509d40236bfb1e12bd29f5cde5a02d465dff1ebaead6a8402a743e319a29675dba39088556c570543735402e7e854e1cacf0903d4d362f594e5d917ee43bb15fe15d585386a77f3044d27ef4975fcb99e9e16cbe6093c803f32302727885d40fb93a9b27eaa7f62b56c819755f5a3b7228f06a913592cb2f563d3c9ea3c672ef4fbcb0b8cec42050388cd9637d8ac630f7452efcd8db85771daae97bb231869f73be16d6e9d0d128f0b9fd56722a689f39f31c30b4e92d7700efe68747d779d179ca48b4337b1203c14fe5ff8f1c78eb282c7d17e192e7fb99a06b9b3e66a272ef14b8198f053fbaf9a25b25bb855f059598e4ba37ac910702b0a0c24b7871ce1afb8853df152b43bace67b49dec73084b596d0709a38432ae4501a53cfed4154f898243ef639a1d24f2eee06278ffba57a49c04e4239909edec2f3546adc601e4268275b56a38c9dd803d0274fae203d4b1857e77f1d480c1f108abf73fcac6293b61097319c0bf06da7cf1c03278f28cae667aa5ac8d799d850f57a0e88db11cdd655d3d2b23a05d853e20df28cf2ac349601861bf89e1ed0b35b56a8c3be682a713d177c9a5afe1962d397d9c95aa254b53d2f6a42d028fde55a34fe294d8a618b1ff573c41aee41784fd8da5a0692aeeed7e5e8f93c144fb993a99371e355cd50ad740d303cfd411c41dc15e536f3fbc0fa1009109bf59abca1ddee91772e741faf0c0786e1b9cb24b7eb54e25f3e4257337a641a263ca82ddf4806355f75efcb3de16881764bb35d02c88d8a490b062eb9d63ea557774efffa1fdebf854e48f576ba9f247858a87d039fe2d9556b1cde3732b9295dbc3f469f681ecf033a014d5f07a960491a9b7beee4c248627c647f54ce01b59eb33450c161a288f332c9434bd3f1501c5afdeb38edcef0439a1ac1bb3946d8471fdef04235c9087b0871c9ce7c0e1efceb36bffcd14362524c8ef6574653fcd98d2e408a5bf51ac4ee5c0733d79ecd084cba854b4fd8b54bcc811aae692226c98ec20b528c3ff95f025dba6bc437ee0cc4e1d5e16c55f67167b8ad2e3b2c64b2079be8d764e48fdc72e5592f971d2b9fa7856013c48468950660372afd9eef06f0a833a93552e209fbe2cdaa6b3b84564b2af816d11f94f7e24dc149471fe84b10426d10f932b4a93a4697b7aa2a2a54f19d014ba265cf18dedc9498e173bfa4a362a4a1bb270fbaf513a20c38956d64faa2ba906e2f5f43c8c0e1bde93fec9b2d7aa5cfaed203ad5b0488be4af7a387ede21256e8e1ae2e6d7c89818e1d91eeeb1de13fa3ba3f0e8602421d11dcc3662f13af1791d3f945b620d9a14d89461b1bfbc17f70cdefd4f5f2af9d98d25ffd4734fd5c9d8374438fd4c3a18e907666e09da00f49c8b3d709a2e6fe712b5c2ca1d2a419550922a593986f4087bcc60cdd783d3c9a20045eabe8f5b4aad58762cb6a6f70b13e4f222128127899e9ed449d8cdfa511fdc1e2f691803c9ec1a9cd5868f80c739f6984b8dabab3836467a895f4bea1aa4302fab542eb3546774cd59c2c844936de69a8a4fb40a7c0bac62fefae3eef2a33ecfd9cfe7b90a07865696fd81a9ff6ad863e0d5c471c6042bbaa0d2881f296938ec52383fec3267aa6284e8a7d7e4d391b1eb389be6eecf05f1ad6eddc3235a876ec6762f33420b295ea97681181228d0faa2b643984c63b2a8f9575a3073650d72357037fd14aadc260a687dab631c9206c3975576d9f4e71132198066eff1676a71cd32097a2eebcc154cbd68dde3a1c4de1cb5e203549727c0b9214d9e25d843b275d56eb4e96a9b1339d751e7ffc8250eda2303c1897af04910bf4cb65dbf32d7e385bea1756e22a0f22c82f7dd7398e74113fe95eb58b388f63cb744c7cee6be263467eeb71613c9a7be61af7a0c46aa352612661bb39546174f3f92db6badc8dfe2ad7b4fc5a6da55fc2036382c8f36dc419793f9f8f6601a3714ff2e8b77220caf6b257f498f6c4f53f53123b9b7102f4cd45e30ec5b67abb9b66a101e245554b416889174540b7d8397ea7f4c155b90c0bd4b7d057494d4c09dca8224804bddd60621a33a025224006113685949ff438c169113738ffdb5c47898845768b60c223a25542d66ef543feef409d44e4239654aeb534cd97ef460b8a481d48924033e8700d08af919fbaa9a6addba34a5c010e946494b1c5ad050cf5dc6fc178438d3fc91e7884e6498e58824eea1f830241e9ea8a8dcdc2c7af3211e821ae43215b1fa114bae22d0b338d108d7f2271f441a3ce3bb17e4ea4c7a8704b0bff704399170bfbe91df4bec0e5a5376cd8ec049076b4b1a230e7fa84f4e3f13575cf84ee00b83ad95cd7df09aff4ef5c6d605cdb7e8a16bfad3efb73a6e9a6152640b3fe2a13cd2fd451e2fef4c2450aaa874095e312235f3734fee6b753b284f25e44349cac5d2d49c71167ec008a2e60455104e9d0b4d5ddad5db442acb4b55ac823f30bf7d3c75f877a48ca94c293542a152f2110a2b46dad4cc1862497c779bc4716da85614b2f650000d73e0757b773f689b8aebb3788450742c1eff784fefa4ddbd2494236f5684d87bb4ebf0ccbfaedaaeadf179f8bb67e4fed57a8b5912c5622d99cc9475f229e9e3d105bf47f901e8f8b44fa8726edbf200d6f7e01aa59df5b2cf264d562b1ec29e6286ccd5cdd2283d53fa39afdaf00a39c5b712a9a5724608a8e1ba3dc301ab2a472bb2ab3e9e0b4d76f6db611ec4b9a7dfc61cdb85fc3935a69fb87fc37bad19e9e8a6a8fd9a325148bcef68445c6e6f822890fe738856b6da80e7dccec94b0ea2ae68b7850226dadcc3bec835b6a82a7def931a0810057c741c55ddca2a29d0754e840366dbcf148eef6a98dca3305bf6b96b4d8a9655687ba27f805157576302e29591d22b842fb8265b8847cb119ed7f604f5c754166fbd2e25b6cba851d53f8659c24f3230f34f3808b26d0b48511338425983cbd114d4011edfe710a7d3f3de4ed99c4c2bad18ec196df4e68aa18852da496cfc3f70f885d9a18c69868d6bb3b114c065addff918726ab1fc6f91fb2882e45905a525cf3a83881373d5935db4590bdac990e4b151bd97693ef4cd49c94596de544f065ec1a5fe31d1fc8bb0b6b944fbca17761861b79d6910f6351e99a89eac372ba311074dcfb3316bc8c2f8f61ebfbd8fc202f5a3f65b76199a4eb506c5afd3e2315d8a598c452551a77873b6691fd6c8ed1ddf1629cd8164976ad6a1e80ea6bd705061edafb60c927d80476413c294f5868bb096f2cf40c3cd9e2a31ba7615744ff58afaf8f95d49d2a67add084bd8a3b37b0a8cff8ba6ec7ca08bdb05458f62ef718bad00291298f29d3d6d85fad5bde21eff47f8b3b328091c6f55e99e0db9d4032d9f0fbef4f3fe82fdce5189d597ca5babfd5df20096a48de303a0b99d23d2731d88c8ee8977237decf5429334b4521648323ff0f871aa0ee90d6bd03df729b045c7afc05322c5d209113f98c74c0455063413da24d2d38291d05ee1f07ce79c66b8e2bb2cae58bbeb6e7670d5747f", 0x1000}, {&(0x7f0000005300)="28bfbe6a3180d5a29b9105c538a4bd3267f807a160c500614463bb20582839eb7850ffcc306e954e3b66590c6f8dd65edaa47b9b4d80117e9e8241f8062d40c9320c247b14a51046d79c184ad007738c64bc1b4f657c06e1b7bd9df05113b3532fafa288c7c13a95e519505417d0d0e85629b47762ca258e42e014a3f0dfdb238aa35a6d8fac088af81b503e38859d8099500b172aebb2012815223d71fa5fb5e6dbcf92cbf487f395a59f4454f88061c90644d5d52b", 0xb6}, {&(0x7f00000053c0)="d2ea90720a7ccff5d437da8b5cc045780d644888543527194f97cc65895dc3a9b8fcea1016cab3bb964bf5aa18ac537d3bd73745892fa8c07d60b13d8634a691c48fcf76ff0fd069de2abdaa813ecfc87c16fa44b922d3ca9b9552c8e5d9e07d6521ea778961549ba6ecd4eb2a0b974099b3c17f1acd371d494d8a7de727d949057dcf25d14573c8ea9ab0bae729b02bd5aee4090d7b0f7d6377ed3d0d9b2f05952cdb4dc5aa6ae8dad5b59d1b82cc918a9fce4ddc6c3f98550049013a77a3b4bce23e72f7e7fab5d88e4ce1386b0d9de89e85f452cd8ada9736d8eed6101c4d8c11d6cae91b904fd914d9b5541d6d783e897133fcf558af4325a13946d2903e6e4953bf5f8480ec6ff2c1766107ebebe235d901fdb87cf9076c2978c8ca453f4ecb4767879c2ddbcd78a1e9d5df4761b771d0ee3eb5da71b08a4977a8e6fddc52d2a192f1878c9bc013053e2089d45f2fe862439388d8bff3564e3b96768162fc3069118cec61c3c30d4060b1f245b0ba5d4a9abd511115efc9b2a6f43b4a3007e6b717864ee111411b200d0eb786bb3a82656c8b89282ff498f36ca5569f21004a2d8254c3a4ce3bcda96e12b037c00b5b647f0af71262ef7c357b9e7cc72f4cabf8f786c7e590982231b79689b30a0dc852cc4856c19f3073dbccf3b70a90dee0a4b2341bff96fe124b7eff1de8b965d7e1dd3d767f4c6b287955bc36d42a152edb85e64f250751cced6273dbb8aa8fc260239048daa9a1e6558b9bf049cc008525b9dc2142205475fbd58153c2608f8d04cd0507357ee6e4a28c9bd6075c84f5e3ca4ef39cb54143553eff9b7ca37c97279a13525092df96e93124c7dda749bf5a6cbf637eacf6cee2aafbdbef8fc745b8bd46b306b15b8f73c9be759cfdaca56e6165710da860e474ca5247b985073f2b41462e0f5e72f258a641b5494b4b09f8647b5cf20759b24374aa741e1b37fb8ee7a5278e3f638e958e48f32d9de2f5d2eee15e93b94ec367608736bc61e30e2b12c4bee42edd229f18df70d3b888ddee2311bc1fab39e12dc3f5a3e2e03fc2e9b22e4398620eec50581a2f227de54125a688a75e5a2121c594d888c85fc9e37cb7f126e87a089bcd28da1790748cce35570a8bfdb338edc88df7a98d326a857a778767fbda572c63d2e69ea04f726658eee895570f92bf9af7aa084e46e5f628dfc0a6a3e0dae27c9c108fdaeaeccf57861e933fbf85a00d4a3810b2bfdd23c158253b5d85191f46aa74401b3e5a0fac405a748ed32afc7848a805d7546f7c93ac163fe3bd32aa5c1cb150240c58a9d21dc8d3c9d0727830793016147833ad4c8ced531be55da7edd9eb2cd71b4ba00d1bd306eb514da3ef47818ea4e8fa2d90903ff374828201695b9cd266c4479a26b161a5cf264afd30aed0652c0d3bed497aac3aeb14442c4dd31995c4e32a6d453e75d212d42fb75a630952f02ed84ac02f9e9b094ed6579d6411a0b8140ac2db027ed6b6809c395263b18d219e3dde9a7eadcb2a2e2614b9bc44023a6b120e38ae9386fefaeca2ab63f0ce5706275344956468e2c3380c15562e7e336474c17b0f2fe5aef5acc845ef77c83969ad4cf2e8cef93de1a6da2ca93a82dcb24502dd9e79685cb1fb15f5c8fe37a1abcc5fdcb14890f375b7cd89141fb0615b495247e2a0b3f4240088e85bb82df3a0a47f43e5701866a9665ba955410dbe5e388d1a0bf06b0012b33f52e8b5dbbb9f61045e54ced9b846e0c16cadbc1e8c518d688ef5014d9bd467f7ccbca355586d0473dc6cdf70044218a3a3716319b077173352c5d69f4145c687a1f84738b0fcdfb954ea6504127563c546a35637efd223ab38a18e315558113db7249acd019b2336d49fc1630593a33b5232d38546aa7b2b01ac3acd77640f54d7af6027e27a2efcc066f22ce90de63dfbc592134c3c474cf9cd3dc3c204e5fea1eedff6ddfc47f0786d351760b69079f02007083dc537e2a4fc73ccac75ce6f682452c8b44638bf7a64067542b3de5fe8db669e861312254dc547a09f863551c4331d6ef64652713107894393cf077c24f9ea9218e070fb066279b0d8ec4a73a6e266f3cd9b82f9e63f474df11931faeac629d11a15af0d44b8c95dace242590915b29372fbce2115a534e40ace7ec3137d0cc762b016d690a440a94177ba491dd4887792e42564c03f18f2859eedb4618c241f54fc9cecd428f150556019520cc731fb1feaffb33b789402b3d75a7b9953f70092483649e7364591895091d3ea229800938197c5a5aee626e1bc905c27f144250a0de7743a3639040019c441a1041782412586087b98694711985c8262b28e980be8bf23f3f744ec98fcf0e3dca2ad29a67ba4d26052c89dfbd389872bad268d34c755716d0eeb046f2e5689c2d8aabda4ad6656bab12d2a63d8934ba8f3b150d26b08cd8060ed37383f974d6c9cc123fcc52d62e3d45cb6917fc7761ce16543a6129e5f9860a7a4ffec2e27c2e8fdca7ce7748bbf8c49bcd264afcc6d29c513efbb4d1503b55829090a56671fccab0068063059bc00bda652a7d2649f5ee247d6ca713f70b0ab180439de3f9d1668dfbfb500fb41a301aa97352186ffc9e5bd4cad538da83dc530d71acf26383da94f6e96bb13b6c6a64ad3a2f435454d3c4978abb5ea8a7c4e276ba74332556f2af521e9c63c5fa03a4b7a63de0be4f83c075464d0bfa90ac9be9f23d613a7fc808f342f1e93c2b45b4a803c384215b027f3d322a6a67e9b1f3f010b2861378bd4080763c416d7603ad411566c514f54ebf7faecf96024f875ef2e48d6343988e98f4d1a5b803ab6784deec8b9886d74a4ffe933a8d15f57a1082c5fee2f9a6fa91989dfd119c49ed5e957dd4b1603298684dd8e0cc251072ce94308b674ff8b98bc5a412d7f1d8df8ecf810877a60095fc3e1d80136bb35b095929c1b79460552afe258c4587fb7fe9c323634c806c6e782f56ec345b30a00ae8cda8f2b9bb15c57b81ace6833dc22d0fe56dee3a345050b00846d4cb7f670e7c18eeb1209cec5ce2d9d0f7529a26fd3c6595ca5bf798f7ef1bed69b6451f190ab93b6ead216f35bf154170c383e0d7d96f99e70679efd13d76b7805c90845e49a11102265adb1bb746be74c5565c200fc926850527bb0de15efd7fe4c11643aedd6980d5667d62c1c81f475f88e3f86888acb38e7c721f4770c3d4f777ea2114adeac962a1a9d4b7a8e05092428f59cdcb5e71adcc1fddee1df503f27afa34518ae670defade72b3144e5c7737e3290c1d6535f67b1db6a27620faee00bc4312c905df416212d5b890e3be50b17ec41145913385bab48f9c181b85cb8275cfd88605ef7b1039064696afa83d1fdc7d3133ca6fd5461c54c13062fd21d8b052bdb55bdfdaf4f456d1230de2a4d749dc28f94f28b70ec159b999fdd7f26d4bb730ca598f9bb27584e34f2b9183e65fb88c5cc19b5b4b8d33f0944e2c049fd6fe4986520d6ad11ed6baa937e2fcc705319878f465670a2f62966295572c9a38c2ea83fc5bdc07c71d2c8dc2b379e875cde9ecbe17d05926e2a91ed409e80c24cdea95f9e72356856552396a00004d2c8224e8220c147520e706d203484a54368f7a705171ea6b0ca0541a5f5289f6183b49b85ffb761daa5e1172ba50abfe86e61d8970a8ce85140288583e249655958b2fae518cb68ba21178e32e09a3dad2018a00389aea805c5d2d8939a7cfb8e11b3dad477612038886ef3762c4b8afee60adbcab0a688ec1d1f8e41854d5f1677fe3c62cf1d070e13274614679a60fd0a2f5fab0e3990c39bf8f45df75c372471edaa406d9ec0a3a94dbcf7376d223f14876255f8b56710108c59d7ac159d6bcd6e3a7648c41cb21dedf017e036263c5815a772a15025357024c6769f7f143876538704e584364ffb63909f778f888f17087154b6b493f9ee607ea8f978dd8d3fe3d848cf0610337b2ec19c9b690949b763345fa5866ff80d82dc556d8ae96744648a0f56699a568fdff419a44239039c718a3393551e3707c1630ca19d98fe6ff7eba3d0f2530a46b835c2d25ac8086ba291a67b42e505069ba5943c04c23249fdce871d656fa5e3a7b128d3c22b9ed32a6142e1670f0763bab3d83da0c9bd8ea7e02f291857635744829df065582447a38f9a57e63f34699d3581f972b24c3f1e8972e369e4d9bc5d79acbab0849321f94e08371fa2510713b7b67a096ae91227c309524c172d5d249289aacaa1a397a8c3f874f81362202f1ece412dabc3fee7a999fd113c3ad10ac3a4f5c554d0ac83f81ffea0ab8e9d2f5549b7b6f58318ddd48b0a6a6c6638f7a4616943764c71d749f91f7d17fe9e25c240cc68da5c633ef27ab51528662174ac31c7362d7596eda44fcd16e60b2858bc1f5043c995e23b3c6cb199e78d6298aea4aa215fe5dd19568a16065aaa5f694ed5c3d72d912bb925b268c294f47673bbda18e1482a2af103e5a6c31639ab244ca7507224af536faf61f94342b4e97be558e3fd89381e673febbb1269988cdcc864e755beb1d74189a865bfa1604cf8cf151c3620d365e02212208c6eaaac94f01429b53e9547fccdc66958572abffa89e302050850f3eef174afda39344deb6517d609e018a1d30b92157b07268967438569a22bb5f35e93b8d28ed5d733c667ba002ceac5be56c366bebe4355dc59268db6d9f5090b7a32cd41727b7df291ce517606af44baac4e91bd3b3034ec8e3da276f2a432710ab193cada4b998ae8ea4cb1dc6ea3c81df189d30365e16eb9f733afd9d3e19d5390f3204492d6ede141a81d87af9fc9b66126902739d6d82106ea3ecc20e4f55f18ca38d7bba27653c8296401498d8fb401594f401aa6199f3ef1e98976c020dda343b6187b49754c8887f57cfbf82f0a0b10dd0f1caf50c19f9bbfb05d295368e804eb4bc5a7fbf18c0b1adf6969d134683f78903151515dbcc3d6555411bfa93faf2e785fbbe473d3c783ccc296f8d41d1b8d063e9179cf88557d2f2e28bc316e627955b070c3bee83df81bee6ad47dd07721b7689134ac73216b85c00cbf0d5ffb85610f4b699410a19721c30830cf84851a589fd9a1841b791b17a946ed7da4c38ad09d50640a5d7fcf21b6a31a1ba4afa506151da34d8cdf1205ac1b26c13df0297e920211c402afeaa45debbf72df9b5e8dabcacd9242aaeb93d4207712af80a4a825d8fc9b61d35219298323e8d9cee0613edc1623848f5f9177df7a3303ce6f364c43ffd5bf8f34b31f58fc5d4954dc9ea5dde224f132a85561d9118694211637ba7c199f966272ec4188e3781a50c7803f3c1ab7cca5ed620a935bd4190e038fcadc769e040d36fa04a7806f0a38f2702d4937cacbb6c40c04e0fe37bfd92ef69eca6d413470ab3ce0056a45d9d3221ab6fc6993d4057318ee544af68ff1038f62142525c19cd7a91a07098cd4c953dc8ccf45f37812a79f71b7f72244335f538decc4079cf282fc304b1af810ba3e91f726b7a790c621fad6aa01add3773e7ade48e40b088d0cfcca6b72ea27fcae6dd46e5c3752b989dfad6866f23f200dda0b9d5c9ce3b9b09ad88ecdc5a46dbcd4dd1166393dd7c6f74b9a8ed47ba4a92cfac8c4016f356cce3540fc6cbcd7d2d517bbfcf6096e680795bcac8c516a986e7493bf23cd0eba57f52a9073ad2549500e939d2089d52f92d137e8fc4353288222b68fe3e130a636ef99485d2e694f1d35e37cb58fee97adbb258524b2c1506db9a396bf51c132c00534ea0a489ce94aa6ef8c0ddcf3", 0x1000}], 0x9, &(0x7f0000006480)=[@txtime={{0x18, 0x1, 0x3d, 0x6}}], 0x18}}, {{&(0x7f00000064c0)=@xdp={0x2c, 0x1, r1, 0x40}, 0x80, &(0x7f0000006640)=[{&(0x7f0000006540)="e998f12bbbdab0483c0242b398704219bafcde6936698b143ed1399de506bb4d5d1a21b124ec7c885b890fef02bbe5a0e488e11065aa27d224f42ea60c13f5572c7312cd098978d1e6ac5dbdb83d026dd9eada4ce8de38ea775979adb3ad227715ffd059e1c50c71882e3d5a25411cc3b80df97c9a66b6328321abbf499e1651e0823b19ea5c013a5ce65664d72880ffa6f312c5f2542f8c28b0f74339422502cdb8a28e786c3c3ff451ce6e280a2efff3dcee5816f41fc1cb24b4665f39d9137341c21d166acd4b2c9d9f9b6134b93b44c3a1b606b882ce788f60f64b9cc787f1fa", 0xe2}], 0x1, &(0x7f0000006680)=[@mark={{0x14, 0x1, 0x24, 0x2}}, @timestamping={{0x14, 0x1, 0x25, 0x7}}, @mark={{0x14, 0x1, 0x24, 0xc0a}}, @mark={{0x14, 0x1, 0x24, 0x8}}, @mark={{0x14}}, @mark={{0x14, 0x1, 0x24, 0xbf7f}}], 0x90}}], 0x8, 0x800) r3 = inotify_add_watch(r2, &(0x7f0000006a00)='\x00', 0x20000100) inotify_rm_watch(r0, r3) 12:56:18 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x6, 0x0) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080)='nbd\x00') r3 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/checkreqprot\x00', 0x40000, 0x0) r4 = syz_open_dev$dmmidi(&(0x7f0000000100)='/dev/dmmidi#\x00', 0x555, 0x400000) r5 = syz_open_dev$amidi(&(0x7f0000000140)='/dev/amidi#\x00', 0x2, 0x400) r6 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/commit_pending_bools\x00', 0x1, 0x0) r7 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/capi/capi20\x00', 0x109000, 0x0) r8 = fcntl$dupfd(r0, 0x0, r0) r9 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000200)='/dev/btrfs-control\x00', 0x800, 0x0) sendmsg$NBD_CMD_STATUS(r1, &(0x7f0000000380)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0xb8, r2, 0x720, 0x70bd2b, 0x25dfdbfb, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x9}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xffff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x20}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x168}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x5}, @NBD_ATTR_SOCKETS={0x44, 0x7, [{0x8, 0x1, r3}, {0x8, 0x1, r4}, {0x8, 0x1, r5}, {0x8, 0x1, r6}, {0x8, 0x1, r7}, {0x8, 0x1, r0}, {0x8, 0x1, r8}, {0x8, 0x1, r9}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x108}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}]}, 0xb8}, 0x1, 0x0, 0x0, 0x840}, 0x80) 12:56:18 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x2) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:56:18 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x20000, 0x0) ioctl$DRM_IOCTL_ADD_MAP(r1, 0xc0286415, &(0x7f00000001c0)={&(0x7f0000ffd000/0x1000)=nil, 0xff, 0x5, 0x2c, &(0x7f0000ffd000/0x3000)=nil, 0x7f}) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000700)={&(0x7f0000000000)=ANY=[@ANYBLOB="04000000a60f84cfa99f71e6d33af3a5c89b66f5", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="efffffff00b88a00000000000000000048ba1dbce83ad52a"], 0x48}}, 0x0) r3 = syz_open_dev$amidi(&(0x7f0000000080)='/dev/amidi#\x00', 0x498d7a6e, 0x20000) getsockopt$ARPT_SO_GET_INFO(r3, 0x0, 0x60, &(0x7f00000000c0)={'filter\x00'}, &(0x7f0000000140)=0x44) [ 1593.052049] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:56:18 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x2) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:56:18 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110b00f30501000b000500000000000100cf", 0x1f) 12:56:18 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) getsockopt$bt_BT_POWER(r0, 0x112, 0x9, &(0x7f0000000000)=0x1, &(0x7f0000000080)=0x1) socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$TUNSETNOCSUM(r0, 0x400454c8, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) 12:56:18 executing program 1: r0 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20ncci\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f0000000080)={0x0, 0x8, 0x6, 0x4d, 0x0, 0x9}, &(0x7f00000000c0)=0x14) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000100)={r1, 0x1000}, &(0x7f0000000140)=0x8) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) signalfd4(r0, &(0x7f0000000180)={0x8}, 0x8, 0x800) ioctl$TIOCLINUX5(r2, 0x541c, &(0x7f0000000000)={0x5, 0x3, 0x6, 0x2d3}) ioctl$TIOCVHANGUP(r2, 0x540b, 0x0) [ 1593.108595] Bluetooth: hci0: Frame reassembly failed (-84) 12:56:18 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x40, 0x0) write$evdev(r2, &(0x7f0000000040)=[{{0x0, 0x7530}, 0x14, 0x4, 0x9}, {{}, 0x15, 0x1000, 0xfffffffffffffffe}, {{0x77359400}, 0x17, 0x5, 0x4}, {{0x77359400}, 0x11, 0x6, 0x6}, {{0x77359400}, 0x17, 0x4, 0x9}, {{0x77359400}, 0x16, 0x1}, {{}, 0x1, 0xfffffffffffff500, 0x2}], 0xa8) 12:56:18 executing program 0: r0 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x200000, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f00000000c0)=ANY=[@ANYRES32=0x0, @ANYBLOB="000421000400"], &(0x7f0000000100)=0xa) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000140)={r1}, 0x8) ioctl$KDGETMODE(r0, 0x4b3b, &(0x7f0000000080)) r2 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0xfffffffffffffff5) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f00000001c0)) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r2, 0x0) [ 1593.194815] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:56:18 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110e00f30501000b000500000000000100cf", 0x1f) 12:56:18 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x2) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) [ 1593.316838] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1595.177772] Bluetooth: hci0: command 0x1003 tx timeout [ 1595.183203] Bluetooth: hci0: sending frame failed (-49) [ 1595.897734] Bluetooth: hci1: command 0x1003 tx timeout [ 1595.903413] Bluetooth: hci1: sending frame failed (-49) [ 1597.257820] Bluetooth: hci0: command 0x1001 tx timeout [ 1597.263306] Bluetooth: hci0: sending frame failed (-49) [ 1597.977954] Bluetooth: hci1: command 0x1001 tx timeout [ 1597.984369] Bluetooth: hci1: sending frame failed (-49) [ 1599.337783] Bluetooth: hci0: command 0x1009 tx timeout [ 1600.057795] Bluetooth: hci1: command 0x1009 tx timeout 12:56:29 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000000)=0x3e7) 12:56:29 executing program 1: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) r0 = openat$selinux_context(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/context\x00', 0x2, 0x0) ioctl$TCSETSW(r0, 0x5403, &(0x7f0000000040)={0x40, 0x6, 0xfffffffffffffffe, 0x1, 0x6, 0x0, 0xd6, 0x3f, 0xc72, 0xf23c, 0x401, 0x100}) 12:56:29 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) set_mempolicy(0x2, &(0x7f0000000340)=0x1, 0x87) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f00000000c0)=0x0) write$P9_RSTATFS(r0, &(0x7f00000002c0)={0x43, 0x9, 0x2, {0x5bf9, 0x1aa9, 0x131, 0x1, 0xfffffffffffffc84, 0x3, 0x15, 0x8, 0x6}}, 0x43) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r0, 0xc1105511, &(0x7f0000000140)={{0xa, 0x5, 0xd1, 0x7, '\x00', 0x5}, 0x3, 0x20000020, 0x4, r1, 0x6, 0x3, 'syz1\x00', &(0x7f0000000100)=['bdevI\x00', 'cpuset\x00', '/dev/bus/usb/00#/00#\x00', '\x00', '.selinux3,%\x00', 'TRUE'], 0x33, [], [0x3, 0x20, 0xfffffffffffffffc, 0xffff]}) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x4) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) fsetxattr$security_smack_transmute(r0, &(0x7f0000000000)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000080)='TRUE', 0x4, 0x1) ioctl$VIDIOC_SUBDEV_ENUM_MBUS_CODE(r0, 0xc0305602, &(0x7f0000000380)={0x0, 0x7fffffff}) 12:56:29 executing program 3: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x2) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) 12:56:29 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vcs\x00', 0x102c0, 0x0) bind$bt_sco(r1, &(0x7f0000000140)={0x1f, {0x4, 0xffffffffffff0001, 0x1f, 0x3ff, 0x4af, 0xffffffffffff3a60}}, 0x8) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$IP_VS_SO_SET_FLUSH(r3, 0x0, 0x485, 0x0, 0x0) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$VT_RELDISP(r3, 0x5605) write$cgroup_int(r3, &(0x7f00000000c0)=0x200, 0x12) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) ioctl$KVM_TPR_ACCESS_REPORTING(r2, 0xc028ae92, &(0x7f0000000080)={0x0, 0x3}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r4}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[@ANYBLOB="040500"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000000001000000000000000000000048ba1dbce83ad52a"], 0x48}}, 0x0) syz_open_dev$video4linux(&(0x7f0000000040)='/dev/v4l-subdev#\x00', 0x9, 0x2000) 12:56:29 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110f00f30501000b000500000000000100cf", 0x1f) 12:56:29 executing program 3: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x2) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) [ 1603.949072] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:56:29 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20ncci\x00', 0x8004003fe, 0x0) getsockopt$bt_sco_SCO_OPTIONS(r1, 0x11, 0x1, &(0x7f0000000040)=""/75, &(0x7f00000000c0)=0x4b) 12:56:29 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007114800f30501000b000500000000000100cf", 0x1f) 12:56:29 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) setsockopt$bt_BT_SECURITY(r0, 0x112, 0x4, &(0x7f0000000000)={0x4, 0xfe}, 0x2) 12:56:29 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) write$binfmt_script(r0, &(0x7f0000000000)={'#! ', './file0', [{0x20, '\\-}vmnet0%wlan0.'}, {}, {0x20, 'vcan0\x00'}, {}, {}], 0xa, "ba48df809b9fe36096752d7db664c4778b058c7c30fe47e382cf208c27d649ddd6"}, 0x47) connect$can_bcm(r0, &(0x7f0000000480), 0x10) accept4$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000100)=0x14, 0x80800) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vcan0\x00', r1}) r3 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dlm-control\x00', 0x250000, 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000180)={{{@in6, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000280)=0xe8) setsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f00000002c0)={{{@in=@empty, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e24, 0x3, 0x4e24, 0x1, 0x2, 0x20, 0x20, 0xac, r1, r4}, {0x4, 0x8d20000000000000, 0x8000, 0x1, 0x0, 0x101, 0xfffffffffffffeb9, 0x9}, {0x26, 0xffffffff, 0x101, 0x5}, 0x1, 0x0, 0x1, 0x1, 0x2, 0x3}, {{@in6=@ipv4={[], [], @loopback}, 0x4d3}, 0xa, @in6=@remote, 0x0, 0x0, 0x2, 0x9, 0x8, 0x6, 0x7}}, 0xe8) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) [ 1604.109430] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:56:29 executing program 1: r0 = getpgrp(0xffffffffffffffff) ptrace$pokeuser(0x6, r0, 0x7, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r1, 0x540b, 0x0) [ 1606.057714] Bluetooth: hci0: command 0x1003 tx timeout [ 1606.063098] Bluetooth: hci0: sending frame failed (-49) [ 1606.777721] Bluetooth: hci1: command 0x1003 tx timeout [ 1606.783197] Bluetooth: hci1: sending frame failed (-49) [ 1608.137824] Bluetooth: hci0: command 0x1001 tx timeout [ 1608.144693] Bluetooth: hci0: sending frame failed (-49) [ 1608.857763] Bluetooth: hci1: command 0x1001 tx timeout [ 1608.863173] Bluetooth: hci1: sending frame failed (-49) [ 1610.217845] Bluetooth: hci0: command 0x1009 tx timeout [ 1610.937816] Bluetooth: hci1: command 0x1009 tx timeout 12:56:40 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007114c00f30501000b000500000000000100cf", 0x1f) 12:56:40 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:56:40 executing program 3: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x2) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) 12:56:40 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) socket$rxrpc(0x21, 0x2, 0xa) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000000)=ANY=[@ANYBLOB="04ff000000000000000000000010008ea58df604950c96fb1c3bb45000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYRES32=r1], 0x6}}, 0x0) 12:56:40 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:56:40 executing program 1: r0 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video0\x00', 0x2, 0x0) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(r0, 0xc040564a, &(0x7f0000000040)={0x7f, 0x0, 0x201e, 0x3, 0x80000001, 0xe6, 0xfffffffffffff6a8}) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20ncci\x00', 0x2c0800, 0x0) ioctl$PIO_UNIMAP(r1, 0x4b67, &(0x7f0000000100)={0x2, &(0x7f00000000c0)=[{0x3, 0x6}, {0x9f84, 0xffffffffffff5f80}]}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r2, 0x540b, 0x0) [ 1614.814680] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:56:40 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) r1 = accept(r0, &(0x7f0000000200)=@caif=@rfm, &(0x7f0000000280)=0x80) getsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r1, 0x84, 0x7, &(0x7f00000002c0), &(0x7f0000000300)=0x4) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000180)=0x14) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000001c0)={'vcan0\x00', r2}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r3}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) r4 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x9b8, 0x603c1) ioctl$BLKTRACETEARDOWN(r4, 0x1276, 0x0) ioctl$TIOCGPGRP(r4, 0x540f, &(0x7f0000000080)=0x0) rt_sigqueueinfo(r5, 0x2f, &(0x7f00000000c0)={0x5, 0x401, 0x6}) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x220}) 12:56:40 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:56:40 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007116000f30501000b000500000000000100cf", 0x1f) 12:56:40 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) ioctl$PIO_FONTX(r0, 0x4b6c, &(0x7f0000000000)="516677d0acf3e27db27c9db2e6b0a613506287ad8da4d4f80cadb057233a042226f8b9abdfa81e178452c366bb6f2afa74b8a3f66251d3956cb4653adf1863c3b830e32a8200db97338010b3643eb9eb942977c521e90cdae93644adecb647d5860926f2c491faa370872b6e9a8671189c0968228ed79274d98ce193c44ad669e395cf088645cb0db95f3dd335b5b7e5924f6ad3") 12:56:40 executing program 0: prctl$PR_SET_KEEPCAPS(0x8, 0x0) r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:56:40 executing program 2: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x4000, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r0, 0x770a, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r1, 0x5437, 0x0) [ 1615.042732] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:56:40 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007116800f30501000b000500000000000100cf", 0x1f) 12:56:40 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:56:40 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000000)=ANY=[@ANYBLOB="0400"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="00002f293f9c0000052a00000000000000000000000000536ec0c54d31bc945cdb"], 0x48}}, 0x0) 12:56:40 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) r1 = socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r1, 0x800442d3, &(0x7f0000000000)={0x0, 0x10001, 0x4, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, 'veth0_to_hsr\x00'}) mremap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x3000, 0x2, &(0x7f0000ffd000/0x3000)=nil) ioctl$TUNSETOFFLOAD(r0, 0x400454d0, 0x14) r2 = getpgrp(0x0) sched_getparam(r2, &(0x7f0000000140)) r3 = dup3(r1, r1, 0x400000000080000) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000000040)={0x4, 0x4, 0x1, 0x5, 0x7, 0x80000001, 0x32, 0x800, 0x0}, &(0x7f0000000080)=0x20) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r3, 0x84, 0x1b, &(0x7f00000000c0)={r4}, &(0x7f0000000100)=0x8) ioctl$KVM_GET_MP_STATE(r3, 0x8004ae98, &(0x7f0000000180)) ioctl$KVM_IRQ_LINE_STATUS(r3, 0xc008ae67, &(0x7f00000001c0)={0x9, 0x3}) 12:56:40 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$UI_BEGIN_FF_ERASE(r0, 0xc00c55ca, &(0x7f0000000080)={0xa, 0xfffffffffffffff7, 0x1f}) setsockopt$TIPC_CONN_TIMEOUT(r0, 0x10f, 0x82, &(0x7f0000000000)=0x3, 0x4) 12:56:40 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) [ 1615.249136] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:56:40 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000000)=ANY=[@ANYBLOB="04e3499803cdab20dfffffffffffffff", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="000000000100017d95df214e2089ec97a4000000009df16ccfadb3b60eff0048ba1d"], 0x48}}, 0x0) r2 = open(&(0x7f0000000080)='./file0\x00', 0x440, 0x4) getsockopt$bt_BT_VOICE(r2, 0x112, 0xb, &(0x7f00000000c0)=0xd8e7, &(0x7f0000000100)=0x2) 12:56:40 executing program 1: pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) ioctl$PPPIOCGUNIT(r0, 0x80047456, &(0x7f0000000040)) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r1, 0x540b, 0x0) 12:56:40 executing program 0: r0 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x2, 0x101000) ioctl$SNDRV_SEQ_IOCTL_DELETE_QUEUE(r0, 0x408c5333, &(0x7f0000000080)={0x9, 0x5, 0x9, 'queue1\x00', 0x7}) r1 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x0) 12:56:40 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007116c00f30501000b000500000000000100cf", 0x1f) 12:56:41 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) [ 1615.477555] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1615.869818] Bluetooth: hci1: Frame reassembly failed (-84) [ 1617.177842] Bluetooth: hci0: command 0x1003 tx timeout [ 1617.183253] Bluetooth: hci0: sending frame failed (-49) [ 1617.897805] Bluetooth: hci1: command 0x1003 tx timeout [ 1617.904439] Bluetooth: hci1: sending frame failed (-49) [ 1619.257945] Bluetooth: hci0: command 0x1001 tx timeout [ 1619.263583] Bluetooth: hci0: sending frame failed (-49) [ 1619.977889] Bluetooth: hci1: command 0x1001 tx timeout [ 1619.983399] Bluetooth: hci1: sending frame failed (-49) [ 1621.337918] Bluetooth: hci0: command 0x1009 tx timeout [ 1622.058048] Bluetooth: hci1: command 0x1009 tx timeout 12:56:51 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) getsockopt$netrom_NETROM_N2(r0, 0x103, 0x3, &(0x7f0000000000)=0xffffffff, &(0x7f0000000080)=0x4) 12:56:51 executing program 1: ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f0000000040)={0x6, 0xffffffffffffffff}) fsetxattr$trusted_overlay_origin(r0, &(0x7f0000000b80)='trusted.overlay.origin\x00', &(0x7f0000000bc0)='y\x00', 0x2, 0x1) write$binfmt_elf32(r0, &(0x7f0000000c00)=ANY=[@ANYBLOB="7f454c460708c2ff07000000000000000300030001400100c50200003800000015010000f8ffffffff0320000100c2440400b68e0000000007000070020000000500000001000000060000006d00000006000000050000000600000008000000510e0000010000000101000001000000ae000000060000006ec876f5b56b3b332694b3b8e8158a2119b863facee0899c68ef3762695a7ff33fa1d75b5d5fb2a8c534a1273880e148d512c043f430eaa1021d4ba3167a44082d0e2f3847cfadc420c62d34664d600bc41695b28b36ca0b5ea7049a9c609f72e09ac12455c274a9f1b5a47700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000021000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c419dc3c56772a96"], 0xae4) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0xfffffffffffffffc, 0x0) 12:56:51 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0xffffffffffffff6c) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuacct.usage_all\x00', 0x0, 0x0) setsockopt$inet_sctp_SCTP_AUTH_CHUNK(r2, 0x84, 0x15, &(0x7f0000000080)={0x80}, 0x1) ioctl$PPPIOCGFLAGS(r2, 0x8004745a, &(0x7f0000000040)) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) 12:56:51 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:56:51 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x4) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:56:51 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007117400f30501000b000500000000000100cf", 0x1f) [ 1626.352589] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:56:52 executing program 1: r0 = fcntl$getown(0xffffffffffffffff, 0x9) r1 = gettid() r2 = accept4$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000080)=0x14, 0x80800) r3 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x121100, 0x0) r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/commit_pending_bools\x00', 0x1, 0x0) kcmp$KCMP_EPOLL_TFD(r0, r1, 0x7, r2, &(0x7f0000000200)={r3, r4, 0x7}) r5 = syz_open_dev$dmmidi(&(0x7f0000000100)='/dev/dmmidi#\x00', 0x0, 0x101000) r6 = syz_genetlink_get_family_id$fou(&(0x7f0000000180)='fou\x00') setsockopt$inet6_icmp_ICMP_FILTER(r3, 0x1, 0x1, &(0x7f0000000140)={0x9}, 0x4) getpeername$packet(0xffffffffffffffff, &(0x7f0000000900)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000940)=0x14) sendmsg$FOU_CMD_ADD(r5, &(0x7f0000000a40)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x20000000}, 0xb, &(0x7f0000000a00)={&(0x7f0000000340)=ANY=[@ANYBLOB="4800a181360f0014", @ANYRES16=r6, @ANYRES64=r7, @ANYRES32=r7, @ANYBLOB="140009b7c5392fac5828382a9ef000000000000000000000000000000002000a00000008000600ac1414bb00000000"], 0x48}, 0x1, 0x0, 0x0, 0xc844}, 0x40) write$rfkill(r4, &(0x7f0000000400)={0xffff, 0x3, 0x1, 0x1, 0x1}, 0x8) r8 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) bind(r4, &(0x7f0000000280)=@nfc_llcp={0x27, 0x1, 0x0, 0x0, 0x8, 0x3f, "16586d104e51c2044d180bd97181025e58d08ca9f6acddea68ca42d0c6d3c64d61133f7037fc99fbbf9871638e4e7e2fe4748d6ca0cc0b5b7c43944cfc6643", 0x38}, 0x80) ioctl$TIOCVHANGUP(r8, 0x540b, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r4, 0x84, 0x1e, &(0x7f00000003c0), 0x4) 12:56:52 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:56:52 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007117a00f30501000b000500000000000100cf", 0x1f) 12:56:52 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ftruncate(r0, 0x1) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) [ 1626.412125] Bluetooth: hci0: Frame reassembly failed (-84) 12:56:52 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) r2 = openat$cachefiles(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/cachefiles\x00', 0x10000, 0x0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') sendmsg$TIPC_CMD_GET_NODES(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r3, 0x0, 0x70bd26, 0x25dfdbfb, {}, ["", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000040}, 0x8810) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) 12:56:52 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x2) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) [ 1626.547356] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:56:52 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c00711e000f30501000b000500000000000100cf", 0x1f) 12:56:52 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x7fffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x100) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:56:52 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) 12:56:52 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x2) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) [ 1626.767927] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1628.457746] Bluetooth: hci0: command 0x1003 tx timeout [ 1628.463166] Bluetooth: hci0: sending frame failed (-49) [ 1629.257810] Bluetooth: hci1: command 0x1003 tx timeout [ 1629.263205] Bluetooth: hci1: sending frame failed (-49) [ 1630.537774] Bluetooth: hci0: command 0x1001 tx timeout [ 1630.543175] Bluetooth: hci0: sending frame failed (-49) [ 1631.337777] Bluetooth: hci1: command 0x1001 tx timeout [ 1631.343200] Bluetooth: hci1: sending frame failed (-49) [ 1632.617799] Bluetooth: hci0: command 0x1009 tx timeout [ 1633.417751] Bluetooth: hci1: command 0x1009 tx timeout 12:57:03 executing program 0: setxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)=@known='trusted.overlay.impure\x00', &(0x7f00000000c0)='vmnet1.%system{bdev%mime_typeposix_acl_access}vboxnet1nodev-wlan0][\'em0posix_acl_access-mime_type\x00', 0x62, 0x3) r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:57:03 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000140)=0x5) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet6_opts(r1, 0x29, 0x3f, &(0x7f0000000000)=""/110, &(0x7f0000000080)=0x6e) ioctl$VT_RELDISP(r0, 0x5605) ioctl$KDADDIO(r0, 0x400455c8, 0x4) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:57:03 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000180)={0x0, @multicast1, @initdev}, &(0x7f00000001c0)=0xc) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000200)={{{@in6=@local, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6=@mcast1}}, &(0x7f0000000300)=0xe8) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vcan0\x00', r1}) r3 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x480, 0x0) setsockopt$IP_VS_SO_SET_ZERO(r3, 0x0, 0x48f, &(0x7f0000000100)={0x0, @dev={0xac, 0x14, 0x14, 0x2a}, 0x4e24, 0x2, 'lblc\x00', 0x2, 0x2, 0x18}, 0x2c) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) 12:57:03 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c00711f000f30501000b000500000000000100cf", 0x1f) 12:57:03 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x2) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:57:03 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x400000, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/avc/hash_stats\x00', 0x0, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001300)={{{@in6=@loopback, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in6=@remote}}, &(0x7f0000001400)=0xe8) sendmsg$nl_route(r1, &(0x7f00000014c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x8010}, 0xc, &(0x7f0000001480)={&(0x7f0000001440)=@ipv4_deladdr={0x2c, 0x15, 0x0, 0x70bd28, 0x25dfdbff, {0x2, 0x1f, 0x200, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x5, 0xffffffff8fc2c7f3, 0x401, 0x6}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x10}, 0x0) ioctl$TIOCGPTPEER(r0, 0x5441, 0x7fffffff) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000000), 0x111, 0x9}}, 0x20) [ 1637.866932] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:57:03 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x3fb, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x200080, 0x0) ioctl$sock_inet_tcp_SIOCOUTQ(r1, 0x5411, &(0x7f0000000040)) ioctl$TIOCGICOUNT(r0, 0x545d, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) 12:57:03 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00'}) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x10000, 0x0) ioctl$SNDRV_TIMER_IOCTL_GINFO(r1, 0xc0f85403, &(0x7f0000000040)={{0x2, 0x2, 0x3, 0x3}, 0x8, 0x100000001, 'id0\x00', 'timer1\x00', 0x0, 0x1, 0x7, 0x8, 0x81}) write$FUSE_OPEN(r1, &(0x7f0000000140)={0x20, 0x0, 0x2, {0x0, 0x14}}, 0x20) 12:57:03 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:57:03 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)) ioctl$KDADDIO(r0, 0x400455c8, 0x2) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:57:03 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110003f30501000b000500000000000100cf", 0x1f) [ 1637.972524] mkiss: ax0: crc mode is auto. [ 1638.085104] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:57:03 executing program 5: r0 = syz_open_dev$vcsn(&(0x7f0000000080)='/dev/vcs#\x00', 0x8000, 0x240000) accept4$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000100)=0x14, 0x800) sendmsg$can_raw(r0, &(0x7f0000000240)={&(0x7f0000000140)={0x1d, r1}, 0x10, &(0x7f0000000200)={&(0x7f0000000180)=@canfd={{0x4, 0x5, 0x800}, 0x31, 0x2, 0x0, 0x0, "020ea273ceda6d4b2b53a0189ff7b22edf9c0b38eab7d384ba78c7cf56d8025874f230376f8c68e28f1a4609397d04ef4389add0c69a5e13d17d9490c80c4cce"}, 0x48}, 0x1, 0x0, 0x0, 0x8000}, 0x40) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r2, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r2, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r3}, 0x10, &(0x7f0000000700)={&(0x7f0000000000)=ANY=[@ANYBLOB="040000000000000000000000b445000034bbeac9b0d78309136b86b2ba0afce12366581b460af27e536ce220c4f413", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000000001000000000000000000000048ba1dbce83ad52a"], 0x48}}, 0x0) [ 1638.194488] mkiss: ax0: crc mode is auto. 12:57:03 executing program 1: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x100, 0x0) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/btrfs-control\x00', 0x1, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) 12:57:03 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110005f30501000b000500000000000100cf", 0x1f) 12:57:04 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) 12:57:04 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)) ioctl$KDADDIO(r0, 0x400455c8, 0x2) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:57:04 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/attr/sockcreate\x00', 0x2, 0x0) 12:57:04 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x402, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') ioctl$EVIOCGABS0(r1, 0x80184540, &(0x7f0000000180)=""/40) sendmsg$IPVS_CMD_DEL_DAEMON(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x20, r2, 0x200, 0x70bd2d, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x1) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) ftruncate(r0, 0x3) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r3}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[@ANYBLOB="0400"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000000001190000000000000000000048ba1dbce83ad52a"], 0x48}}, 0x0) [ 1638.406118] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:57:04 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110006f30501000b000500000000000100cf", 0x1f) 12:57:04 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) execveat(r0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000200)=[&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', &(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', &(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', &(0x7f0000000140)='\x00', &(0x7f0000000180)='\x00', &(0x7f00000001c0)='mime_type\xf9\x00'], &(0x7f0000000280)=[&(0x7f0000000240)='*\x00'], 0x1100) mmap$binder(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) 12:57:04 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) 12:57:04 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)) ioctl$KDADDIO(r0, 0x400455c8, 0x2) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) [ 1638.618921] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:57:04 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000080)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f00000000c0)={&(0x7f0000000000)={0x8, 0x0, 0x0, {}, {0x0, 0x7530}, {0x0, 0x0, 0x0, 0x3}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0xffffffffffffff02}}, 0x0) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vsock\x00', 0x40000, 0x0) read$alg(r2, &(0x7f0000000280)=""/104, 0x68) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCINQ(r3, 0x541b, &(0x7f0000000200)) fcntl$getownex(r0, 0x10, &(0x7f0000000180)={0x0, 0x0}) perf_event_open(&(0x7f0000000100)={0x7, 0x70, 0x6, 0x40, 0x80, 0x6, 0x0, 0x0, 0x4008, 0xf, 0x0, 0x9, 0x80000000, 0x0, 0x9cc4, 0x1fc4, 0x1, 0x0, 0x80000000, 0x8, 0x4, 0x7fffffff, 0x3, 0x506c, 0x3ff, 0xff, 0x8, 0x3, 0x2, 0x5, 0x100000001, 0xaca5, 0x800, 0x573d, 0x800, 0x4, 0x40, 0xffff, 0x0, 0x2, 0x4, @perf_config_ext={0x0, 0x20000000000000}, 0x2040a, 0x8, 0x0, 0x9, 0x40, 0x9, 0x8}, r4, 0xc, 0xffffffffffffffff, 0xc8510e9eca89383d) 12:57:04 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110007f30501000b000500000000000100cf", 0x1f) 12:57:04 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x2) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:57:04 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x2000000000000, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x7363, 0x4800) ioctl$EVIOCGPHYS(r1, 0x80404507, &(0x7f0000000040)=""/183) 12:57:04 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x800) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') setsockopt$bt_BT_SNDMTU(0xffffffffffffffff, 0x112, 0xc, &(0x7f0000000180), 0x2) sendfile(r2, r3, 0x0, 0x50000000000443) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r4}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) 12:57:04 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$SNDRV_TIMER_IOCTL_INFO(r0, 0x80e85411, &(0x7f0000000080)=""/149) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) [ 1639.007816] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1639.338100] Bluetooth: hci1: Frame reassembly failed (-84) [ 1640.617774] Bluetooth: hci0: command 0x1003 tx timeout [ 1640.623174] Bluetooth: hci0: sending frame failed (-49) [ 1641.417720] Bluetooth: hci1: command 0x1003 tx timeout [ 1641.423145] Bluetooth: hci1: sending frame failed (-49) [ 1642.697799] Bluetooth: hci0: command 0x1001 tx timeout [ 1642.703206] Bluetooth: hci0: sending frame failed (-49) [ 1643.497787] Bluetooth: hci1: command 0x1001 tx timeout [ 1643.503307] Bluetooth: hci1: sending frame failed (-49) [ 1644.777769] Bluetooth: hci0: command 0x1009 tx timeout [ 1645.577770] Bluetooth: hci1: command 0x1009 tx timeout 12:57:14 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x4, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f0000000140)={&(0x7f0000000040)=[0x0, 0x0], &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0], &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x6, 0x3, 0x9}) 12:57:14 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x2) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:57:14 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) 12:57:14 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$KDGKBMETA(r0, 0x4b62, &(0x7f0000000000)) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) fadvise64(r0, 0x19, 0x73, 0x3) 12:57:14 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x3, &(0x7f0000000040), 0x4) 12:57:14 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c00711000af30501000b000500000000000100cf", 0x1f) 12:57:15 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x2) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) [ 1649.395026] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:57:15 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000080)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f00000000c0)=ANY=[@ANYRESDEC=r1, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000000001000000000000000000000048ba1dbce83ad52a"], 0x6}}, 0x0) 12:57:15 executing program 0: socket(0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f00000000c0)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"}) ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000000)=0x100005) ioctl$KVM_RUN(r3, 0xae80, 0x0) [ 1649.492393] Bluetooth: hci0: Frame reassembly failed (-84) 12:57:15 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c00711000bf30501000b000500000000000100cf", 0x1f) 12:57:15 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000000)=0x0) ioctl$TIOCSPGRP(r0, 0x5410, &(0x7f0000000040)=r1) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$inet_mreqn(r2, 0x0, 0x23, &(0x7f0000000080)={@remote, @multicast2}, &(0x7f00000000c0)=0xc) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) 12:57:15 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:57:15 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0xffffffffffffffbe) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x11b001, 0x0) r2 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_ADD(r1, 0x4c80, r2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r3}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[@ANYBLOB="04000000000000000800000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000000001000000000000000000000048ba1dbce83ad52a"], 0x48}}, 0x0) [ 1649.624041] kvm: vcpu 0: requested 128 ns lapic timer period limited to 200000 ns [ 1649.652393] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:57:15 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c00711000ef30501000b000500000000000100cf", 0x1f) 12:57:15 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_dev$admmidi(&(0x7f00000000c0)='/dev/admmidi#\x00', 0xff, 0x8000) getsockopt$IPT_SO_GET_REVISION_TARGET(r1, 0x0, 0x43, &(0x7f0000000040)={'icmp\x00'}, &(0x7f0000000000)=0x10000011e) prctl$PR_CAPBSET_READ(0x17, 0x2) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) [ 1649.771881] Bluetooth: hci1: Frame reassembly failed (-84) [ 1649.849773] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1651.497724] Bluetooth: hci0: command 0x1003 tx timeout [ 1651.503292] Bluetooth: hci0: sending frame failed (-49) [ 1651.827735] Bluetooth: hci1: command 0x1003 tx timeout [ 1651.833140] Bluetooth: hci1: sending frame failed (-49) [ 1652.297748] Bluetooth: hci2: command 0x1003 tx timeout [ 1652.303165] Bluetooth: hci2: sending frame failed (-49) [ 1653.577812] Bluetooth: hci0: command 0x1001 tx timeout [ 1653.583223] Bluetooth: hci0: sending frame failed (-49) [ 1653.897783] Bluetooth: hci1: command 0x1001 tx timeout [ 1653.903184] Bluetooth: hci1: sending frame failed (-49) [ 1654.377829] Bluetooth: hci2: command 0x1001 tx timeout [ 1654.383264] Bluetooth: hci2: sending frame failed (-49) [ 1655.657857] Bluetooth: hci0: command 0x1009 tx timeout [ 1655.977839] Bluetooth: hci1: command 0x1009 tx timeout [ 1656.457798] Bluetooth: hci2: command 0x1009 tx timeout 12:57:26 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c00711c00ef30501000b000500000000000100cf", 0x1f) 12:57:26 executing program 5: r0 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm_plock\x00', 0x400000, 0x0) write$vhci(r0, &(0x7f0000000140)=@HCI_ACLDATA_PKT={0x2, "6b90"}, 0x3) r1 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r1, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r1, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[@ANYBLOB="0400"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="000000000100000000000000000000ebdbba1dbce83ae72a"], 0x48}}, 0x0) r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x1, 0x0) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000040)={r1, 0x5, 0x1, "b281a0f1b9dd4ae7b93e2b25adb5dc57c66ece9c7b135af5fa8f78e010e9b6ebdf6c51128bc5d734f0b3051a356e4dbe5379a59ee9341ce226a11f73308aa5a15fd5886890423abd92a2ee21925d3c9636eb29b018046b0c63910fb3d8b973dd183102d0c161aa33e8d85d78e2aab9dc252893889bebfd6f20463066766d5f6e7b05c677467deed359c5aaf4e6daa00e769b34e972bcc61b419e9e8a"}) 12:57:26 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = accept4$x25(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80000) ioctl$SIOCX25CALLACCPTAPPRV(r1, 0x89e8) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x800) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:57:26 executing program 1: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x280000, 0x0) ioctl$TIOCNXCL(r0, 0x540d) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCGPTPEER(r1, 0x5441, 0x7d) ioctl$TIOCVHANGUP(r1, 0x540b, 0x0) r2 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) ioctl$TCSETXF(r1, 0x5434, &(0x7f0000000040)={0x9, 0x9, [0x400, 0x1, 0x1000, 0x8, 0x5], 0x3f}) ioctl$LOOP_CTL_ADD(r0, 0x4c80, r2) 12:57:26 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:57:26 executing program 0: socketpair$unix(0x1, 0x0, 0x0, 0x0) memfd_create(0x0, 0x0) r0 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x1, 0x2) r1 = perf_event_open(&(0x7f0000000980)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$UHID_INPUT(r0, &(0x7f00000002c0)={0x8, "b13e1c20d1764d052a4289a71186ca1abfa7f39eb694f4602948f6585c2842ac42cb2f94b098e98f2bcd6128dab4a71d544e96e01e3a9a3548ee5f554c06d963346edb9d133e86fdd31c21e9aaffeb52f7cd63297b1fd0db1845e12bda3ce00f0cca0e6ac9c42a61e687c24c0553b408359c86c7bfd7a30944ac327f982b011258e85ee00f050c38e73199d07b72b225a96ab0fb5a9ea944a233e46cd4c25aaa0fe04bd9b3203f61a06c8f094563ffa0078e50248ce1acebc03c75069eb1cb20ebbe30ec063f9ebc45290dc4f8b56ebb08d32e4df04785fd385029f766a0b96db6a1b6615de63393fe97082c076a7170d2b1c06ce0627d6acae850c2b95f38b079a352f27bf6f5460078b8e597c1d3bdb5cf9e73f42eec5aea224ab44b94e18e812864faeaf770ba7471f99b07d41d573d1d4c3833fb4410ea36d710bfa66ccdb14a1927a678f873b023e82c341a43704adb37242a67b2a46d02ab7aee23cf3030a2f3dd58eece667b6e9393ee8d36649e37e83b1c73c0ef65b4df6173c1c25324fbb9afa1361dc4275f152deb03d7138a688eb9dc66e7845ce1be5647bf740b0e1dd038120ef1e3e1cf420cf8b723bef771376e433935e4f9096a10c4a969aceaac4791c41f365b274dab49bddf51b22a24c05ceaedcbf45febc927e98f410d38247d7679cee7b0d3041eaebd7821924ad31e7c5137bf87ce1ec537a981779f0a4c57bbbb5c641cfd02e1e3904f48b0be96fc9851b6bc8c4260168eea9d9d111e2777f78a9021d5eb0166e39410bf279656770263ca2fb7ac0e30d5e168f8cf4bc5665d057da939b770568e41d0fcec5d6aac0bf4ae66fb099b786cdce7f6a9bc00b83d8ed72440a9724d4ef8af71c7efbc31397930cdcb99d30502ecbcc7ddb9161ade16a1badbd7ea3c6c65b387b46234c4660c816506a2f76264bba07ecb685532116bd971464b58e3ea0a29c2fa1d49d9c6308806db01326e9a1b6bbb556f6479b29f48718e211d75f08d0fb477ad8dae5aeaad7e176b2c5ae331ef78212e9dd7e506549dc74ffd940dc91d74aee2fa7f28855919c163f443804e2a072ad8add2be84df87e414afcab0f8e6f67d3ebb1778a6798d50233da09d29b95c0da97304b7a025e50a7c89e614c63bc69477bfe0e5ae2c468332d134f9e22b19eb2f01c8e8d5148b9b980f8b9aa0cab9ba89aafe16d6a8cf9cb5ae659d8fba88e2841f3d6ac0c44dd9f03787d357fe31a4f551e247bfb73b1f2aa1e208c36aa90dcfc4da8877967c05fe951716ec2293d79c6083e79061bbe18150e2af1d889bb4e87c7735b0e7b88a3109a906d1bd4bf9b98c2462420ecc4e9f3a274a6678bc56e9aa7f3d64677141f874f35d00d04a1dc83126ccd69a0221305a3a5418ec24e163b165c1e4533c38f3d213de4012aece68ed11e2f42325d6da5eef78ee985f81a7991e3d1ff69188059c292779579418ef81177fa94b43cdd0fbf92d31f0fb592a864ddc98ddd5b49ece865e7c7a6c873169d0eea46c1a44f645b1cfa40849ffb9f5355ab396dc1a875180f17103be63be4e7d1920949c59ba5d47341c176ac307e165b9733ac5cd9e9691f5ecd76b467881b78f217d50903a06c57270f4104fd26d496dd7e08c27209185761882923f6447c73d53a74e28132e6bf97ee4f2df9d03be88653a9a7251d8df247f1a75f91f95886ce317e3c125aa7686eec86708fa72c9b33a664e76c0ed891ff9d840ac121ae3f96d32330a14fd76df19c7ae0434e2103d6e9175da0b6cc7a007a0a18615271771434959de305636cf7fbfdd16239bff7dbc656a702ebd48f9a2b1937cca80604ec525d292bb7337459235ad047c6933b6c81bd966ea60ec863de568a9e6d8e0378916f441e0f8b2b74df49b9b24094fd643413469428a537aed19b72bf9381ebab4cd57400ecad1cf1b792e9610910d02f9a779b009840e3f1a1395a87f1e590c33018be80a3f34bbaf49e415ba7d3858b40788cd19211b8cad3789870fb252f8991d64bff9558a67a2316ec2402c2f9c52de42e6389fc90bc4379f7b899b1a943035d64f20b7766edf08fdfa185d00493031f0d3f9ad7dce841f725c5adcba896a76857918a2f54c8aa2e50f71eda35b8fea3732a02c146201ad9f4b65b7caa09e2a73f72aee1ce428a35489038d5cc859fbd48be8da5d088ccab897a248fe418b89b409ab5507af725f077d264abec5b53667ca06aed03815dd537535a3360a50ca3d09c025b5057362c7cb5a4b99c58ac64fe813f4d7f2cafbc3048835ec43fa68170ec7310342134c9b5ec417763db145555cdd37f24b27b0911d172710b74d3c754aac02b24030166cbf2eccfaf1e909b629b7919db1351cd0167e8b6bddc5ce4b7e13cbf0c095f636427d440d058e7637eb117947fc6a60942d10bd455030ee38fc447fd3e6232efba65def558dcff60274e6b2ad62464b4f767bcfec22c681c12bdabf1fedc3946f45c9a34a9169f79ea60a9d190dcf1ce14957382af602dd134b610b269247f38c3d4e233f2fda399dc4cf09139cff9e9c731f8bf940df3cbdf9355f604bd0f3d3b20a6cfc39a7d9ff74f734750187b30c1a970a432bf7e9417cc87d8dea00c4e1885845e1a59bc6a5487687c5bca514e9dcf372bcdc0fe4a47f3e4ac456b1a812e69f88b2a8a964d946cc102ba6f3a7c965df24653c6384d810cf157c8581d4b40e874aded8d227a25fab9889f02698bf52980f048408de4a96226949eba5d1b7f41fce61ae1ff9388e096646ddda4c222f7b9bffc1d3e5b645b6e248637698f6a5be1dc03ff7aa9f418153beeef9b9d67ac5b6fc888e5adf0db41a6d5cac2b600af3b428a1294f4fdb4cf64ccc254c1c7ef71b9be3afceb797fc9504bc3f3dde217687d47cd445c44bea2b16eacae76f16d868b77065b189bd7c4678f3a5fc99b4d020d42972d010b7a6b22de46b434f2d8ec4f567af2d531817ec81ffa36cc27d073a66d2152f1be2a8dce08e98a00f473f22e680cf0ebdcf37936cee60f99eec69503a15d8e36f8d599b535021693fb52f9dc93e315d6e849bd4bf9d05fb25f0b09de91b73ca4edfbfa04d9262d449eab2be542ea30f316384609efc52ed641a9e32d48e4a57c65e8bfa5c13e769d5402a0b125c17360800bf0da8592a75abe647f1d9b1072942947da82e701308b60ecdcfd40d7b6cf44b443493ef0466790547c0a8e5914484969e52cba3787c41df965f91ed7074cd62a63db7e1c35b8f9ac30521295ae7b9c81143926f1dd36aefdfbcd7056b0d4209cabe113a18c58ecc062df687666725707029a8be3ef5721484bd429bab33fceb76c6a0f079da8819d0d9565f5e4ed45eb531f9501b85b619b5323169b0297b7cedcf6f288225dd5e6a7f52c1b96cd38dd94b2f6b8cfc6dbd7862901a5295dca5ecbae72344f41c4a222bd6711831d265b910d547501116bcfbf3c9e104b446175c4c8a4e56445ca22f9363f0f54858a8eb4a1c43103bca578c5b0ee372efd705a950510dbbfa4f74c8ddb4bbc1f07dd410ebb39c01f4da8a0bad2d3d35df3a12a9fa2daf44c8163d59aba8a7351ecc9fe4cd25b987dba700e73d7174307161adf70db0e7a802d7c9ec1b912ee58b0a35c2c6f40f112d70ab5aa708071379280c9ffbceaf0a4ec45c89ac0bf3ef40538302b685e24574da8bde8654e99eff66c9ad5e6beafa0e48e1c293c53d955980346cbc052d15e5d1f3baed388dfaa72ca089af06ae757466a704b93a0ff13cb5c722f0b872432a4fd4513ed56825b13ddd4d8c02eb624c8358199f52679421ab0e1792869f6b4aea523a1079b3138f1ef761c6df102096eff43ddb23ee668b9cc5161433feb318903b58387c3dae2833a8c770e7c6e27c31a1fca07377fbb07f11911be6192f7518a8d089b89826e48b28f5c8a00784bef9b2f68c90838eb2c9fcaeda4bb76782510082c977a7ecdd5743e9da8f088a3b67a25cfb25db4a709b6cbf5425e7efa8c2e472464606d9ccd2fc0f73cd1d51a5aa19d9caba10be2147f8e1ad763ba45693f9f078b0716cf588142be847ca67dc132c5782fed12b7d95c55a9bcfdfb85cb48698a45621cc2f1c85559617ece7def71486290b0cf8e987e8788e1a13f17e3f24b93ed2009ebe42e3bea9571f98b39b787c107dcada3a36fa1fe93736e74ec34af80a182cf0adf2846577f1d474c9ff1b4b8a2cfe6a2d445029ca77088b9c84be63655d48cbc5f61b18d7cda0d141f2db6bc3c479aa6ca19638e2c37da38768eb8820e5679345d2abe8033318eb952e297e17dacaaee3df7ef1d6cd554e9b1b453c44e3d4e030e25c5f9ed094100f6d9b1dc5dab371436ab252cc4d7fdf8fe4b7f36ab71f2bbe3878217b151664c3b9ae970e473ae164d77f294ca8ad58634ea446880e8327fc7af2a088e39508443a601eaa00742a7d0ad459dcac24a60edcfa6ac9f72f428c2b8dd30b8278e28f25a1a129d23cacd765de4c4aa52819578951bb8e311e8621f627e3463e2562b6dbc8d1c431c240f1424599438b9c94723f79ffd1fa1bc94104e4598bd43244302f86ddbe47ad8671e25f406aa507ba45bdba09841827a697cece002f79ec7cf14488789d754f84818d180bd04a11cb2115441a402bea2be749ef233bcd26ca27df828ada877a893e54ea3e6ea29e62d6e7693af7cbee59ccdb4045d0e6eeec3d8f59205f324a5f7cf5f871929c83ada04bc5d3990288dca5eb312339933ffb1031e05866e1b2d0aad0ca940795458b7d6c8a3750a76e1e6c8ccd48ca542d6c51164431d70c9d35f0f828cdec404a175a44bc2a9651ec5281c0f3aee9e4375f0eb139f58fa4419fddf9ebe2f8f37121a57397e7e830ac097ed375521a68f7cdc471621b769fef40cd19d8d55a82e27bf5b0cc4182359db7c9066e2ee10df279a89e96fcfea225995f065f7f286b8c8ef9b6c82a34df14dda2f737f557578ce5b15944e3149110102d80465c1b436b6bbb16fdc64a9d130ec7644bc162f0e2c5669a9254970a062561e269d85b72b4748d71d88ca20778287bc3b9613043166862f133f366f6361b9e1d040bbcd9728a70fcf3be7ea8fe0f55980ed03f336ec49f7cb6899813acf47d3b2413e7b637b764fcb9003ece75f8a255b9cdc71f80dbbaa7eaa2111b5551feeb7ea31620a2c88897538915abedcd184d57c79d81505985f561820449c330bc3412bffb68c4c743c5a5a3acafcf00d7561a66f70e5835da530ba62f221211e1fefdc1fbc8c05b1b68b7eb2afac6ebbbc0b961b8ef8b27b555ce7641f6601ac19d5f4adb06b40155a2085ff32de5b2c5edd96a01a14d1bb49b58f1fd718bec428043819b8070e46f0215d2153318320754638d9b40a5214784e7c1f80dde05500cfe8e4dff855504e099634fb3d44829453cf4ac8db7e5a4144f96d4508de90ada04240637fd5b261cfbb80c8d9ccdea6c1d3485a85663cff9749133002c7f9c6ea4de1b50fe90dae397f6b5833e943e6c5f60e10d805e97e6869488b857b44d8c94276f668257c223e2e26dff75222d3f304f8a040ce058e1b7b3bc5f0b69c310beea64212ef0a54bc9fb858c25681cee574c532b64d4f8241e0b855f7f79d0a1ea22fc3d9ad5a1658b5c4d9d417e9eae47c81628341172609a8ef8c72fb6e4e48da6a10207e56b727f65c82d49e2dbb44b492e1265c2b28f98980334ccc3abb0cfd15d73c2f38f4c824022aa7a0ac0b7d35eea934d3455d21e8c710474e54bdf29be107ebc00", 0xa943708f26830065}, 0x1006) dup3(r1, 0xffffffffffffffff, 0x0) add_key$keyring(0x0, &(0x7f0000000100)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffff8) keyctl$revoke(0x3, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getpid() sched_setscheduler(0x0, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) ioctl$VT_SETMODE(0xffffffffffffffff, 0x5602, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x9}) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f0000000140)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3235004000000f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4d}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f00000001c0)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) openat$vsock(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) [ 1660.910603] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1660.919571] Bluetooth: hci0: Frame reassembly failed (-84) 12:57:26 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c00711000ff30501000b000500000000000100cf", 0x1f) 12:57:26 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = syz_open_dev$rtc(&(0x7f0000000080)='/dev/rtc#\x00', 0x7ff, 0x200) ioctl$RTC_VL_READ(r1, 0x80047013, &(0x7f00000000c0)) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[@ANYBLOB="04e4ffffffffffffff00000002000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000000001000000000000000000000048ba1dbce83ad52a"], 0x48}}, 0x0) r3 = dup3(r0, r0, 0x80000) ioctl$VIDIOC_ENUM_FMT(r3, 0xc0405602, &(0x7f0000000040)={0xbc6, 0x1, 0x3, "6e06fb30aeac6ff06669239c836fd192ee8e3ecc20dc639a0b405e9ab1508e9e", 0x767f775f}) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vcan0\x00', r2}) [ 1660.984643] Bluetooth: hci1: Frame reassembly failed (-84) 12:57:26 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000000280)={0x0, 0x1000, "b879dd107e5994e35b3fcb99442661f6e1f1e611f5f41220fcb1d981d74406d1407702bab51f5166925c497a19883a8c35b1a53a1c1fafa294d39dde08dbabd1f72377827c5a7877d2fd02de5b5d00f2b724ad97e80e953f24babd8f245866f6b7f292504b3d2b47bc78f2e629ff55587cd1a3ccddd01211d81cf62e4974f9e0064fb603b625f20d104633b378c84a7baa6a1b8ff2d30bf345d523dc4bcccdcd0bae2b8371579b4370f6428380caf4a098244d0e2c75c097d25860c05e4ffad351a5e55506f4b148c2caa30a9acd1e2343858929ba909bfa79f09f468dd0fc33a93eeff8fe284231d3d53b498f8bca055537ed407970d17430e8b1997bf813bc98b558d85d8e444d8d2758c666072430c634a4f3cb0eb27db96fe2f6b8434805f86b367bcd94a5552f965b808f3d70a598adcccd17b13b2b51625ed1b25e8a7994dacabee313d391d0d2663254ee7f3ec2732980cab63768f8ae55c2752054c0c73ee2a1ee922cbbd203c0d1161dd77ab24148128d682ccc8ecea37bfcf42b74eb46ff2273cd477830efd7a31622c1c3f600d3331fca01a6c5559c8e15bff1e0248f67c929a7a4c14557dbc847bd7f2961b1656540fad5a6c898dbc51de8889e8b78c755f3967c7506c390425cf7b7dbb569dfbc2a10078ed103a1daca46139d649b086f615d8e268a6618aefc61fe0a89dd8fa8d14404d19479fa13e0dde5c9c88755b3a441df45f9809fd01b963d61ddcb2d6b107d7507dc3077a72d6c655c93df4555149eecaf5fc4991084745eb84ec68304a16f52122666f790173037388875f0a67bc7abbfa396280e667b85bf056ce9642528845b289c6692c4014637b8a083a7d95f9a93a7c34899e8d71636b1ae50d79501b3296cac8497151cee17f2b5fcfd32decfbf28d748bd033681602691811c422370dc4ccecde07fc1f4b9e66e834f8e9742d4a3c833f7ec15b1a904d2264fd8bee6c97b02e6ff21adb3361cf402b1a36c41921fbb7e05c4734105702e44a52505a85492fdf2d9b655d8bd2b6b6d95e11c1d18d405b61aa314c2be08802bfa436d51d4fbae43637aca2e09b8b56000ff6d8774c7d6fc7aded57e7eee1596812964d8b29d5941fe1f16698f06c2213460c2c537d27f3b11754b90a8e11d09ffe6b098659ffe0b27e181a708f73dbf822de4a125e861b0861be2368c7075b66a174d3cdba8552fa40779371d755e4447f36a7612828063cc9ae8310c6c5c934fb58cdc53028ab901dc31dc0fa2e72a1e6c3b57e2c0c82d13d486c287c5bf8213ae6d09202186a8fb1b8eaf153af050652f16b441afb20022cefeffb62c0fef4d05c5ff3a82f98ba91740d678e7e67315e2057ab9cc3bd3fc1cf82766786407901acf38d060c2367bf9f0e82d4c7051b8726d7ed8436aa008fb7819cebefe9f8c60e3c2e36d7093ccd994f5e64d6f4954a2e82e962bd7778a20faf490bb1e1ba1fbd5144f0da39c1a63667409f6b66b8918a5dadf762d9c9ef6d7f21ef8e57f4b446750963a745a065889e9f543e98c6b5d75d623ccb7ac0789df8c31e587e691c632b5359ee375916301abff14c6295babf692355c48254b3a44da14e9a2c955c468715242f9279039ff45c4ecb1b2a8eda13b3b189c9a3e753bea2bd526eccb8dbf4e7d49b75845440cbf4afdb665fedb5a2dadb64a950f76a14db5822454768db471dcdd1545c5231536b856b0b6c9ac9f58a7fdcb9274802e77872637be0916952ee76651d3e9190b0f191b7462396fe98e61a8a9803ab27a510ebecd8c93dbe349cba7114b20c9ef31ff3c414d2d23a2b766aba1687fe28a3dfab874bf221388b1aa9811d69838d4311084becfbe0d3c67330b8ca8618da46ce4373b5b918ec0fa6cdc680752f3ce941d8a657b61676280259bf18ffe1a1a47f1756fe4d0d8ae49d2d2101b27d2b8e944e64687e5fe4da77d0c9b5d5366e17f9a15aa4753bf84a8308f9d464562a4d4e1d70bd729178a9f44d27e0b9ddcc9a827e2f6b198598607db3a23c47bbf1c43e26995a81aaf2fe537dff93d74277b992fbfb3207c4c1735d502e6ef9c89adbfc214c76c47e004c6f45c41e2dfae5421a214ea006c5588f35b31b6cc6fa55d3e196f50562b446e78efaf9364a870db92d5d99e8811a6790ab0e851a49bc862908cfe0f32bba99024f97da8331a1ec9a65e0f2b8f53f222dd3a5f364a80c0b80325e12c89a1278d427ee66c0ef3915f3aaa758b4fea8e460dc8f64107a15176d1b95489f3cefe0d993ed77d7003cb0d9c531b29f1dc442a46ee962fbd689210019461bfc386b8074475a9499a3c22c648a56302e782bb129db520a8b5c0badaeb755080335ff89a631e5e2b3b3d1c54c2ccc757561c916721dab82c846426c5beec116f610e0d2fa9d493e62b4e5a4c4d29694f266e4c6565841a558aa175d37aadf5e90ecc73df4d911d283229e163c2a865dd1c30b0515709ee84d21bdef4190e54c793ed0e91c40cf8cbf542ab9088143f5b1be3ea93ebc1a708d8a9b52f268f8b3e9c636bd427c0fb7e601a3c161712b05385c06f1b6c020fc26d562f5481fd0fc6f43bf34bc9da06f1aacbaf3740295da035a0375575a8cfba5628fea079551ed7c5bed31da7b571767bb91ca3849086e01dcfb148d8404f229d3af3fc0cd9956957157efc90f18ffeafa0f3d00bba0820e1d70f69b1dc8680e2d21053d6cd6333c0f4bf2345a841c809436527be23b1ac11c120f3073f87657e2f0cb1714d3243b8be7f128cbdcb472a9f7f6db7345bf53f3abc57027ce4ae0efd064490346ff13524bbf4e2711f77a8f183f56d8f573d3cce501c0fdd2f646d94cdb5459ab33d0733bb4f952987fa21aee5861bfb050560ec73166dfe2fbd46b45eee72f1a9e775cb13d0cacbbbe47c00244e5fe543acbae97ba1a92aa7ea1ae9c8fbd82cda1c9b65c53610c843f1a21cab51f796e70f324ac3e6a7fb91d3615028ed51af79b3cb7a0eaf45243b3462c603907652f3a7e86c38dece90061511441bad2f839fb99cc75fd54256e8833cbb04995b1c0424bc4a385b36ef28da7e6f58f7f6ece692c2086551e89849957373324afd4b59b21d4f3acceb3cea496a5bb936e013aca57a10cfb931debdf768493ca9048d77241ffde9c50023ec89b0bdaf800118f31f7bf74101ccacc67fea30c34fe9f4365674f03759a9021ad53863cb6e6abe0f8a9d3569b33b6e096aa18ae890820cf10a59999bdc294e550b5e4773a4732c6a67136e1c1dea01e45b0ba100ac18dc40cf55c2317854e4204686f2d39efb55cf52792ec8c933c652d914fb4d8ba43e09f64d4bb71c3fff4c150d8010c55f4b5e7bfc40dc88f2a0c686150ce0b001910b9596b60dfa71ec2d14dd18f529200291900a54405f9ec90e66304e5a33c0e0d6247a0ce2cbd7511956da6b1085966ae2f95faf9601363de1d3a52da79920538c1c32f95edaf9b7529fbd7114aca01c231e71f16de2825db2660386ff3dc667f4c9742b59a7f980015a315b46498299f6ce3a9ef979b790219b29a48eba3b0a38d4f68a61f3dd532ca852fb839a1c4d27f74b34147d02eacb24189e8b8a921c6a214cbd2870f3c2d4879aae3b59deb54faac8d8ab2799f59580aaddb42ad8ce21aaa1d0c51e99cfaff35812e591e087ce75f311b613e9745cc9370ae7412d53930b21c94ad8a6622ac06de2b19225587b1129099b4d45c7f96ec3f2072cc16550be6770564a86225d0d3b73fb53a2aa788160aa86d8c52cd1aa150266550f64af4c7a86f5e98945b42950f94a335f9afd72893f42f3941b42bb7286bd071c7e7a144423963dfdc7104323cd1bf9489906589741a9a3ff35ebb565c1028bff94c40c8aa9cf3b728873c4aa1f332ec066219190d4019bfde2043d1636f5a26587beb31972fa3069df6aa00b829b84a7219dfbdc5bdb498b27e8a01c854581e675004546850100b9ec34357fd1d46b9e3ec1e5311b77594fb1ba3cd1d65740e756d96fa7b29eac4a867e453e5a5eb642cbee9da2e3d191cb5f4e9a231c61cf8616de42662b6a60160349952c027952ff3ddd30408a7d8646afcdcc4a5573339f1762d5aac4e5c59b9bd258b537967a582ccc642c838d414b6b7d68ae3b1f1430e279ce439222dbbce573589ce8a062aadeb6287a424f28b0dc1fc8259d84ee7269904bbe415c82f2e131503c834b1d527af9775520ab88ddc34d2650047d1c8a532f9d0ea53b1b902c49c9cd5beb238d9125cf61ca096e0481efa3120553f30f978a9c9d73a0d9ec1738dea927bc8b0d47811d62af74306e4bb30fceb31bbbd7333ecff53a35d501ddc6a6123131e69e09937137b368835d6c5237bb7e0f9bd3920835108bc371da500beb98181fd9dade25140da12b553c6c22a7eacc1499c17b9fe42804d7afe4f708a096a7b67e1cad0d29777aa86c4be1286133b88d0b6e6a5e2aee68fa70481a37677a86af52e9efc12bae56ec7fba301c7d356a626e497ad66e34f1a22710fa5ed67b94cd009bfe586ddffaa50b4f18afaa62842aceb53dead7f1c51af58bdb9c8caad630aa47ed7bba54598ea149eb50f54243af0c82a33961e7ac6a32ab3bd088994b5820c702d49047957d014861d65ecb33b1fb873cdd9f5556b392b4b8aa409d5d38b38e0d0a14dcdf6634f42fd2aa64662ed809875cc541f8ec71f77e8ed6dce9ac6455de8cd5119ede350aed932c6714bc317a62161e1b06eedb0cd030fd56efadd001f42398091226c153de8e22228dba856198913e8607d19535a60d2e2a8551bcbb5e767c40044e62d6cd982525db289df31cf354af787a62597f16a73307242b492f4f904566c249210257083dd2c697a8c25e68dd4c03370638765ad89421a53a3718785205836d875e9581f3dc6353167a41bf994a5abc0f98addbaddbd62a0c936e2b616e4b61a558a7e7e21e0acfc1a9c3257f3a1e293d1c43052cd9be07384f0765e575eeb69e29a47fc4b95f880340d11822697139e7bbb973476c965bda3d6458e1a57f646ed381cfdd224caa1d1e58c85538625916257f0e2db083815303feb2e6ed81ca3445a4dedb5a0636b8847b9a7b4dba6e6153b6608852374ac29f3177e82475f35cfc744202aae3bd688c90c00caaeb12d88bbd3749de19c7cde2b6f4edfa3740e0e8b5dbe1464028eff92e6bb776d94f409d73aa5657c2c7a7878e2a0718fbd8ceacb6d22643a3f7be5265601b09d79c992deeef205daca075ced66b0909a23fa429e06027ed2ee220d91c407d29b468658fff2b29a95a7f0123a4b83a41b7a59e37fae1943be745946abd5d935cdf947bdcbf226d9170f3bf82d5717c6bb9d95a599a79708e4707820fbd3c57879cfeb1fc001f1392b9fb865caeb113c875c05296661bf7723b4b99c415561dfc9b0b3f0b602ba50dcc939898d9ad22e4daab44661ac152ddbc06258c64e65f51202d0505ce3e2a337acd398d14c330f84e02cf37b28294394dbf869f3f87ce9cb72aac073c12a03b5d71ca72a06ca073dee042aa36229e78b6234e29a8f7edda6b2fbe6fbf92c58eaa96077bcf3f0a96abe33cd3cadbbe12883c2abda5a931f6f308a8feaa0dc2d414a5ece1ea6f7241ca2a7b2850107ddbe20d38070d5d72db9ed8e6b1570ae678a9e94097565c44cb8c8b35fdb5240751474e9cf4775430b5a41125b5df2ee9b8663075e4fb03c356a60196d2e5fcf4332819b61debb2bd7fa3c011d1b3720e9134813f9a870f41daf5245d467ef3fb76e6d076c71b47fb6d848559007214f7cd9c47de08"}, &(0x7f0000000040)=0x1008) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000080)={r2, 0x69, "5d4063e7f3424ab0dd8e3c5bbe58e7410d17c8886c479b10e5f5552cf2495b4d07be57aa8493f88abb7d0e0aa5372ca13235bd89abfaef2a9528fcebf7212c4e0026fe2dd61934ece67a90233bf6a503ccf506c1b964d222fa0a264ddc8ee56fa5a075634d9aeccbc5"}, &(0x7f0000000140)=0x71) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) ioctl$EXT4_IOC_MIGRATE(r1, 0x6609) r3 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r3) [ 1661.055640] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:57:26 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110020f30501000b000500000000000100cf", 0x1f) 12:57:26 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) socketpair(0x4, 0x4, 0x9, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = accept(r1, &(0x7f0000000040)=@llc, &(0x7f00000000c0)=0x80) r3 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20ncci\x00', 0x0, 0x0) ioctl$DRM_IOCTL_DROP_MASTER(r3, 0x641f) syz_open_dev$admmidi(&(0x7f0000000180)='/dev/admmidi#\x00', 0xffffffff, 0x204000) ioctl$SNDRV_TIMER_IOCTL_TREAD(r2, 0x40045402, &(0x7f0000000100)) 12:57:26 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c00711003ff30501000b000500000000000100cf", 0x1f) 12:57:26 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x900, 0x0) setsockopt$inet_sctp_SCTP_HMAC_IDENT(r2, 0x84, 0x16, &(0x7f0000000040)={0x5, [0x8, 0x1000, 0x3f, 0x2, 0x5]}, 0xe) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) [ 1661.150943] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:57:26 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="73797a319ddcecce339c547360566475683291c8228f9536a7ab0cd8343f4ea4e3606fdaca739692b5d0f37dd0f1d881361fec9b032bdeeaf352e457a4e454870e909deeeaa1b6acf34ea7040000000000000013854eba0c29183817256a7eccaf9338796c5eb7a65aeadaa0b9da8ea8eb0284ce9b681cc5fd240b78ec9d0cf1b5e7bedadd901f460096473d6a2246017eee1cd82bcd56b038fbb7cd8e385a53c0fd481cb67e8358a279a6e14f629b6f7fcb07171b45c2da9e0533fdf7bd7a44f63d4393a2770013fdfa4f64ed87f0984f521da6ba07c8e00b6265225ae026554d9a"], 0xe2) r1 = dup3(r0, r0, 0x80000) write$P9_RWRITE(r1, &(0x7f00000002c0)={0xb, 0x77, 0x2, 0x8000}, 0xb) sendmsg$nl_crypto(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f0000000140)=@del={0xe8, 0x11, 0x202, 0x70bd28, 0x25dfdbfd, {{'drbg_nopr_hmac_sha384\x00'}, [], [], 0x2000, 0x2400}, [{0x8, 0x1, 0x3}]}, 0x80}, 0x1, 0x0, 0x0, 0x5}, 0x4) bind$vsock_dgram(r1, &(0x7f0000000300)={0x28, 0x0, 0x0, @hyper}, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) socket$can_bcm(0x1d, 0x2, 0x2) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r2}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {0x0, 0x100000000000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0xfffffffffffffed5}}, 0x1) [ 1661.280231] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1661.733482] Bluetooth: hci2: Frame reassembly failed (-84) [ 1661.739825] Bluetooth: hci2: Frame reassembly failed (-84) [ 1662.937722] Bluetooth: hci0: command 0x1003 tx timeout [ 1662.943236] Bluetooth: hci0: sending frame failed (-49) [ 1663.017736] Bluetooth: hci1: command 0x1003 tx timeout [ 1663.023206] Bluetooth: hci1: sending frame failed (-49) [ 1663.738002] Bluetooth: hci2: command 0x1003 tx timeout [ 1663.743525] Bluetooth: hci2: sending frame failed (-49) [ 1665.017759] Bluetooth: hci0: command 0x1001 tx timeout [ 1665.023152] Bluetooth: hci0: sending frame failed (-49) [ 1665.097757] Bluetooth: hci1: command 0x1001 tx timeout [ 1665.103181] Bluetooth: hci1: sending frame failed (-49) [ 1665.817955] Bluetooth: hci2: command 0x1001 tx timeout [ 1665.823386] Bluetooth: hci2: sending frame failed (-49) [ 1667.097794] Bluetooth: hci0: command 0x1009 tx timeout [ 1667.177757] Bluetooth: hci1: command 0x1009 tx timeout [ 1667.897924] Bluetooth: hci2: command 0x1009 tx timeout 12:57:37 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:57:37 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x100000000000000, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) 12:57:37 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110040f30501000b000500000000000100cf", 0x1f) 12:57:37 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[@ANYBLOB="0400"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="8100000000000000000800000000000048ba1dbce81bd52a"], 0x48}}, 0x0) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x101000, 0x0) write$nbd(r2, &(0x7f0000000040)={0x67446698, 0x0, 0x1, 0x0, 0x1, "e16babeb4cc100d4aa6fc4749fe813c58615c86de97a29"}, 0x27) 12:57:37 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000002c0), 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) setsockopt$l2tp_PPPOL2TP_SO_DEBUG(0xffffffffffffffff, 0x111, 0x1, 0x0, 0x4) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0x4000040000800) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f0000000080)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f00000000c0)={0x0, @in={{0x2, 0x0, @empty}}, 0x7000000, 0x0, 0x0, 0x0, 0x1000000000055}, 0x98) syz_open_dev$mice(0x0, 0x0, 0x2) 12:57:37 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) [ 1671.778967] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:57:37 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110048f30501000b000500000000000100cf", 0x1f) 12:57:37 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000000), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000080)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) 12:57:37 executing program 1: openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x200, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x1, 0x0) getsockname$packet(r0, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000000c0)=0x14) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f0000000100)={@empty, @empty, @loopback, 0x10001, 0x0, 0x100, 0x500, 0x1000, 0x200040, r2}) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) [ 1671.877286] Bluetooth: hci1: Frame reassembly failed (-84) [ 1672.014092] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:57:37 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) pwrite64(r0, &(0x7f0000000780)="0ff6e5f1304049c6c3a2e962e83b8191e4b4adc94d9796410ca1c84ca4b7ec1e27f34c02bfa08142cfb374256a774ef2003e4c9cf6e07e4c997e5682572b5b13edcd18c9f944f0e0d8d6c969b80568d9606708e3686bf5297f7908ac5d91d715d4d9b94e063e93b881c00033f67580dde28ca63df03b283aa73c5dc37d20f72e34f4dcec926e4e54f6e1b0efc86ad31e82c92c7a5acf7ed4355a85e23743fe85b8052616f63c642d9c498227b846d6b20d6298da00abfe6ae20886828080e1674d6275ecf1f89aee707458db645b15da279deef07dacd4b95a128d3bae5d6f537677dc90e5aaee638c48c665a6f56e142ded9ed218d1df13f366945b7b47479a328b9e414449957dc81b12785d386f19317fe096e835485ba7cf054f85431ca8e68deb70a725af2516f43fe59a874d1a20520e22ae0b65a1ed08b69aa945655241d7e800c13b5d8fbaf4666cd1cf222eb8b795cb1539f22bf3904533adab2cc5309ef015b0acc3e98984555edac74c0306cfeb7ee5b9b869a943c5ba08413f754be0a599ed0938521dc93c23a929db337fdb5d8ba5ca9b18452a5a66b3be6acb4c9bbe02ddcf7e055e11c73e3815f8eba303e086c0bb6b41ba2b5ca31f8798c46a60b11d56470592c76aced319ff1be330b3a5282e1cd543863ad244e3d44aa68e359906c8f7f7549e836f42914813f0abf104fc2f15222b6dc664004aa31b13d22b5d2b8a831ea05d0bc4ce3c63a68e36f3af3f2bfabe53081648133a7762c4eb6a7e0912ff17b406931bc64f59ed8b6c5b2dd3846cabc4ed84deba0fb878f72450f3dfefc4047dd25cfc0d49f425d34ac7146848a41db6c50ebae359acb632249da9c60b5f00b6ceddf32e6e2e3d117ade683ead46eecf8b52d0f916c7e573f652d2aa1e67fc871c1e693031563440b4987d9b7a6c55d1d0734b944f043dc90097a556d095ab74ee0e93136b1c98ca33557e276dd3f9fe7e66bd24d00f2bcdc55d52e6c45473ed02bb5e5218a0647a50109da1587e81adcf242d4cf4102e4fd70d9f38977c70cb25372a9baeb7f2cd6fbab0f4d647cb2daf2465a6858fcdcbf5d207fb399342be74efed1d47205628756b065dd788ee01a9e48e444e1dcaf3f0ace0a037c6e82fc860f1ad6f50518a61da5bfbb6e7b971c694cec924bfac630249eb137e72cf370db4e985b07dcca6e5c3220bb1cfd8f8e366b87755908e585fe80959b2de21e5d1d787171cc8c5e7b1053491fc54baa885d32c78718ad7239f664e0f635c6c05c4cb376b8163e205c6057580b68409ea8fd3b8127597a975179c993ed6d8fc10c537e01d637133f5809663bb90c3c09f05334141bf98e2c969246a2ed431bc8382d3c598ec1c13319db0db38a07cbe1c30c77667945816b05bf6aa8baa90d09f760b48d676cf44ad2a359945023294b6f67f9ede5918833f692ebc8ec4544d293e76639ebc7e7b70ced558c8b6a5d4fdead0930da4e0e5c08827895da4dc1bb56b77b7a7436a01faa796d50ebc0d0a6f699aa4d581baf6dfbffbe023f2ae3c58f436d65f1237af585407461a28a09d3dfe71b53428cb919fd142eeac8ecf6f3504a735f4dbfb1fc54c0e283553713129fb1aebc28e7e8cb152300f46911308c13ba19a7bd15f16437fcc39d27b0f215a89a2854623f95b0755b9e56445ba01db478ce102069b6af33d2b05e1e3f38ec11f7f1b39c91aa35893295d6f1a91798e7cf862b06ffca95ca7d1621775c30148d653cddb60d1900a846f5bfaa09d04da3b9af7a8bec898ca48d89124f70062a113c2a098dbb3994544d08c69daaea782c48a9309faf2e3b694e7562a61be53cb90fb9b33aee84b40ce20bc1d1c2a92d7b94923acae085b36d026c9e1db2689eada98c4abb871bad90847ce6c8b2dd92fa69435538c7487669a70efb76bbddbec7c5adc5cefdf02a52a5c0280ae6b5f122ceb8efc557ff4060bd89fc6357dd0181992ec8412a6ef0f712cae60fc3ba0f98aedc75a12e008ee8bad2bc52e4b84cf56096bbe3b7ec2198d6adfb8454b462e0e732736c4f0a040ca78c596331eb3e542ff03379395f3c9dc4684b7bf05d96098a79637028f02555dc7bb59c3d539ff62a970d33b472049c2f6e0c574e1c8c6130dbe4f3f42d7560ffaf0117fa98794aef3ad6d3f673eb067e11768fcf31127d9f3df04090ea919dba78b1c2c9b4dacb605cb52a2dcbb4ddaff162a5c1e42d59f55948750c119e8f1aa595d9ada47c39e2fb0b705c4b9b62c7ab27472acc500f6236f3b7bfc1fe50ea18cd19f1fe3cfaf44728f6c0fb3f19557feb40cb9e71962dff999da6a50d17b8325b92583694ae2c0f933dd3a3f7d2e943543a250323c90d1392fef13a096a6463b6b6d06aa0a942fc3481509c0c7e96cd11e736ba379052c687df5ead61721d3850859e28845a0c4a7500255907182b9245466a354b78d78f4df32b25a40d7057cd728f12fd57a846a25b58e4054856c0e4d6ccb9774a1fc254232518a9f15fcc95cd4953b52689954e1489a492d10f45f35cc8084ce2090f6b408a95a7bdb6dc3fb5c8ab431a7f42da91ead663d433816a5ada62acaa518b63b4f4b39621e3d168ced5e6618286d30f459e1cc9e574ca4f9fb9eb5825e96d76e809e8f028fbe9fa975d44ed8c296bb4aee144163b59a0a677f46a2a859424e6d814fc648d9eb825f735f847715fe13a78126aa1ef238a041e3b85a2293066ca73c387110a3f776106a2c3a0dd4557cf1a1a9eca9dd75b3c6994636519eca824fbc9d6f5a38d9233ddc4e5720d3e188575cf890007424533474b8f4b5312ec1fccff65c9b49227f5ad137bc6e4a79fc078521c2cc6d86657813c9eab9c341df7c05be7dcc02b1313d98f09aed7e0cbb60c0f56b180af5b40ea71bc34ac590cf19d2e9db13a5d58b93547f66c7ce24c78949fc7337c26024830036eb4dd93e2c2f382003c404ff91da7be7a58c7415ecf1826f94fc58ff028b6eb6247925e7bc6f363037db98475d23a2823364760b0316d6bf4ef6e4a6269b9d86fc27cca29ac558982e1d0b40b73702cdf358ad2495f04a3d9da147ef15df7eb53524cda98563699b0e9cc84b953b1c2a7cf95144be716bf5ee9d8b566be8bd2f2d31304390f7eec18efb4a6a4752e67d16e5951159ee5f708e05b2368e2ff6c367ba00cc7b63c2adc90b8399dd78b7dd03d7752a629e370f738b307f6622aa03734d3f83a9ec1b26b76813a8f2d37ebdd37fe8878af486c5856639d4d0a5a83c699f19e689b14b960d8ceb90fd0df02f60630e6de0d16f625a5dcdca29f136a837f33fc303f93ba43c4a3c3e384d742f0b65d14364e2be79758930134cfea5125b478999571f430d0faaf9215cd620aa088c127ac8050a7f5d48d0f77d29a4275153f46cbf0cc0313b2964a7a1822651b8a41cfa4bb973bfd5715622e664de2c979871645fe53c849fbbde5e7c033de4cd5e91fe9ddf44353966e86d4490dad2adda8f29b33e0ffbf77e5b2affe0bd0b08efc7ec8e7f0c2f24439555d1c69988256f28e47edb3e26b867f03596018f7b3b7cb81374fd896dccbb4324dbc13112ff96dee1d19ed6a81f1782a68fd04fe51047a3bc754b9508cf95dec66f8b1ab50e72496ad74691f520be405d11acf3ff5c3d81a23ee6a9db9781b13ec472c6e5e49192d06aafc7cbfea47f4c24fa29f317816c3ccb881bfd70a9d1a1b74b175fe8cfa7b1c069a03b46783b6250e5ee40ffd95345fa1815ae251a9fae3003f2e4f4ce1de2939beee593021d5b8ad1a90aef2077bbf509083368fd8a882aa2b8129f91e3482a84d97683da71e7fc614c84b80bae5d55e154d080f8bbe0e9eab9615ef3454d6ed40f7c11d2ae4691e7130d3623e6933f89fe5df2db2582c69c67ba32d59161b1e7183a4d30844d8cd3948de1d394bdd4c918dbc7ff57051414b6c49f09263e76de9998099506d95ff8ecad0b51da9c533d93c546aa6dee8f4d007c16418b34b4640c230319ff25195508309aa483a35936b620fbd3f4ce8d07705bba5c0afd05009473e61b1b8eb77c4fc9bd5abbf46ea2bf3b562f23e66fcefe9c4156051628e6aed3668351c3753508eaded15631a5462f26a27f4c0b07f92158e019c0ddf645ae223b10aa9dbc21335247033cfdb402fe494360cc474dc17ae0fe2ee47ab531ae447da53cc2d69fd1c47771d5472ae8fd4f00b4edbde6a273a8cb42a5067c98ee647b7a1a18b70994c2ee716d0e5378546cc4e2ca2c70360f65602b90a69fffba39875683c604edee205e4fd0dd1a24a6edaca3526ab26aff2b265337f3a2104db897a65dd30952f984223107c31dbb13d3fff1024b693aca99889b7a8ddb63398b43a2d56dcf4d58096cde2d1ab3c0933167996ed0ecb3de2e9fc388027f975c6e87eb088acf1c83abd872707efa8f6d602e2a40f74fe98e4f609b3c8d93444ade52d9d6b3b6bfb40fe4e4137a61bdef7e69454ac04e8feb175c283b2d77373c50e4e2dc5db7fbf97e9661bcffc3a02146a4ec4f6f10830718e3dad3a6ad7ccefdedc3adf04177b591616a6baf03d12f1eed4f47f30dedfeba941e2295b0cb2443c73b163ea2d4e273811e879f1e9247147e1b284a1ca9ed89900b5301a9415ee76fe23e54fe1940fe85d7e785afa732233711dfae69bdff8db24197fa61f49b2ac71d8b4fcbfeeeb837d5b08dd5f7e1cdb1538747bdc2b35777677f75972d3825a5ae3894327d4701bd6e2fba17d9c02b6768249c0937078bdefd3fdf01cbfbe161ebe6fba38041c00233815dcb9872246edef11d9f85e123b4feb1e75c942777f53503a0ef3c969aa03a388fcb270a9189c0c86601b63bcb507019c7de6de1f297686a641657bf85bce0cb95642e583723d8b06a652756b3dba05fc10057140862c07b07eb5f4dc4739fcf41496cb7252c11a91dbf4013f6e866819395b2a595a23f12bc2916d8dd8beb4fc8dbe0f1c6c314461e37c42dc28c42fb7ee5cdb4822429b9e46c4ffc358dcd090803a88aa2483c298c1679f93e2c69529db75decb0c873d4b54d3a8277fe8788c2e35f449cdeb5da71f13ea6bafadddc2d25c45c5c48cc6b3e515285a2c9e575d2eeec9afc086fdaa8ca41e2a72c4d14ceb9d1124881eb2f2989f85765dbafdb5a04a7b9a784b4559865a3ac67133927246d19500acaccb2fa6f98090354bbc1cfa270672668f8816ddabad51f361bc813f204b24d335f2d97b35abfa7a97e8acd88729f498c06395617f4865f4944e3442cc19ddf222c637f86e8d32e264b1f59516eb84232a2b7cbf07aafad60af2d6286944b0afe03c560dc744ff8dbfbe1e25185300edaed00614b142e3505c718c7001830d5a9a071fe193042c4244842bf1f0614586e7498c9677368e0106073b684d1a57865f62d6b03cb0a5aa99819556ee67cdaff0f67e2a34cf51695201c398d07a30cd7f4f37d46d3b228d8827dfbbf6cd8db77701787e83fdc15ae1de61f134cd409df46c4d9c10b40687f13d3c476ecf5495a609998e7898509a773a93d4fa0d181c40f032197545be43dc3c6fc1c4ee7025d511370bd23f0816bd33159fcda960cd5a08cb4ea21bc938d65d5dfecb3301ab657fb36cfbae69ea5e95e8b99835300347301ddd758b48893caa1afe39fe50cbe13490305670b882cd7337cee78e5ad783542a707871550e8983ef98a9025d4cac669c616183fa068f5c3c0503377c777455117b80a9aea15d15c7df6584f54ae590ad7266fe31e64830a4217330f7619ea7b8428b437db7fdfa2bd233bf7d2890f", 0x1000, 0x0) clock_gettime(0x0, &(0x7f0000000000)) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0xfffffffffffffed9, &(0x7f0000000080)={&(0x7f0000000680)={0x4, 0xffffffffffffffff, 0x0, {r2, r3/1000+10000}, {0x77359400}, {0x2, 0x0, 0x0, 0x40000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) [ 1672.089504] Unknown ioctl 35084 12:57:37 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c00711004cf30501000b000500000000000100cf", 0x1f) 12:57:37 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)="1e040643ac7cd44f756034367067e94adb86319c066d4ab758d6c56d687f9540e13cae0ca5f4eafbd15a38a5f940fc18530826b5ecb2b81fd0c482785869817af9e4a491dc6b6fb10a2dc438d89c82cabeb60f8815ad9e29d979a693ab0220fe94fcd35abafc", 0x66, 0xfffffffffffffffd) r2 = add_key(&(0x7f0000000100)='trusted\x00', &(0x7f0000000140)={'syz', 0x2}, &(0x7f0000000180)="ff394bc40d0b82fc09f504b7268427bb843e389c6f0a725437db88077e7b07bd2624a0a32c058fbcdad0c1b7a0e8977799c7681e1c26847e4d89d48f88e7c3f45529d69b0389e5a709966772e97511845eefe566f221a4b2cfe23c0f522babcfc32d5a63cdce90a77f2bc88f4636ed455807502d210eafe23eb527cc587b634f3e3c1b1a1d8c5ed82a2cfd3bd3a98a384bd445b35d7b4fe29fe10aa3f65fb03953b214a1ef6d036319", 0xa9, 0xffffffffffffffff) keyctl$negate(0xd, r1, 0x9, r2) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) [ 1672.151366] Unknown ioctl 35084 [ 1672.272420] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1672.654962] Bluetooth: hci2: Frame reassembly failed (-84) [ 1673.897701] Bluetooth: hci1: command 0x1003 tx timeout [ 1673.897728] Bluetooth: hci0: command 0x1003 tx timeout [ 1673.908444] Bluetooth: hci1: sending frame failed (-49) [ 1673.913994] Bluetooth: hci0: sending frame failed (-49) [ 1674.697721] Bluetooth: hci2: command 0x1003 tx timeout [ 1674.703195] Bluetooth: hci2: sending frame failed (-49) [ 1675.977741] Bluetooth: hci0: command 0x1001 tx timeout [ 1675.983078] Bluetooth: hci1: command 0x1001 tx timeout [ 1675.983151] Bluetooth: hci0: sending frame failed (-49) [ 1675.995684] Bluetooth: hci1: sending frame failed (-49) [ 1676.777735] Bluetooth: hci2: command 0x1001 tx timeout [ 1676.783132] Bluetooth: hci2: sending frame failed (-49) [ 1678.057726] Bluetooth: hci1: command 0x1009 tx timeout [ 1678.063159] Bluetooth: hci0: command 0x1009 tx timeout [ 1678.857753] Bluetooth: hci2: command 0x1009 tx timeout 12:57:48 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110060f30501000b000500000000000100cf", 0x1f) 12:57:48 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) fdatasync(r0) syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x2, 0x40) 12:57:48 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r0, 0x6612) 12:57:48 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee68, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000006c0)=ANY=[@ANYBLOB="200000001e00090100000000000000000700"/32], 0x20}}, 0x0) r0 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r0, &(0x7f0000000140)=[{0x0, 0x0, &(0x7f0000000100), 0x0, &(0x7f0000000100)}], 0x492492492492805, 0x0) socket$bt_rfcomm(0x1f, 0x0, 0x3) 12:57:48 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) 12:57:48 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x202400, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0xc000}, 0xc, &(0x7f0000000140)={&(0x7f0000000280)={0x130, r2, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@TIPC_NLA_NODE={0x18, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x5c}]}, @TIPC_NLA_BEARER={0x74, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @multicast2}}, {0x14, 0x2, @in={0x2, 0x4e21, @remote}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'eth', 0x3a, 'nlmon0\x00'}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}]}]}, @TIPC_NLA_BEARER={0x90, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x6}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'eth', 0x3a, 'ipddp0\x00'}}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80000001}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'eth', 0x3a, 'caif0\x00'}}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffff4b2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9f}]}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xa952}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x40}]}]}]}, 0x130}, 0x1, 0x0, 0x0, 0x4000}, 0x20004000) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) r3 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video37\x00', 0x2, 0x0) ioctl$VIDIOC_SUBDEV_ENUM_MBUS_CODE(r3, 0xc0305602, &(0x7f0000000040)={0x0, 0x46, 0x3009}) 12:57:48 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110068f30501000b000500000000000100cf", 0x1f) [ 1683.309950] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:57:48 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x1d, r1}, 0x10, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="04000000180400000100010000000000", @ANYRES64=0x0, @ANYRES64=0x2710, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0400002001030000c0020200002ff91c893e943772"], 0x48}, 0x1, 0x0, 0x0, 0x4004}, 0x81) ioctl$sock_TIOCINQ(r0, 0x541b, &(0x7f0000000140)) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) 12:57:49 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCGISO7816(r0, 0x80285442, &(0x7f0000000000)) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) 12:57:49 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) 12:57:49 executing program 0: getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, 0x0, &(0x7f0000000540)) r0 = syz_open_procfs(0x0, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x0, 0x82) r3 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x85nG\x13g\xa6\x05', 0x0) syz_open_procfs(0x0, 0x0) pwritev(r3, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r2, 0x4c00, r3) sendfile(r1, r2, 0x0, 0x20002000005) ioctl$LOOP_CLR_FD(r2, 0x4c01) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x401c5504, &(0x7f0000000300)={0x100000000, {0x100000001, 0x80, 0x1, 0x4}}) clock_gettime(0x0, 0x0) times(0x0) iopl(0x63f) fsetxattr$security_smack_transmute(r3, &(0x7f0000000080)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000140)='TRUE', 0x4, 0x1) ioctl$sock_SIOCBRADDBR(r0, 0x89a0, 0x0) write$P9_RWRITE(r0, &(0x7f0000000000)={0xb, 0x77, 0x2, 0x3}, 0xb) ioctl$PIO_SCRNMAP(r0, 0x4b41, 0x0) ioctl$KVM_SET_VAPIC_ADDR(0xffffffffffffffff, 0x4080aebf, &(0x7f00000000c0)=0xfffffffffffffffe) r4 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x40, 0x0) getsockopt$inet6_opts(r4, 0x29, 0x3b, &(0x7f0000000400)=""/4096, &(0x7f0000000040)=0x1000) 12:57:49 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) r1 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0xd6, 0x101200) ioctl$CAPI_CLR_FLAGS(r1, 0x80044325, &(0x7f00000001c0)=0x1) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r1, 0x84, 0x5, &(0x7f0000000280)={0x0, @in6={{0xa, 0x4e22, 0x6, @mcast2, 0x3}}}, 0x84) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) [ 1683.461466] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:57:49 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000780)=ANY=[@ANYBLOB="0400000000000000000000000000e600", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="002000010000000000000000481a00000000000000e9475b8437baffffffffe9ddcd5e719cfabcf640c584c9d3efe7b9aba3bcdd67fd360602ece0cbdc8b90d6347548a2b0846274ee31ae8d3e1f7033b0419098e52e5799d087f0b178cf8e73c1c1c7fdaed1a8002824a0f686ca15dff8cc83cbe19d01cbd4957dee775b78bcf313274a30caa6ccba764310bc3e168611c701a598a341609f02d11169449b3fa29c3e926fab527953e648ec2022712e1b44646c1392e5b33fa064275f20ec6950d71e309a2f33edbd57ae98b709365d49827c8ea6844263a6c032b7545e3a5f51cfbcdaa1dd2548955754f469265f18073b2cfb36c7585a36e6c0b71bdbc5aba3071bae3e870e18640685288551d10f39c1f86a835a2740b5098f67ae0be0cb3329167d7478830ade05ce9351a30ea245f7b7da958e398822de243788a45b080851d5e5d0efd417c01bfc0740792c4298e1df5d7a31b55d54f7c8c3e715e1b2adfb5fa53b84360ff7828989b89de07034d1d578679483b0ee642cc7b98772ef20e81a77da999a5f93fbdcfba40998cf78081b5b365dc888ba6b55ef964d2db0cd4939c63e6a8c2540c01e2ed63779d21f14aba2293e39480d211bee9f7bc9ba6cb7fd591f"], 0x48}}, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$KVM_IRQ_LINE_STATUS(r2, 0xc008ae67, &(0x7f00000000c0)={0x1ff, 0xffffffff}) r3 = shmget(0x0, 0x2000, 0x0, &(0x7f0000ffd000/0x2000)=nil) shmctl$SHM_INFO(r3, 0xe, &(0x7f0000000100)=""/166) 12:57:49 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c00711006cf30501000b000500000000000100cf", 0x1f) 12:57:49 executing program 1: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x3, 0x2) ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000040)) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r1, 0x540b, 0x0) r2 = syz_genetlink_get_family_id$SEG6(&(0x7f00000000c0)='SEG6\x00') sendmsg$SEG6_CMD_SET_TUNSRC(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB="14000000", @ANYRES16=r2, @ANYBLOB="140027fd7000fbdbdf2503000000"], 0x3}, 0x1, 0x0, 0x0, 0x4800}, 0x80) 12:57:49 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) [ 1683.668604] Bluetooth: hci0: Frame reassembly failed (-84) 12:57:49 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setsockopt$inet_dccp_int(r2, 0x21, 0x4, &(0x7f0000000040)=0xdb, 0x4) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000080)=ANY=[@ANYBLOB="0400"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000000001000000000000000000100048ba3cbce83ad52af342cdaf264bb5312c96e2b91952a5de70622d189ac8545933ac2e781d46b20d682b2fcd11d72d7deb1e0df54266161c44da9051b89501a8da3f07"], 0x48}}, 0x0) [ 1683.745356] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:57:49 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x301, 0x0) ioctl$BLKALIGNOFF(r1, 0x127a, &(0x7f00000000c0)) 12:57:49 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110074f30501000b000500000000000100cf", 0x1f) [ 1683.791915] print_req_error: I/O error, dev loop0, sector 0 [ 1683.820874] print_req_error: I/O error, dev loop0, sector 1024 12:57:49 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000000)=ANY=[@ANYBLOB="0400"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000000001000000000000000000000048ba1dbce83ad52af1fcf899c41285bffcbaa5a9e5b781eb465fe728f2ec5e7f151170a83f1f6bd8d76547605f3c7f3b603d022a237382e8d25497a8b6f90acd0fd48c75e0d2612d7fa83649323dd32d5937e9b0d01d3dde289dd8ac88ff3289d411681e56fbd86f58ea2a8a9af6c1042aaa23e6c235f8b732c72fba4c33221ef771987350db443b6553065a1f60b6749bf3dc8a5e7a66eee127a34dd19f41af8e3635cdb9186e99adbebd947eee860e586b6bfc4c840dd9"], 0x48}}, 0x0) 12:57:49 executing program 3: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x800) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, 0x0) setsockopt$IP_VS_SO_SET_EDITDEST(0xffffffffffffffff, 0x0, 0x489, 0x0, 0x0) readv(0xffffffffffffffff, &(0x7f00000001c0), 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) ioctl$sock_netdev_private(0xffffffffffffffff, 0x89fc, &(0x7f0000000300)="45dd94b80393d9b37cfa2874c5a794395097027729873aaf59eb8cfb70912429cc4f99e74dcff258a2a19c3f15d933d989bbbd69a3106153") ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x89a1, &(0x7f00000000c0)={@local={0xfe, 0x80, [0x600, 0x3ef, 0x0, 0x3f00000000000000, 0x100000000000000, 0x0, 0x1103, 0x0, 0x0, 0x0, 0x0, 0x6]}}) ioctl$sock_inet6_SIOCADDRT(r0, 0x89a0, &(0x7f0000000100)={@local={0xfe, 0x80, [0x0, 0xfeff0000]}, @empty, @loopback}) mmap(&(0x7f0000a60000/0x4000)=nil, 0x4000, 0x8, 0x20810, 0xffffffffffffffff, 0x0) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000200)='/dev/qat_adf_ctl\x00', 0x0, 0x0) ioctl$KDSKBSENT(r1, 0x4b49, &(0x7f0000000240)="f6d9f95adcf31e0303052573e578ab762ef82244022ba5556ea627f22183a44dde258f2440cbcde93fc735b24c0b5ad281b784cbf31304502d329e74de2bf3aa7d3e7352f70aa2b8b054f140c9b4f596f1498ff449dfa8e83c152ca7828892177b4d58d7f6aa212ca0a871d8ebc9e36755aafaaa6778fc8a08650b9af9") tgkill(0x0, 0x0, 0x1) 12:57:49 executing program 0: 12:57:49 executing program 1: r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@l2, &(0x7f00000000c0)=0x80) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f0000000100)={0x40, 0x8000, 0x401, 0xfffffffffffffff7, 0x0}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000180)={r1, @in6={{0xa, 0x4e24, 0x9ff, @mcast2, 0x4}}}, &(0x7f0000000280)=0x84) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r2, 0x540b, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$PPPIOCSCOMPRESS(r3, 0x4010744d) [ 1684.015709] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1684.090352] QAT: Invalid ioctl [ 1684.234849] QAT: Invalid ioctl [ 1685.737763] Bluetooth: hci0: command 0x1003 tx timeout [ 1685.743286] Bluetooth: hci0: sending frame failed (-49) [ 1686.457728] Bluetooth: hci1: command 0x1003 tx timeout [ 1686.463133] Bluetooth: hci1: sending frame failed (-49) [ 1687.817739] Bluetooth: hci0: command 0x1001 tx timeout [ 1687.823183] Bluetooth: hci0: sending frame failed (-49) [ 1688.537739] Bluetooth: hci1: command 0x1001 tx timeout [ 1688.543275] Bluetooth: hci1: sending frame failed (-49) [ 1689.897821] Bluetooth: hci0: command 0x1009 tx timeout [ 1690.617789] Bluetooth: hci1: command 0x1009 tx timeout 12:58:00 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x10000}) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$KDADDIO(r0, 0x4b34, 0x1) r1 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x40000) ioctl$NBD_SET_TIMEOUT(r1, 0xab09, 0x1) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:58:00 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c00711007af30501000b000500000000000100cf", 0x1f) 12:58:00 executing program 0: 12:58:00 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) 12:58:00 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x15, &(0x7f0000004480)={@initdev, 0x0}, &(0x7f00000044c0)=0x14) connect(r0, &(0x7f0000004500)=@can={0x1d, r1}, 0x80) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x8001, 0xc0) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000400)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, 0x80, &(0x7f0000000300)=[{&(0x7f0000000100)=""/162, 0xa2}, {&(0x7f00000004c0)=""/227, 0xfffffffffffffeab}, {&(0x7f00000002c0)=""/22, 0x1}], 0x3}, 0x40) openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x8000, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000003c0)={'vcan0\x00', r2}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r3}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)={0x4, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "48ba1dbce83ad52a"}}, 0x48}}, 0x0) 12:58:00 executing program 3: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x73, 0x0) lseek(r0, 0x0, 0x3) [ 1694.830602] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:58:00 executing program 0: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @loopback}], 0x1c) 12:58:00 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110ec0f30501000b000500000000000100cf", 0x1f) 12:58:00 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000480), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x1d, r1}, 0x10, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[@ANYBLOB="0400"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="0000000001000000000000000000000048ba1dbce83ad52a"], 0x48}}, 0x0) 12:58:00 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e21, 0x0, @empty}, 0x1c) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4e21, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x6c, &(0x7f0000000380), &(0x7f00000003c0)=0x8) 12:58:00 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) keyctl$join(0x1, 0x0) [ 1694.909344] Bluetooth: hci0: Frame reassembly failed (-84) [ 1694.998033] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:58:00 executing program 1: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x24000, 0x0) ioctl$TIOCGSOFTCAR(r0, 0x5419, &(0x7f0000000040)) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r1, 0x540b, 0x0) syncfs(r1) ioctl$TIOCGPTPEER(r1, 0x5441, 0x4) fcntl$dupfd(r1, 0x0, r1) [ 1695.811900] Bluetooth: hci1: Frame reassembly failed (-84) [ 1695.817771] Bluetooth: hci1: Frame reassembly failed (-84) [ 1696.937731] Bluetooth: hci0: command 0x1003 tx timeout [ 1696.943169] Bluetooth: hci0: sending frame failed (-49) [ 1697.817810] Bluetooth: hci1: command 0x1003 tx timeout [ 1697.823402] Bluetooth: hci1: sending frame failed (-49) [ 1699.017738] Bluetooth: hci0: command 0x1001 tx timeout [ 1699.023245] Bluetooth: hci0: sending frame failed (-49) [ 1699.897787] Bluetooth: hci1: command 0x1001 tx timeout [ 1699.903240] Bluetooth: hci1: sending frame failed (-49) [ 1701.097765] Bluetooth: hci0: command 0x1009 tx timeout [ 1701.977726] Bluetooth: hci1: command 0x1009 tx timeout 12:58:11 executing program 5: mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, 0x0, 0x0, 0x0) mbind(&(0x7f0000024000/0xc00000)=nil, 0xc00000, 0x8001, &(0x7f0000c28000)=0x800003f, 0xf1, 0x0) 12:58:11 executing program 0: r0 = msgget(0x2, 0x0) msgsnd(r0, &(0x7f0000000040)={0x0, "8bbfdfb8db1f83ac0400000000000000f0"}, 0x0, 0x100000004) 12:58:11 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$VT_DISALLOCATE(r0, 0x5608) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:58:11 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c0071100e0f30501000b000500000000000100cf", 0x1f) 12:58:11 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x0, 0x0) ioctl$KVM_SET_CPUID2(r1, 0x4008ae90, &(0x7f0000000040)={0x4, 0x0, [{0x80000000, 0x8, 0x4, 0x6, 0x1f, 0x1, 0x7}, {0xc0000001, 0x4, 0x3, 0x401, 0x3, 0x6, 0x2}, {0x8000001d, 0x3, 0x3, 0x10001, 0x8, 0x1, 0x11}, {0xc0000007, 0xf6, 0x7, 0x3, 0x7fff, 0x1, 0x3ff}]}) ioctl$RTC_PIE_ON(r1, 0x7005) 12:58:11 executing program 3: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x4000, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r0, 0x770a, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r1, 0x5437, 0x0) [ 1706.357079] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:58:12 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) r1 = fcntl$getown(r0, 0x9) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000040)=0xc) tgkill(r1, r2, 0x7) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:58:12 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) [ 1706.399261] Bluetooth: hci0: Frame reassembly failed (-84) [ 1706.414135] Bluetooth: hci1: Frame reassembly failed (-84) 12:58:12 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000000c0)={{{@in=@dev, @in6=@ipv4={[], [], @loopback}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6}}, &(0x7f00000001c0)=0xe8) mount$9p_virtio(&(0x7f0000000000)='em1}ppp0keyring*k\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x10000, &(0x7f0000000280)={'trans=virtio,', {[{@access_client='access=client'}, {@cachetag={'cachetag', 0x3d, ':\'cgroupeth0cgroup\\'}}], [{@dont_hash='dont_hash'}, {@euid_gt={'euid>', r1}}, {@smackfsfloor={'smackfsfloor', 0x3d, '/dev/ptmx\x00'}}]}}) 12:58:12 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c0071100f0f30501000b000500000000000100cf", 0x1f) 12:58:12 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) r1 = fcntl$getown(r0, 0x9) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000040)=0xc) tgkill(r1, r2, 0x7) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) [ 1706.556688] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:58:12 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110002f30501000b000500000000000100cf", 0x1f) 12:58:12 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) readahead(r0, 0x2, 0x10001) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x2, 0x1) setsockopt$inet_mtu(r1, 0x0, 0xa, &(0x7f0000000100)=0x800000000002, 0xfffa) epoll_create1(0x80000) ioctl$TIOCMGET(r1, 0x5415, &(0x7f0000000040)) ioctl$IMGETVERSION(r1, 0x80044942, &(0x7f0000000080)) 12:58:12 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) [ 1706.671209] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1708.457788] Bluetooth: hci1: command 0x1003 tx timeout [ 1708.463177] Bluetooth: hci0: command 0x1003 tx timeout [ 1708.463216] Bluetooth: hci1: sending frame failed (-49) [ 1708.474530] Bluetooth: hci0: sending frame failed (-49) [ 1709.177717] Bluetooth: hci2: command 0x1003 tx timeout [ 1709.183188] Bluetooth: hci2: sending frame failed (-49) [ 1710.537734] Bluetooth: hci0: command 0x1001 tx timeout [ 1710.543081] Bluetooth: hci1: command 0x1001 tx timeout [ 1710.543130] Bluetooth: hci0: sending frame failed (-49) [ 1710.554765] Bluetooth: hci1: sending frame failed (-49) [ 1711.257720] Bluetooth: hci2: command 0x1001 tx timeout [ 1711.263168] Bluetooth: hci2: sending frame failed (-49) [ 1712.617843] Bluetooth: hci1: command 0x1009 tx timeout [ 1712.623268] Bluetooth: hci0: command 0x1009 tx timeout [ 1713.337773] Bluetooth: hci2: command 0x1009 tx timeout 12:58:22 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETSW(r0, 0x5403, &(0x7f0000000000)={0x80, 0x80, 0x3, 0x8e, 0x15, 0x1f, 0x20, 0x2, 0x4, 0x4, 0x139, 0x1}) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:58:22 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110003f30501000b000500000000000100cf", 0x1f) 12:58:22 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) r1 = fcntl$getown(r0, 0x9) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000040)=0xc) tgkill(r1, r2, 0x7) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:58:22 executing program 1: r0 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x200, 0x24000) ioctl$UI_GET_SYSNAME(r0, 0x8040552c, &(0x7f0000000040)) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r1, 0x540b, 0x0) 12:58:22 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:58:22 executing program 3: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff020a3b54c007110000f30501000b000500000000000100cf", 0x1f) [ 1717.209731] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1717.223954] netlink: 'syz-executor.3': attribute type 5 has an invalid length. 12:58:22 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110004f30501000b000500000000000100cf", 0x1f) 12:58:22 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_dev$admmidi(&(0x7f0000000040)='/dev/admmidi#\x00', 0xff, 0x32b100) ioctl$SIOCAX25GETINFOOLD(r1, 0x89e9, &(0x7f0000000080)) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) ioctl$TCSETX(r0, 0x5433, &(0x7f0000000000)={0xfffffffffffeffff, 0x0, [0x3ff, 0x80000001, 0x0, 0x4, 0x4bf9]}) 12:58:22 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) 12:58:22 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) r1 = fcntl$getown(r0, 0x9) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000040)=0xc) tgkill(r1, r2, 0x7) [ 1717.308738] Bluetooth: hci0: Frame reassembly failed (-84) [ 1717.339745] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:58:23 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) 12:58:23 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000000)=0x0) r2 = syz_open_dev$vcsn(&(0x7f00000000c0)='/dev/vcs#\x00', 0x32e4180d, 0x400800) recvfrom$llc(r2, &(0x7f0000000100)=""/45, 0x2d, 0x20, &(0x7f0000000140)={0x1a, 0x4, 0x4, 0x401, 0x7c1, 0x1, @dev={[], 0x13}}, 0x10) rt_sigqueueinfo(r1, 0x1c, &(0x7f0000000040)={0x30, 0x7, 0x6}) ioctl$KVM_GET_DIRTY_LOG(r2, 0x4010ae42, &(0x7f0000000180)={0x12717, 0x0, &(0x7f0000ffb000/0x4000)=nil}) [ 1719.337738] Bluetooth: hci0: command 0x1003 tx timeout [ 1719.343127] Bluetooth: hci0: sending frame failed (-49) [ 1720.137794] Bluetooth: hci1: command 0x1003 tx timeout [ 1720.143188] Bluetooth: hci1: sending frame failed (-49) [ 1721.417806] Bluetooth: hci0: command 0x1001 tx timeout [ 1721.423303] Bluetooth: hci0: sending frame failed (-49) [ 1722.217749] Bluetooth: hci1: command 0x1001 tx timeout [ 1722.223158] Bluetooth: hci1: sending frame failed (-49) [ 1723.497762] Bluetooth: hci0: command 0x1009 tx timeout [ 1724.297750] Bluetooth: hci1: command 0x1009 tx timeout 12:58:34 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x10000200002, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0xd28a82aaa6b1686d, 0x0) ioctl$CAPI_REGISTER(r1, 0x400c4301, &(0x7f0000000040)={0x2, 0x8, 0x8}) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000140)) ioctl$KDADDIO(r0, 0x400455c8, 0x0) mq_timedreceive(r1, &(0x7f0000000080)=""/61, 0x3d, 0x1, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:58:34 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110005f30501000b000500000000000100cf", 0x1f) 12:58:34 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) accept4$x25(r1, 0x0, &(0x7f0000000040), 0x80800) 12:58:34 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) fcntl$getown(r0, 0x9) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000), &(0x7f0000000040)=0xc) 12:58:34 executing program 1: r0 = openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x446000, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x7, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff}, 0x4800) r4 = syz_open_dev$vcsn(&(0x7f00000000c0)='/dev/vcs#\x00', 0x0, 0x200) r5 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) poll(&(0x7f0000000100)=[{r0, 0x2041}, {r1, 0x400}, {r2, 0x4}, {r3, 0x2000}, {r4, 0x8}, {r5, 0x21}], 0x6, 0x3) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r6, 0x540b, 0x0) syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x3, 0x2) 12:58:34 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x2) [ 1728.740612] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:58:34 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110006f30501000b000500000000000100cf", 0x1f) 12:58:34 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x2) 12:58:34 executing program 3: 12:58:34 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x1) r1 = socket(0x4, 0x4, 0x1) bind$vsock_dgram(r1, &(0x7f0000000000)={0x28, 0x0, 0x2710, @host}, 0x10) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:58:34 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) fcntl$getown(r0, 0x9) 12:58:34 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) ioctl$TIOCSERGETLSR(r0, 0x5459, &(0x7f0000000000)) [ 1728.900497] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:58:34 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x2) 12:58:34 executing program 3: 12:58:34 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110007f30501000b000500000000000100cf", 0x1f) 12:58:34 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) 12:58:34 executing program 3: 12:58:34 executing program 1: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup\x00', 0x200002, 0x0) r2 = openat(r1, &(0x7f0000000080)='./file0\x00', 0xc0000, 0x1) ioctl$VIDIOC_RESERVED(r2, 0x5601, 0x0) r3 = openat$cgroup_subtree(r1, &(0x7f0000000040)='cgroup.subtree_control\x00', 0x2, 0x0) close(r3) openat$cgroup_ro(r1, &(0x7f0000000100)='io.stat\x00', 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001900)=[{{0x0, 0x0, &(0x7f0000000280)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) readv(r3, &(0x7f00000002c0), 0x18f) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/sequencer2\x00', 0x109000, 0x0) openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x1, 0x0) ioctl$TIOCVHANGUP(r4, 0x540b, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@empty, @in=@remote}}, {{@in6=@mcast1}, 0x0, @in6=@local}}, &(0x7f0000000240)=0x451) [ 1729.172561] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:58:34 executing program 5: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x2) 12:58:34 executing program 3: 12:58:34 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c00711000af30501000b000500000000000100cf", 0x1f) [ 1729.398217] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1731.017858] Bluetooth: hci0: command 0x1003 tx timeout [ 1731.023353] Bluetooth: hci0: sending frame failed (-49) [ 1731.827725] Bluetooth: hci1: command 0x1003 tx timeout [ 1731.833149] Bluetooth: hci1: sending frame failed (-49) [ 1733.097780] Bluetooth: hci0: command 0x1001 tx timeout [ 1733.104349] Bluetooth: hci0: sending frame failed (-49) [ 1733.897789] Bluetooth: hci1: command 0x1001 tx timeout [ 1733.903216] Bluetooth: hci1: sending frame failed (-49) [ 1735.177749] Bluetooth: hci0: command 0x1009 tx timeout [ 1735.977759] Bluetooth: hci1: command 0x1009 tx timeout 12:58:45 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x2) 12:58:45 executing program 5: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x2) 12:58:45 executing program 3: 12:58:45 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c00711000ef30501000b000500000000000100cf", 0x1f) 12:58:45 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x2, 0x438080) write$P9_RSTATFS(r1, &(0x7f0000000040)={0x43, 0x9, 0x1, {0xc68, 0x7, 0x7ff, 0x3, 0x3, 0x8, 0x6, 0x80000000, 0x1}}, 0x43) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) 12:58:45 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x4000, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:58:45 executing program 3: [ 1740.261004] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:58:45 executing program 5: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x2) 12:58:45 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x2) 12:58:45 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x8000000000000, 0x0) r1 = dup2(r0, r0) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000000)={0xfffffffffffff208, 0x2, 0xfffffffffffffff7, 0x0, 0x4, 0x8c7, 0xb16, 0x1fa, 0x2, 0x1f}, 0xb) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) sendto$llc(r1, &(0x7f0000000040)="51ab087dac53d2a0d5004e39", 0xc, 0x880, &(0x7f0000000080)={0x1a, 0x302, 0x40, 0x1f, 0x101, 0x0, @broadcast}, 0x10) 12:58:46 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c00711000ff30501000b000500000000000100cf", 0x1f) 12:58:46 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x2) 12:58:46 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0x20008000000f) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) ioctl$TIOCGICOUNT(r0, 0x545d, 0x0) 12:58:46 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) [ 1740.526612] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:58:46 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x2) 12:58:46 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCGDEV(r0, 0x80045432, &(0x7f0000000040)) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) ioctl$TIOCMBIC(r0, 0x5417, &(0x7f0000000000)) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000180)='/dev/dlm-monitor\x00', 0x498001, 0x0) ioctl$RTC_PIE_OFF(r1, 0x7006) r2 = syz_open_dev$dmmidi(&(0x7f0000000140)='/dev/dmmidi#\x00', 0x9, 0x4000) ioctl$SIOCX25SENDCALLACCPT(r2, 0x89e9) ioctl$TCSETSW(r0, 0x5403, &(0x7f0000000100)={0x7, 0x4, 0x1, 0x27162034, 0x8, 0x7, 0x8, 0xffffffffffffffff, 0x8, 0x6, 0xffff, 0x2}) ioctl$TIOCGLCKTRMIOS(r0, 0x5456, &(0x7f0000000080)={0x9, 0x8e, 0x6, 0x6, 0x9, 0x96, 0x1, 0xffff, 0x1000000000000, 0x3, 0x2, 0x7}) ioctl$VT_RESIZEX(r0, 0x560a, &(0x7f00000001c0)={0x2, 0xcc74, 0x2, 0x0, 0x4, 0x7fffffff}) 12:58:46 executing program 2: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x400000, 0x0) r1 = accept$inet(r0, 0x0, &(0x7f0000000040)) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x1ff) ioctl$TIOCVHANGUP(r2, 0x5437, 0x0) fcntl$F_SET_FILE_RW_HINT(r1, 0x40e, &(0x7f0000000080)=0x3) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS(r0, 0xc0385720, &(0x7f0000000100)={0x400, {0x0, 0x1c9c380}, 0x401, 0x2}) 12:58:46 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110048f30501000b000500000000000100cf", 0x1f) 12:58:46 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x2) 12:58:46 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) [ 1740.756295] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:58:46 executing program 0: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x2) 12:58:46 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x400, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) 12:58:46 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) 12:58:46 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xc) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x200000, 0x0) accept$ax25(r1, 0x0, &(0x7f0000000080)) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:58:46 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x2) 12:58:46 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c00711004cf30501000b000500000000000100cf", 0x1f) 12:58:46 executing program 0: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x2) 12:58:46 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x2, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x2d}, {0x2b, 'pids'}, {0x2b, 'io'}]}, 0xc) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r1, 0xc0a85352, &(0x7f0000000100)={{0x100000000, 0x1b0ad176}, 'port0\x00', 0x1, 0xa0026, 0xe6ec, 0xa09b, 0x8000, 0xffffffff7fffffff, 0x71, 0x0, 0x4, 0xff}) ioctl$TIOCSLCKTRMIOS(r1, 0x5457, &(0x7f0000000080)) 12:58:46 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) [ 1741.141633] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:58:46 executing program 0: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x2) 12:58:46 executing program 3: ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x540b, 0x2) 12:58:46 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110060f30501000b000500000000000100cf", 0x1f) 12:58:46 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f0000000040)=0x4000, 0x4) 12:58:46 executing program 2: r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x42, 0x0) ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000000040)=0x81) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x0) ioctl$CAPI_CLR_FLAGS(r0, 0x80044325, &(0x7f0000000080)) ioctl$TIOCVHANGUP(r1, 0x5437, 0x0) 12:58:47 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) 12:58:47 executing program 3: ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x540b, 0x2) [ 1741.357032] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1741.389414] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:58:47 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) 12:58:47 executing program 1: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) 12:58:47 executing program 3: ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x540b, 0x2) 12:58:47 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110068f30501000b000500000000000100cf", 0x1f) 12:58:47 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) [ 1741.590440] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:58:47 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) 12:58:47 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x2) 12:58:47 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) 12:58:47 executing program 1: r0 = creat(&(0x7f0000000140)='./file0\x00', 0x0) write$P9_RREAD(r0, &(0x7f0000000200)=ANY=[], 0x5aa78d33) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fallocate(r0, 0x10, 0x3, 0x10fffe) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f00000002c0)=0x10000001c) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r1, 0x540b, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0}, &(0x7f0000000040)=0xc) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000080)={{{@in, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}}}, &(0x7f0000000180)=0xe8) quotactl(0x8, &(0x7f00000001c0)='\x00', r3, &(0x7f0000000240)="2058dc889a50fc4e8b6f727b1aecec178cb943b191d1793af5d59f5fc400b786a8c5bf312b6db465b5d560c66868902dfe4c004a7aadb61aa455ddca13dbb5f8c1035be0951a6aca49e48be8b4326d2e791fc89ac306bd6f87f62bea19b371444eaa129c5183c80cd23dc9a30a060d207bdccbb15aaf9452ad6c445ed9") setreuid(r2, r3) [ 1743.497815] Bluetooth: hci0: command 0x1003 tx timeout [ 1743.503327] Bluetooth: hci0: sending frame failed (-49) [ 1745.577911] Bluetooth: hci0: command 0x1001 tx timeout [ 1745.583360] Bluetooth: hci0: sending frame failed (-49) [ 1747.657739] Bluetooth: hci0: command 0x1009 tx timeout 12:58:57 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x4000, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040), 0x117, 0x5}}, 0x20) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:58:57 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c00711006cf30501000b000500000000000100cf", 0x1f) 12:58:57 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x2) 12:58:57 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x2) 12:58:57 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) 12:58:57 executing program 1: socketpair(0x11, 0x6, 0x9, &(0x7f0000000000)={0xffffffffffffffff}) r1 = syz_open_dev$audion(&(0x7f00000017c0)='/dev/audio#\x00', 0xfffffffffffffbff, 0x1) ioctl$EVIOCGBITKEY(r1, 0x80404521, &(0x7f0000001800)=""/65) sendmmsg$alg(r0, &(0x7f0000001780)=[{0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000040)="623fbb5f0c6411fb1df1bb734a5a6d20db21dbba4779c4362d7fa8293db6ba661cc9a796673b0db16438957d51694356febd57f09b2c6182a407c92ba49233a9f36dcaa922426be938480fa17f058f0b44fe78922a2d60c6cb76a50786bee7c2d1f8efe808bbecd0053fe05ab4eef32bbbac88480466052476670f1d2af47a4145d73bca298c80cc0fb4c9b11d08cd599958c2440cad6053eb326860929b8c312b2a8a813cec01dc0d1f9c2dc43c8ed838ce532ccdd9", 0xb6}, {&(0x7f0000000100)="5d3d32cd6040626de3b021639eedd6449f02543003a8a1716aedb26b9d1e5faa40ddce2df557f437d89a8fff94f09825ab40dd59a507f48673754b651ceaa05fbcaa653e5fdd5fd44c511145dda5504dbff83b5086ecf5dfbe6bea5740ca1723432fb329e477240b57644c6c14af4bea318baaeb6c9b276d0aa49e8a6aa8c27655d39a065e5880169224", 0x8a}, {&(0x7f00000001c0)="7eb8d521f4f94e29807991f2a72d3935595d2f4452ac6b30547a252a320be5936a0e1108257366458ad550ab07eebc", 0x2f}, {&(0x7f0000000280)="6c39672c34d6791f84dee626e26e4b195dc3e303d2efe262cf7a2640e36521e903c5f3b0ec05c265b055c5e9dd9a1c2999f2dce680ea7714cb7c26d80cac5f7cf7fa0bb3ba7e7f406a0a478d22a2792c908a14c3da931f728edb9816d738ffb43ead3030527c04f31c1f200756c17ae87385f6d59031503889514264d8e41fd84c57186e56786ea2b78d31e5d25b47d4b9122eeeb3e87279b158155de483a7495b54cc18b72d519e508f53be98c48528f146b894818a16d188aebde87b89ac65bd5fca394bf463675d15ffb8554ef2e7edcd972723aa64f6216375ed279b06b4d47fdd499a86e0e3b94d51b4914b31774eebb79d07d8512f9b01e47a85a9ca978eb931622921aba69ff8416e2acafe61bd02b6b996782c78dcdbce825343f0ef2126ef88960699d5cf992449834f4f5a31126672b57b11076429e7f0173d60e7a03ef963a467ad490dbb652f94f87d65bbd754c0a2aea93aecf2524cf427c6ef939fa83eb854d56549c9a5c2a258050f69085e4d391fd69d4cde632db4b715651adce688701c627c6213d27f51d9c12df8e985dcabe451a7700bb9febf9f27d131f645fc4ff44bdf5d617a78fcd259ebe85ea9fc1c5fcec3083d42be5bb6233069ce15e589d97e4da9233dbd7c6b21d111fd3c23df52e8e9dbd36164d440ef51a49832d587000a39437375bacaccec5474ccbb2ecf867bc0a22537a9f55c6355ba7e9ee1817efd5c87ff4e518f35f4b4c919641ccfc54819b04397ccd8d28c75b7909dbd17eff9430a001f3eb1d1fbc61015203db2167f2ac777c75d7fddac7e9e84bed1a209f637319734cc83814c71f0c5b260a82f3dfdf414a9217c917de99e230489971ccd2d18d31934ba3f4124b377a37a2e9ab7a4e0700a8927c34108d45cb94a52fc8586f211c841c7d1e1ae58f7c26773e8312ef989ecdf2bb056b827049d3f5a2b25bbb1b899dca138ccb85b46ba208f6f66d9baf67751b1fc869899188ffb792052eae229449880d59e97b55fa3a517da11089fec8815a19c446e29296c929c4ef5a0760cb833c01b14a863d387e6bef97abb9158d0593e711548a840e5735b2025cb4ff5e3d06d7a84559b7212206b984f860b44e8c9da3b9ab1139453af11322da62fb0fcec1bcbba79434eb8c0677ce61aa780ed46dab886cf46ee5fbac392f93977192c58a9b054fb695521c5aaf43992381511ba754e19da2b2228db8154d5dcf63682d3eb7bf33aeb55dc9b01c494a909e7556c78ab2f624ba2ff3980c770873d04ba8dd8761d731a3bce6ec66303e9afd902df7f28b882ed515a66ce20313eea5eb980d7a81511907bc43fed046511ae03048d0368285f570485727564d5b0a260b819a9b60befa1f765c91b4fbd9ec94656f950953bb9739ce814c27a56741b726bd9ef62c93c57ae061777eef565ab300b78d3e8ed469fa9d0d6db09d9d71c0cd1cd2b985dfea6513d01d229e32e0891b43e8691aaee23b0589bf9e9e5f9a948016535fb0dabaf50b73202f91b08799015d02d0a1c5f1275243fc071b5298d1c3bb813c60cfa9c021c2f413e539b5eafc321b50d060f790837a244a750c1918667a1ef6a02e2f4903ef7a0ca6d86208e025ba678f0aacb8812f48afa089faa2825073e737240786be0b14f00f138ff0462396a84f5bcf7d90c7178bc9b3581e4a68661cc9aa9489fb203950c1e2652948035125592b33594055b5cba327ee5c838bfcc458cdbd7fa7eb30d2c08b520ade9dfddebbfe04b5a42b8c5a0d6b0b091871eca324493b035035bfdf3a950fe08519689451bf140f4ed61429caaa61e440cacb09fa0498c5ac95f4642e394ce945d82c9b231f717364db6212514c6584d2a34142528604dc75670750bf185e6315ea302796a36d51be25480f799921532c3d6ec41b38033995be2383a2c47825e76792a280fb53b81757750670aa391427f309c3962a2818b28a23b942e5b057a5041dc8a1c1676483f4f29ce709d361c7a1e2661f133f984497a707115af1f976f00bfc543b92ed826a344483969522b5d0ceabf805f12189fb765b24ed34b939f1cd47aa7c6cb707b33576be9145cd5686cb005907d0911300720f0643b663a35b06bfca8d77ed634ff7b7db346bada3ac156fb5ed91b1ac9081cc98a868ab271074783b431e50b9cd27c2e3293aeb789293f9f57ab6d0534db66a8ad59a922d21014d9fff84d11cd3ec41bf286f486ae0739d5a1d2ee7dff6906dfc3de0caf467bc94fde9cfd36dc18eacc800df7520a4d05ccb5c1e5dc325943755d45c221aa97bed9885329037037ec12124953532ca2118827b507798347a134951334458005c147288653da27228c218ed7a407e0853de936cb662e7a424945d6e92d4ceda72943c103a91ec309ec259ba3cc5a4f82c6ccbfe0bb4a0767e297e49818154d1219f0cefa6749bae35fb573e05ab2348f86d75d9b560a681cfdc5f109a25f310fe4a1b05b061b06bb02288f0e648c427324dd3c20425e8783006cb6b24b1c13a5464bb755b3278b42c5b7fe0c6b3038d2d3e12cfcd1970e32de9a5584282fec9b7ed1538c407261919598279321e1e19f55a0b4d7f3ccc5da6bcdd11233dd668bf2f8b5ed2d3035c40adc90747094cd10ae0ee28fd20092d90b941c7e1548e8949320bdf6b6d23d75f6ed1b7b8acecd5b375e2315aef363b679cfa6e0deb1d6f555427f3eeb5530a56db6fbee605f79942aeaa7754da94a9c2d7ea6740802aae2fea7200be64983fb3ae3d7ec1cf122d9e9dcc3f49d0500fc44196d1d0143d37aabd581fb6230c157cfec3a75da9745ea4c7c92508590ecf5778d11795baaf31019a3edd4e3965a92ea6d6228251d7d5870d6d4aadf4f96762c17d7afa6d38c013867966af86802cccc3ad608dea928fd64c6aaca6d52def0f5138a499f0a4c0d4d7aa8f86d4cca669dc7afb15a909b9da10f4f5c9e70798181f9d48dce57914c9bfd7833ad27cc40581e148bec6e9ebc8650d2d007f639518e95621a26e19b15946240c89a6fd30e083e28cb359e722833eacb2afcebada31da347c59e5cdee234375770277b3127d26b559a668cb80fcbf6146dbbebbe36843194079da6db43e40987a5ac2ac13568ad8b9dc61350b0aeb46905e719a3c7719828990dc688e1b37230edf70d3ced0e5662c1712ee6e402d38b8974e578638c65ff6fba5b9d07317402e62aadb379160564b5813b2f31fa4f6f54035ed9a3d7c1578f7413c5a69b31da7ec8a359829cc7baa409f55653cdf84852b4ffd0e463b0d2ee1d2cbc42ee33c1121428353da669f4e4fbd399d3e4aa16ff02d669c82c8fd152118b9f7f3e516b5577a42b7ba91108381910cab52ad71dba9235aaccad0ed15fa80013e5073ea585f89239fe098ca1ce4a5fb46ff7c05f115fa8a2b1a85dc250fa223af1f986770c9d5d7c433c443669a77ffb3483e90e4a3dec559cf4a37d8978cc17ab0880e4419ef1b0c81315a5049c6bb78952c7985aa53e03cdc9842ca1e6afa8e3d06cab1fd8258e99b58d14b268db22c03fd788dee15ac4b5bcb437407247243b27811177dea48ae519875360cf34f0c8f2d9ea508f7549e1f7bd7a6db82b1e2dd81a5a569e875a1386afad738197ecaf835f257783c9a09d9b09e4bce7dd6f02294ff3aa8276579fd19e26ad86631608be818346a2011dadcbb7e24f8eefe4b277d27ffa955c6853368eb7f76f8fe3105513fc4ba50e1a589381c0ae0ca611031dc1411623940176078316b009d0fe78abb10913d8d6822e1293d540d8966c01e99fb8cd5e2a0f4079580f1de195bfdb0048e2157c17dffe3d10d204c039cc9632fb1dbb71092dadbb082f6af717889efcda50eb38d7423e5d762fcce537804beb928f32c9784c0c0cf24f614058d7dbce9c96a70b86c8ab3dfc52b20e47bd56f79647af5913829620124f9ecd2b57ef323beecd629dda0f17ad8ff007aa78d4d27a7e977a51abb28f825b408108dbcce24220426f414ecbabaf49bb3a0978a021b44d1d84bfb6aef4feca56ebcec271d5b4d96890fbd9e404d10ee108246a477dc167aef4567a34b32f6d648bbe20df02e62782596e0040158d1e2c0a35367f412f91c5eeff90b61f4e25caa463f9dffc6613f616f4796527da7233dcc513edab6cc31d3b0e1428970778d114716a51ac009ebba3c7f23bcf4aaa21a88015fe2d6b9e5ab9a892890f4549ec158aeef76e50b5aff11cd6dabb8d68d76a0afc90dda260487e72d64bcafe44792c99a6770c4ba3efdb6b2af56ace424a847a4ad16245a8340487c905f07465fa320a7c404005e1849caeb0763a9e9bc76ae4d65f6f167d8dbe1365ee24bcb22b5bbe33ca9b6ad424d57e1f7536bb2441f029ecac388d61f867fedb0359c061b1975dcab877aa922e78497573632b3e3d9e0f09e9f3e72cb80c1be1f36b5831dd16f8ec5d216811f7233d3771f22d9d268fa9ecf9fa5d3cc50ab38287efc2019fc4f6e4b9df67a7148e8e9d2bc0040b0da71365222ff010966c6e934b044e87f896f2cdd26e2eb3661f59bbe0e07a5707c1f824e1232bfa34170b1b28ca87411ab08c916b1129b64468d400260ad0f35692278e0cb8af66d944f293dd5dd23d71a86982a841e6b5381f00a0e9dfa03f1c10999b9017c5180119eaaba44d7aec24df44564a19455b254be4860615c2792533ffa0ae3b5dc1538ec95c6b7f690993def383d23abf02b6650151c36454899863dc0a1f5c2a9d9e9d228b2b67861d659ac805ba48cf346d7e30a91800ac7270f954b4c14fbf59ec41fadf9686b3c90b68f5fe3c25e2b48f55e72bf8a1fb4838888eccbfd7a0ff8c49cfefc6f44d6d1e2e6b76ce3b1a9fac07587f2e36387e3ca93d97066d2d842cd4453d91298b5af6db69853bd70958a1914652981c122f901c013a4b93d6dca7bc998d6e104edee2c5e2d826c74aae53a2184c30b6e8b44b4fe60cd29ba2eea543f98b1f74309a98b98c068a72cca67ccdbe58bbb7cf061a36bb562e140504f046342938f05872538e7aea4790b580bcc90c267beef89b94a5f54283b6b7a014cdde6d964c5fae8eb022f60efef10cb26f64a418f9e841739dda8460749a0880283c4d1bc2a8cdb5320a53176b001a7909c717f5faaad0a1dfe4996700f10339f548369a8c65a6a47a7595f4c73144f69bf1711a34227a34f03f556d52a36f73a2bbd550b55326a4f7bb596829acc4d50b69442682188f5e481a18ae5c9d1307aae25cd8ee98ea159973f50fb0005bfc7549b8a1bc68c8f805e552792204c165bc7239bef04ef04588095e5cb3a5cd00e5f40a809bad746e8bb2dbd283040fb807259f3bf3b888784234a0eb3a42b77d34e0244c247f3d42ac1fae367a836212ea61095c093fc89d0d048dc55cc86b2349021409b34760334cb25c0d728bea98c8e435f00230124c21366053ad6cfb09e9ce04776640b540b53e2eafbe64ca51a5024102eb375ae9dd2083c5472ad32781c9252dbc01c4de4fcd9a6add84013364b56c6570e6ceb0e6362fb2ad5b174f1d7b4f4c5c058bd9a31b24d0518884d2c0f75df1843db5592874128f2d5559d575f37e39a43eeb898002dbb593c74a61f79694acac9f7e29264dd5617e900a923854fa5c846008e46a4e3545cf0aec9df755e03f54857431ee0321775bd793164de86bdbb9398679d455c836fcb33217cfd5baffcd09cca2da028017ed23b016118653d67471f532b5da3b0d19be6e8cc272724ed77f7619ab315b863fd324f3593dfa266f39cfe59e4850219b397028", 0x1000}, {&(0x7f0000001280)="24579229261525d9235821de8db11414ecd9b67c62322e09fcf69c123f0274ee79a801d86fccbcc9a17b64e1980ffdbef9d1f15190a4334e98ca4c1a1a5caa0215852e55535939142b205d40cb408a315b5d0c7b74a528b9e56a4d70e42d8a119cab0b943bfc9a2922c25e3bf337641056", 0x71}, {&(0x7f0000000200)}, {&(0x7f0000001300)="d5872a35d58211c20f40e272f41e94d41946b5ad4054290f8c8f567d415d0ebfb4d55282caffda6eee86c22a04835aff42fc761300878f686f1461cfba65704371741bca4b36d22238202edfdd7e342dbef2e2c0883d8014fb3c175c6714bdf2b0ddb5002a5bf86e5e416e5f878fa6abeaec0e74bbe4d67b132eb6a0787bfefeaa7e8b0138e16693fbeb74607f58effda404c66939561cc7570cd2cb01b5d8f1f75d2868d9e6b2515007a561", 0xac}, {&(0x7f00000013c0)="d21a433eae1a461f27c012f9e644848e7bf34424de77ccf9185ac7389a8e5e9532f8ab603670631d71b4b55de562a206b54787b60af608b0757a338b6f589daa067c6752655659b3320278dc604c497a2b49e8878dafe1f67866fb8d33af8f73b7721cb1fd5d564c36efcc42a65043eb2e3ef6cab7e1a4099574fd76252d27943d71613169d1e87b2aba4b8c4d04a89e7ed09485fae6", 0x96}, {&(0x7f0000001480)="59f4521629e2d982d29ec9759fc02a505cdd5f1a695e8010e251b92c227fd414c0a8dc96868d6193532f6ebf9362aff3cbe3a17744f1dddbf1b9f6fa12b239b6ba68b42bd1667f207606551f1885c9d16eb424fbd953aeb734a0b7f980082bd6c624169f6edbb75908e580d97eeb6c0527c5799a94e49ad2e03301ad3adcb9917597916fffefb6e902321749d2d009f43ec901077f2da6e55394e4d15e2d3a8e960c48870c78c7dfd99fa89597a71cc46153ea08d18bcbb302720464a458cda1abaa79b5cf190644ccc54d6825bfdeb47138ecdfc453c2c24f3d69cb18ba004e4c75fb97faaa7d005a5f540a82", 0xed}, {&(0x7f0000001580)="f0d109f199d34f4e22dbafa14eff728dc6655620890043c8a093f3c1ee1d258e4332b9046a5e8eae0afcd49ef7b0823a913e4f5339fd329a5798ff", 0x3b}], 0xa, &(0x7f0000001680)=[@iv={0xb8, 0x117, 0x2, 0xa4, "17251df4954d1669a6b138bf6dd19e7a8d0ea6fa9ef120d867cdf781a11aa9cb1c376e9042a9f09491d0a155eaa802f19d9402790e806caa16614036001d2613de817db32cce6836bee5ab34775acb469624012a3a9084beeea7bd921058ccc02c3809ebfeee61678d344f2b386405dfb22a805f6e2a4be91afd1d287af4919b68d7493ce469bf3c0108827b49f86ccc06b519c8685de5f641201eabc47f8db4a490be39"}, @assoc={0x18, 0x117, 0x4, 0x3}], 0xd0}], 0x1, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$EVIOCGPHYS(r1, 0x80404507, &(0x7f0000001880)=""/5) times(&(0x7f0000000200)) ioctl$TIOCVHANGUP(r2, 0x540b, 0x0) 12:58:57 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x2) 12:58:57 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x2) [ 1751.815702] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:58:57 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) 12:58:57 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110074f30501000b000500000000000100cf", 0x1f) 12:58:57 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ptmx\x00', 0x81, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x20000, 0x0) getsockname(0xffffffffffffffff, &(0x7f0000000700)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000780)=0x80) lsetxattr$security_selinux(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.selinux\x00', &(0x7f0000000380)='system_u:object_r:mtrr_device_t:s0\x00', 0x23, 0x3) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000fc0)={'team0\x00', r2}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000001840)={@mcast1, 0x0}, &(0x7f0000001880)=0x14) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000240)={0x80, 0x2000000, 0x7a76, 0x3ff, 0xc, 0x200, 0x4, 0x3, 0xcd, 0x20, 0x40, 0x1f}) getsockopt$inet_mreqn(r1, 0x0, 0x23, &(0x7f0000003d00)={@multicast2, @empty, 0x0}, &(0x7f00000003c0)=0xc) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000005000)={{{@in=@broadcast, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@dev}}, &(0x7f0000004b00)=0xffffffffffffff37) ioctl$KVM_ARM_SET_DEVICE_ADDR(r1, 0x4010aeab, &(0x7f0000000440)={0x8, 0x5000}) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000004d40)={@local, @loopback, 0x0}, &(0x7f0000004d80)=0xc) sendmmsg$inet6(r1, &(0x7f0000004e00)=[{{&(0x7f0000000040)={0xa, 0x8, 0x2, @local, 0x5}, 0x1c, &(0x7f0000000280)=[{&(0x7f0000000080)="5e1a3d", 0x3}, {&(0x7f00000000c0)="d2be789a1083203b988be907db124f991cc1b45d62b3b8008e749d1e3361516ac57c8f5d067061803b05df51b8fe61f91e63be644383bf0b15ddcfef74080b15bf2298a47e780ee46b25aee80d68f30716813eb5e9ba70cbc6133475570a706a1e6567bdac4cd5f50ad2ba03ad03d30e265feba1137d265351bbb6b1074625f43d72a4bdda876ee8", 0x88}, {&(0x7f0000000180)="46a14afe623b3e18f8ef5bfb6456f525461490aef048972ca03b76953e1316037db152a8e43fd94f5282d20669c3c1c14c30", 0x32}, {&(0x7f00000001c0)="df", 0x1}, {&(0x7f0000000200)="a601f32ff7f8fd598513ed5af7dc3ebad9e65ec7a3dc1f7f5896bb7049f852fe904662819908c376b12abc56a0653e", 0x2f}], 0x5, &(0x7f00000007c0)=ANY=[@ANYBLOB='$\x00\x00\x00\x00\x00\x00\x00)\x00\x00\x002\x00'/32, @ANYRES32=r2, @ANYBLOB="00000000140000000000d00029000000080000000000000000000000380000000000040029000000390000453192b719f7d771000008520000000000000000000000000100"/84], 0x78}}, {{&(0x7f0000000840)={0xa, 0x4e24, 0x3, @loopback, 0x3f}, 0x1c, &(0x7f0000000c80)=[{&(0x7f0000000880)="ad6a5c8b75912f6ce3e84c", 0xb}, {&(0x7f00000008c0)="f6385f02377df7fc704e062711547ad1754ce14a7d437a649a382fbb72f35d74308a680ffec8b396b65647cb858ee6f92dc0b6816b533117215e4fff8e9c51b02560ef66aef944f3c92dfe11c1d33028f44c6faa4dfbfa5e2a99966d4c3fc11c3a6db2224bec9cc4ffb3724d7c4a3fee1d5fd885abde555781b03d91f55069d1eaf6c2c56539ba16b296f1ef8442110e15b10eb54717aa98dc4360a6dfaad9ac973a313f059877354f17c99a1b00608c6adc", 0xb2}, {&(0x7f0000000980)="b308cd01b7e392693f1f12e4754ac035686919a40dbfb67ad4e1e58a7395f0420857c1a029cf3c16280524974c9dfd4fb152cad4324851f17017a4c2d9cdfd797f6a6cec8ecfdea123a6dc4b4bbf656bebff12af62ce35531296eb10fda8c08272", 0x61}, {&(0x7f0000000a00)="294c67202fb83835b9d0a155932149540f403bd13215f518ae0277f36aed627fc3bf3bd39b1024af167a264c3167668c7968c06aad01b96ed1adc55bb8ccfef67730d220e8321bca07ca96fd9e", 0x4d}, {&(0x7f0000000a80)="32dfbb6189b165da15f4200b9a0cce0b", 0x10}, {&(0x7f0000000ac0)="afb78957e70cbad3ea01d37b9d9540eb823de89671256d57047950bd9464e999d4c41c60609884141e0bd96be40dab36a8bfe33edc3e3c246ffd90758ed52ab6f413dc9e4644c28cfd0490284d594e9f03b238721075bbac41cf702c8f55387c0c1b3a1f19118681e6d63c3fc30c091a51", 0x71}, {&(0x7f0000000b40)="0ac31f9ecb15852732e00970e5c766b2ccfe384f9041dd5bad14f3e37102e0fb836a9b9143fabea669d2ff8d156ce1104e0cfccaa53d3fc606f21a48fbb4a5b4f6937ea0efc14c163f6177de94fd5bde3ff5ece956764fa01f0ecbc61ffb89f9305c81d7b1c2c396d37062b5dac65ff8f1cdd4e54253b43c4cfc9e41269ab9a868ab5148d9780351e940ed52aebffee2ef4325f3e8be31c325536d820096b1b6189d8d25271b19f5d9ed95ce88d3ed0df6618c1b51486c19eb9276aa6c04ed10adcf42d10f196a03057b7af77569dc1eab8e6187110cc2", 0xd7}, {&(0x7f0000000c40)='\"', 0x1}], 0x8}}, {{&(0x7f0000000d00)={0xa, 0x4e20, 0x5, @rand_addr="f06d842269d33b21e6fce623c38144bd", 0x9}, 0x1c, &(0x7f0000000e00)=[{&(0x7f0000000d40)="916e198323b2e9c42be747113c032437434bd43efb7b25704653d18efa339903990fdf1390a75d239015c571ce2ad1f9ac1462b429887a62f6516c84e3fd3fd3fcfee0f0d62e317001d93c009391ce52428b214887b2694eaba21eb70cf36568c1e33c2fefed6ceac6d7d544efc1ecc2b1d473f9a1a5b5c771b170f69a8e5758c52a01669963bf71dfd3ee61394ca6dbfbc258602a7bbf85", 0x98}], 0x1}}, {{&(0x7f0000000e40)={0xa, 0x4e24, 0x1954fbf1, @loopback, 0x10001}, 0x1c, &(0x7f0000000f80)=[{&(0x7f0000000e80)="7b8a8c5bdfa426e7d41d4763901b6596929e1fb71877654070c6ca7a35e436dc8127ceb634a0af6c221ddbcd312772d15f8a8be906b8f2b4703ecefaa719766e80d803f648d62b409a36ba7a88ad1a1881db7f89e8553ce5d971fd53262e5a5ba8a86ac3854e607322c8b8d9a969b270394de499155186319e94c15c396130aa105c03263a2c7b6ca06ad9a4b8eda595959c156b7d0a64e3150f3cc2edf9f07f6c20d8e40020325ce4d769bd0152f89830b45e6f1cef5c84a7461c905122d35f6fcac25b40e08104e780583e46f82eba22a981ff7cf2643394978c30f380e25f731793c982dfd93c67281101b9d8080fbce0a2f30d7cdc108fad7641bf52ac", 0xff}], 0x1, &(0x7f0000001000)=[@flowinfo={{0x14, 0x29, 0xb, 0x8000}}, @dontfrag={{0x14}}, @rthdr_2292={{0x88, 0x29, 0x39, {0x33, 0xe, 0x3, 0x9, 0x0, [@empty, @mcast2, @empty, @local, @ipv4={[], [], @remote}, @empty, @loopback]}}}, @dontfrag={{0x14, 0x29, 0x3e, 0x1}}, @dstopts_2292={{0x1f8, 0x29, 0x4, {0x3f, 0x3b, [], [@generic={0x10000, 0xd0, "8934a8e73ce8fe416ee5fa58d4f27c890750a50dff57871c6eec2c592a264cfe437502cea025d0c484c61552e6d57180e458e2dacc11b3a43b48e2b8e0c0f184faa69ae725a42018957e6cf9764d6269878d9c25fcaa64b4bfece69344d8fd748329bfe5a0e2b5aa5467ea20044469a02faca8b97c7768de8385ed695089601db7253021f880f7ef858f33296bb27ab1fbe30c67cf7391b0731506e37931373092787c0722b253604d53945d13ad2b7ef34959896b4157bb5ffe5a0000e245d172e9a531acbf9674137e4edb7e3a2c27"}, @pad1, @hao={0xc9, 0x10, @mcast2}, @ra={0x5, 0x2, 0xe775}, @padn={0x1, 0x7, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @enc_lim={0x4, 0x1, 0x3}, @jumbo={0xc2, 0x4, 0x4b09}, @generic={0x5, 0xdf, "36e3bca94f969ab0b372f06d4c0468e7afdfc88323710e364b6f35a9522ea4ea963c6388cecac49e7ebcc79ad06be0c17295ea263c2505a4bf6b9612c9bdabe6047da6f7933bfab50153f88f5bb28a094d9d703e30254f9aaa95302f52f44db35d9324f81b8bc74224b6e8982301164940152c403349d53bd02ab16f72d74fed40fb8b5d1418ec3880776731590855126becb0b6c31d9b3ff08127f4df145f9152a39153f2abca5fa4d753e48aa09bfa0d64092dc5df9310485d46476d546576f7a21e73393154b48f709103e8b04aac8104710c19ce1b4a5d848a8bee033a"}]}}}, @pktinfo={{0x24, 0x29, 0x32, {@dev={0xfe, 0x80, [], 0x21}, r3}}}, @hoplimit_2292={{0x14, 0x29, 0x8, 0x9}}, @rthdr={{0x48, 0x29, 0x39, {0x7f, 0x6, 0x5fc5367853fdaef5, 0xfffffffffffffffa, 0x0, [@ipv4={[], [], @multicast1}, @empty, @loopback]}}}, @hopopts={{0x20, 0x29, 0x36, {0x33, 0x0, [], [@ra={0x5, 0x2, 0x60000000}]}}}], 0x370}}, {{&(0x7f0000001380)={0xa, 0x4e24, 0x0, @rand_addr="f37827e8f750f564cb0e1efec7366dc5", 0x7fff}, 0x1c, &(0x7f0000001780)=[{&(0x7f00000013c0)="e918250151345448997e4c715dd329b3bf068080d4ace378c565b964fadc", 0x1e}, {&(0x7f0000001400)="d493de16e39c35a13ff0e9c80f15a1c8329a2c60a200611c29f5e474a5f01310bf10232a6ad30ef2f74c893be322231e91ecfea6d57cffe106219a79fb843572bb26d25fa540ad0640da7227c598a57118c91aab72d8e946d2ca702d", 0x5c}, {&(0x7f0000001480)="ad4c73da235158f9f810c0af916ac723e9e3f59206386bd3bea241b11e253349fbfbb4f16a9729e1d6351d908c17a38bb6251d7e825a429cb41c31f1379da1f46384ae3a932bcf36c6696b0ca604f0923f01ff9ba644a4f9", 0x58}, {&(0x7f0000001500)="868abf707b2ad22eeedbeaad96cde87ddfee9efffea1187a8c8364aa8209175cdcb6918ffcee69cc701686377fff3a9ed5a35dafb2da9368bc9b01e7c73907cb50d94482087b4329f28e0af852ae6eb8e808e572c7ffe4a35da2b46258fc3c0f5bc98982ab8cee6fc03105626bf82ff3b2905baa6d", 0x75}, {&(0x7f0000001580)="4b1ee06c26068253fe144430c0935dc1114d4180112f115816e82d59175a6bd7b199a1caf6969f64dc887106aed1b14c12f0e742039bb544a1c01a7b01e40a618bc75cd2d0612a69c905a3d5b3d4a0a6132d", 0x52}, {&(0x7f0000001600)="fab3815510b077d6da4eee60bbca3c0134bbbfbd2c86240895e4ebfc1293a39fe2fc898657ad944312d6bddf8e48bb3fc7c9521c575285f5044c1acdb6f0a228835d8478c152c37caa8c099cad0a4631b87a682db306c475a80a94f154efe1962182d3f25bf8a1b25dd4689b2c9e2122f7c286195af445f45177dfab60b28eabc9d6eb591394d8e023eccf3820ebabb95efe3e602d7fc791c93feff0501bdc4b504c327426d8a88172c25c3449a069618e025a712b5f799486e009a37f722906a552f3b0d23df7f0c614dd95bd31b94677e97553f272c9b5eced4aed9535d66c3687882ceb9e12cee06cdeacb4", 0xed}, {&(0x7f0000001700)="2c909ab846b02e8bc0f42d8cf69a6ac5c7adb4a4ac27c7f344c09f4ce9a9440af31c4dfb5194e5e99200204d05fc7843420f2ee683c52b96215eff976fea7ce971ad6db6c15d06419085b0e031e742b34f8878e3861e766fd8fade210622c4", 0x5f}], 0x7, &(0x7f00000018c0)=[@hopopts={{0xd8, 0x29, 0x36, {0x2c, 0x17, [], [@enc_lim={0x4, 0x1, 0x8}, @hao={0xc9, 0x10, @loopback}, @calipso={0x7, 0x20, {0x84, 0x6, 0x8e, 0x2, [0x9, 0x1, 0x7f]}}, @generic={0x100, 0x85, "f6511386f004ab60413e5d7518830f02b251dbab22ce8278a1dbdd2dff2c7d69a944cb7355fa9de563ac28e905b5d497eb3f3372bb8020689b2cd8fdceda115427ee9ca4a56739620d70a3cdf454457233ef066ba0b58468b52fd27e396539c8998f4aeda2f78ed3a846e252b66e499fbd4f2c10b1175b418e1f432b14f11ee89313404c6d"}]}}}, @rthdr_2292={{0x28, 0x29, 0x39, {0x88, 0x2, 0x0, 0x9, 0x0, [@rand_addr="6abb741b4c323529aaac40556ab2baef"]}}}, @hopopts={{0xa8, 0x29, 0x36, {0x11, 0x11, [], [@enc_lim={0x4, 0x1, 0x100}, @generic={0x14c, 0x2d, "d13c5feb4cf211773c03b7a4ddb9527d875bd24a107e0d0c662e0fbf134d1a1f5214cb760e66c0383f70d721d8"}, @calipso={0x7, 0x50, {0x7f, 0x12, 0x8, 0x100000001, [0x7ff, 0x4, 0x1, 0x800, 0x5, 0x2, 0xfffffffffffffffc, 0x4, 0x8]}}, @enc_lim={0x4, 0x1, 0x2}, @pad1]}}}, @hoplimit_2292={{0x14, 0x29, 0x8, 0x7}}, @dstopts_2292={{0xc0, 0x29, 0x4, {0x2e, 0x14, [], [@enc_lim={0x4, 0x1, 0x80000000}, @generic={0x0, 0xa2, "182b224633f114cf63cb079afc5634130339f8c9b662cc34695e032727564c6fe266f38ffffd00f6030889809b087f43df20dbba092a5fefbc611a8376b11b78ea44e8906e8a8e85a4c89cb7c0be976966c43bcb7f05e0cdad6f2d9c8f1f47b0325e919f25a8f260982e9f5847f0c63b29966bd3d7556a595369271a25e0c8111aa8396f95de00c720df7a7f0712a7c97f52915dffa44e4f170ab0cbf7b6ab3902db"}]}}}, @pktinfo={{0x24, 0x29, 0x32, {@ipv4={[], [], @loopback}, r4}}}, @rthdr={{0x38, 0x29, 0x39, {0x2b, 0x4, 0x3, 0x2, 0x0, [@remote, @mcast1]}}}], 0x2e0}}, {{&(0x7f0000001bc0)={0xa, 0x4e22, 0x0, @local, 0xff}, 0x1c, &(0x7f0000003c00)=[{&(0x7f0000001c00)="856611fefe4de8c63e3cebfc5681b8edcd4312dc412f81ceac9f3f7b50a35be5c52e7bfb4e657e779ac5b4df8d8a0002945442976ee23a72cfe7ba3aae49f6d8c511be44208e2b7b6aa047d3fcd596a564a68b49c4bfbffff6dafb958d3ef6d28414171ce55f499ce2ad9265405d27f8fa76d66709bfd34b52019c76993c45a3b06561300fd88ae2bbfa28798cfb3f7e99e46f78bd89459e0a17a39638cc3c3b09a03aeb648386fce85a3320c6ec6ad318119aff5a46dc8ca9a01edc9d59617120554e0e977217607954c929e9a29628c695c01bbe64a270a347eef64f9de4733e765f6a2dc5d789aab2c4960311213c2c144477a84862193f249892bc9953fbfa07450fecbb6adfdbaaddda44709136c35e8ca53579b648ee9ec3ad97006fef5c607feca9f953c2cd87932b1996259782770dfc22cd09bf026bd6d3a8051d2e315219f9b537bf3a2c5da4a8c264b1f513b81bc7d55452cda1dddf7df45f0c2765cddc2bcda6672732622ed7f49e1b99eaaf365d50d7741900aeb52c6197913afb336fa01e6b8c08b4b105c49ef088b4851659f12f0dd980e6c383a814947a825eb9bf2982e8e8355b6c31270ce9e7b5254e88cb5aef110ca1b1f7ebe08483d43adc4d657e6026aa3919ceba6bbda112a37ee6ee33406477f8a7f32170d969d2515c0193f313cffbc40c6e081c2f65f58ee7b0ceff0bc59fa98a2c439e15b8ebbb7ea6a2774d97b2304ad4638972448dfed6698e7ba0f3693d52d891a179274450f36598bd3220b5c974fee1df1d27479877607387d3b8ba94521367499e1e5c22a7a2ce0268c31dd9861b08f895401026261e814fc99b5bb24769d5ca2006375c24b61914bd1b910a8cda35feac4dd96a77a91d5a4f7413c771dd7f7a5084e1c866aa85c2ce4e0edfb58d43b76299258e3dcade8359dd5bef6febb30d94c94ec5435a79805b8943212e96807daa3adf29e90284e941e8de105601bf6602bc6bc93c6a6e2aa48bf4ba34163748077c7d4a1044562551ab79acd59067f6b060517705aef6c7be221f722120801cb05802b6c1d5bf1c39b2d91367a2a6d5586a6f95c8d215518608adfaddaaf23009e9d1fc557e00e953da41524e2672bdeae465e24de4000193006dbd067bc13437a1eeda100f23fc5fa2c3fdb76b4e7ec39166bef7e18d385f5c626d58e916786bdb4b70671f4b17658102417119d8a14c913b186c360a3cb9a877059022ae455b57ca95e8caec92ca06092fce3972356e9ba93aea645317ae11419a5a9df615a0e80658d562cd53cc8e507ab5883648d490cb77a836801542940ab99318ad18bf8add06e00a30ced2282a2100ab8bdf89d19fac0515d02a50681a413e2ef65d829ba61b009aba459fbd8ca2706178cfda4278b1bab162c2b25a602bb19a2e587f64e568d1f7dd04a03f08e3f5c935149733b6bc76ea57a8056e0d45448faf90bc0e90bd1e932d046393a95ff1c88a77b4dd23ad49bbfc6010fe135a2008922f5ffd88e3c83c1840660af914b028ec9b9d09f34bdca30237cc5b66d06bc0877de4b91f4d6fc5e199fdfe06ec9a9c872c315696ca170a9799af17b24c16d5a24ae6d98f1281fab2ab3022e6c9de21c3286da0a7befb81871fb280cf7e2eaf18905db633219a5eec26cf68a594adc2e69534fc0aaefba3653616e967d796be81cb89e5b7f2962a864ab09e46522368e2ce1ff6e602bdf91feee96433b6fc36a9372c633c1755236f1f9e64308b1ebda846e263630dc6855d8993ad9c412fb318db69ffd1b57c9834bc9f0d49d01665a7c221cd2a29c34b77398de460367a7647df4f765ca0bffbd49890e47e644604f5b14c28d7cd288cbed190574ddd75291192f4322834f29fe04e0c89aae9eb88ff428fb1748d92bf03d663867d1a3531459cf3a0c0b4219bc03be9a56ece731295e0e8534fe720841667a1abf8e3978dcd91160253ec4817f3eb73f069017388928d2e4cbbddf681fc45ab9ee0ed45a055faca5b7bb7cd1f7ee7c2767d86ea7c2edc21c3752b0228964b8332d5fe7ec43b5270806d72ce47bbcab8192bd9f16e60cd5cc4fe2328a1673ff327a3d774d2ae3e25e98ccfccaa8ceaf4f39301f06e6b17d3d59e277ba93a1e31e0ff8a2815d3482ee9bc387093d92918e42752ca66fbed6c347779ecfcad7750aac7dde8c47d674cfed40a34f3194a62b70561e20556d1b1ef2261b58f252501aa25bd923c61784df343d868e2d15d8f1df9bd3feef8ebd56ce3e2e6556193a86cb45b8319e17fa77519458570c3a4156c6972e46a46dcd0a95c379f7843c6aaf7eab35d22a252ee79106d7b4d8979fb4b0ae9ab2204816e3ab09ca7457804e9864b8a0a05b8f28ab63084190fc26250a5b29115313bf304bda7575bd0564a422846e94672fa12954110e4f0e4c1934a891f709b06f16ca9074a847c65e06ae26b6541ae93b947a7ecd67f1eda4c9762d9f182f838fa1bdfcda7885053c93f6ac371c2b109fec8cd07f6388568cf0a86d674ad4d0fab08453998b7dcd5caef1380bcbd114c3184d223270ea372475e1597fceb46cb939d5d3301910454e103ae956d01978b3d8235ee06788425afc3893235447b3b8344dbb101095dc56c650b2b5e297157c961eba6225f7b1a1101a0f23dcbc02adb024cd19fdd91fca9518876a2e3e92b4a95522c491b327311d3aa285b31b753d3ef7ac64638f9391f1ad149288012bdb4f9b3966fa23c8893848d94703613094847a3ff44c2441de525e8cdc0e8c25ace2e93c471c8f31b0c40efb1f7bafbdc52e266e4293069074c633f426cb7fd6897076ffcf3939c7050545b4c6cd9ca4121e89463c9cd011a20f83643c736224e32c4775a8475a7ce3a8bb6e8495b3fe0e5208c4232f9611cb3523c5cd5f37188621b88b3ac66ff98a082083e59ad2c721a8e49d04650b00ab23a86b86e71bdf40ab987ea02cd3b913ed5f642975e7003a31058d3168221bf43e0a389bc5e5a4e84b22d98ea719d37ef8549327e29906d443596631f0e5c299162ac68cf25903e92280121dcd3d0aa470b088dd785e83ffdfb84748dfeab5798137ed0e5ee6e19cb21e3bd9eaf1bcb97ae37ca07676e0ba88965977955f79e1b3bf142f0f350f489f0bdbd45c93208c1fb915140a45208379ed8effc114137e1b637da6455dc9e2e415c7652a47ef38147ae492c18d901ea05421f999bd815743adba7d676de8233ab9fc4e8e3dcc37c709ee8d4dd685e4137821eb2df46fd187db4fdd290ce39f27a619c2722de23b0fddb5ccc70f963f50b22d23829ccdf0382ed6e7f0741e5b9c17a2050652afca21514783b67a9b710e9862e72522105d0a999680548676fcc70174f0c9beaf0c9cab718360a6e0556c9ecc54fc7466726020506f08f75c2f11759bd71c381a388a7f9a85316f123dbef5c02b2e127b2aef6a0768f6e1026c232e98bec12245a1b2245b415602af25da7d3e4c7fc748830a2da95f478bf376c943088f7f57009a0bc2d2e0eb01e2bf7d6c15c9ad6c6dc594971343429d09c9d89cb210b2e84520b8cdf930c1ca8b08ea808a2af4bde9d0d5290d7ca3fd58efb9d9cb1c2d5246b9a02ce4bdeea8027cad6abe3862c00c2e9643d5ed19637378dd4fcf3e6a6fb523d082eacb7ce6c211c585f8acd90292a86ef404813c9d9906b64081666d4991d345ece5a47494862cd4d2544ee517f4bf5d858dbae5db5db7c88440ba41a215c918791e2c444284c8f58b349496db89e4305268c0ba892d020df7c982c4f5fe6ea2f415fb41c018f503be8a00d21ce34dd0f5f6819110bfbdd62da5ed0ee726687a43938d40071b3361a05ff0d0ed1673abeab02126fafaea58b3fbd556533640d7ad558bf84e5046d03f75096531e026b4c25fd549eefb054f9f79e306b810ee761d748b91d69ce9822fe5820b6851c66895cc5817b3574d17166a652ca16754b441d973f384a7e1860351606b97440a68c45be3e2edf09178794f0adb934c2be7bb67d03239e6fd665c4f80427dddd0975e39301936d9b6278cfb12e4c83aa7235396c60eccbc396ad84a1b13eea0e580f06a5d026cc7c0e6c120d28cb15fcbb93c12cb817bcf713fea6f7ebea173ad945846373927d1bc7f1f5da6c2791689c1f62f3fd050b88dc43b1b4c1f92e6269d89dc066f501bb51cb5b3805381e7049f2879bcfc3c81be563914db1f1f3430f200d3e803c6f3e244e6a119bf8fe9b31f1d7e10c8174067891518f849ccd5a671380c5e83546d71bc6c1681418f7a7a965f5791345c2cba0b1fcaa7f581d2f0488d867b7ca432b0082adeb6b4411a03fab3d7126ac6d931ba4562ea3c652471826da1110fe70b71248e82c0b76c214fcd4ba536f5d59d7dfd9e42ec773968d0b2fafeba6d4c03cf8a186d026897ae869e808efafaa43fb436b1b7efd0de991fd020c03ac357ac661335e4676d5a98411265ae48f514e9653ba4f993a288dff61f8f292c3f04e49cc0ff28d9de63d554208f13b31e0b39974277bc36b96521857dd6776bdd69676ece45917895b1762c13732e50aaf58ce097710498a85831349a2cd36f8859f44a3296e3667d34e84caa103d182a988ff96d898b47f539742a1587ee3899f5195e5f42a7edee483b789a87234e2eac597120366ce8ae24cd4b609cd0f8a1e419f2d7b10cc98f2bea5d33dc0ad67297e7a460682bbf93dab4c5feaae50e1d55a121f5b62ab93d62b60c1ed7e9996f503ddba09987f8029782e6022d10ff25e0daed0d777149948827defe378690910a2585ef7faa786aca6e072c6ae8a6ae51e156da9126d49148335d51a9a4c3bf6b4922796496400ea16501056e599126f5b651ee7aafd526fea4b7a1776f5b6615f25ae9107f7b57ac346ca259bf3ce9e7b161243d8aa0fef40c44d9049c762899a2c2371850a5674696f72c8dc030cd72b673b1b8538149f813fa70bcf864eb57db2424a215a207f0d27ca4e05776300c550f18cb204dc10bb3461034c7be895272ed897a9eb770d47ec8f2769d92ae4a616626e3c6b07a85395c73ea49dd2523a2603bfc8c1be8c35cdc6e17b41e9d767a2c9b0181db4f8d8dd3e37cbbad156dcd2a470eae7476031937342b367ceddcc1ea37c72ac9777d12293569be555b42aae5fcc81f76cb7778606c74a2f334d3ba2da0ce265eb984de58caf38d436d8783abac3d8b5349c5b9b5baf2baa4aabaec6db10c354dbc2ff1325cba954f76c463b3e03167271e9fcf67b2a031dc9769e58c635612e802f632c2fd2154a9d119abf812dc2d6b7f9803dc75a93f5fddd4ffb6082b7fce000f97b95ccac6c545b6d7e218bb4bf61a29ee338999d92779dfe4ac134d7be405ed45030bc893758179939776c4f1e9a2e291311c87909527e0b141231af33478e700923c20d748882b2af8e73b8c6f08bbc9c3894749d237197de5072f530950c10006ecab2feeb71d7fe7a616597714c3a7935bc1b555923ebc1c7ceefc9cbcb18ba3be67796519374df220a4bfd8fe34b872b61652503965457296f9819ea2b5c4bc4c675b159b2c881a85cc8dca397e4adcf3a0019aa90ea98961c6f6b8c5ffc1d89da48c2a04e8969d07490437e54f16035f7db9bb3041b1612b618b0baf366ecd9f3930c2d6bcefd50c0dde8db2610d5f2dd5c802fbc270869939a0bea3b2e555762a6cfecb1707792a9e7b7e7f65009d17a66bedcb0c08c65cc88072e4bee19fbae8f53f4d7c2addbc92b8d3903a49e76cbaf58d6d32dac7c50175e0edbf376a35a8fdc92ecab2f85983c05a7", 0x1000}, {&(0x7f0000002c00)="d100c51a4bb4e9eecb13abcd6672cb64a7071bc252a023da2871cc16b0a234db4e744116feb0c2c88a2d6641a82d809b7c813704ea8151c45871b966d612b7a8e2a5bfa27af8aad74d5f7652a6e27913c5cffe38783ebc5817f23156a61ff9222c3f085e89c1549132c17a7dd47b7522e59bf4d26f86638e098103b7ccbdf3705f3d42179f6d6d2de5422128ba4f7684b6d0dc3050ddb37ae393ae856731796cb42323c75a680ea90a3326c980280b9c852bb19358a8f6e1cb4148cfa746d68a05830cf17a9a774b8855fec27ae60976d57acf5d2b22ebff8f7c3ef9f02b426943fecb59ca922f88e33cf8acbc9d30d3718b154d6a7092afd93e27cf578e19bbd037508cb9e2e70cb13d941d05a02c94af7d6d1a75b9320b7980d20c6f045503fe459a925f51ebe50f00300d7484f26497d8ab992d98e93a35d94c016fd2409163f68b8a83f69664f507a401f5471bdb6aef1a48242da8384a062567de637fb2a73a6c22aa0f1c0cca0c23c663b72067ecdf3ef3d060bfcff29758ecc90ef5abde00f04ef55a482a5cf84ace82e4772f56d7d393ab134c8f373040b00b06d7a1e61cf6dfc6a435dcea7cad98b0c37d3d3329d57c7922eab705d20fca6164d6dad786445c2343418cfd3bacd52ea4645f654e45ad3f040447bf18987d176b463f6db01683624639fdb6a82cf8ed57171b5dd60bf9c599908049c024d3d2cd7223b1cd0b45099178fb42744a120a86e4711d77063d3d2a5a79b598f47c1456aafd0e163c49ca364698d7018801585d1d50b18d998e6922fec6af3b8d69111923682f4730816d5b44668a4c385adc6348e4ebf3d21e762f261bfc320d4cb2f329ecdb300a65fc0e1b744cf5d38bd9a9c727b9c3fdbfc3cdea447e9723d36997926fdc2ef53ca492284afd58d8011949aa722c1604dbd0471ea19b165f21e13a8c5ad416794d8c56eb9aefad83e69385199d71e4556e1e83fc4ccf1cd353b8a9e6a97d3b875e3eceb31d788050e346d687bb76cb58b3e387d14a0e01f278922214c39da766e41aac31e98ae14052cd8df0fd1049e1666015c11c91652d932a67c4cc3f809d6562d3429ab37089a5fcde6af84e626064ee0072443c8b43f158e111eaf52a6881d8b576e2cfb45b6f621ecc8078de73676bb636d61415fb792c9ac7614f7de6632199aae103a8e74a0741ed94f445949af1000a1ea5b11c90e9f61e191b3c7f8c005e3bd859915012ecde88d96a494a7f1f2e1a94f41e0242902facc56d54555c10aeb3f944aea497585bfb2a4787c823d58dcc5e23495948d35ada0d68b8a087d266ac14a940175468fd15f649ee5e9e7a348f35a0141461491238c1d7dd06ff7e3a90c759f2e3360ad811d288bc2f57befd9da5b4d16c19f23b8165bc661a4e0e2bb12e4258d0755d0a516b9b703b11f8663c6819ca914c59a52fd61a0629a70a96f2ab983ffddd57a7a5f7f514fd17874c8b486dc23aea09d3b9417e93bf84a72f8d707fe9607295bc4176383bd7a785dcfd36fa673272daa95d39318e61d6ada4b4ec7e410ee9d044b624375a77acfcb219f4a1287bba177a659e62008a9d2c6afc4d92efc42716ce683c912279bdb65ad8f0714d0d656897dc96efa69215b665c7f1967d1f5aa0ae805e5306e3bf7f0e746334d118b5b17bc32a717808357f1af457ab5ca336ab1c3fc6003bd617b6f982a947b68cca4892eaf12654545aad96a8db2b73a0ee0b103af284d49dc9cd687e0e5e7cc64ccd9d47ed007ef9d3eae7479afe8dd386629cadae7cc142eb962dcc4d45a17ab2afe964258114bec767e4012b169db024d27242a0bb6f75472a07e2c1c86b92b6863d5123337d733be53a6904c9bda680c0918f2f0dd747a20b79799b727262f394aa80de1d9e20f253b6c588173abaff00cba76e8312f4c2ec6ec14551abd438509411f5a5d5bfd9803f4ccc652bcd78988172b400c364799e9eaf39d9d5e11c0827b85d66f9a351732d3ca7a5ccbd708335175475630efecbec3cdb0792f64cf5680fcfdc3a6a055929f0780b1b1b1ff79e10b7700613fa358a389909c7ec8d2dca365b0280c7d775f1d1db3a98c979a9d06c543a71d47489c72a9df92eb6311db7d6a746da31ad778062c3bd03131ea7c8c78f74c8a1ce61b6466be458d6a7e13caa16661d4915514242768e5df6e2afc4e0ae14e0b238fbf619a2402bfefa370a33197ec26ff481bace3bb4aba19d8e9810dadf62d5313983e01ed635d698bc42f74b96272555cdbda7bcf342e7c0fde5151c4e58b01859901fdf52a88613a42fa2c175acb9ff59de1a59844f882ce0f68c060aa2ec47250b88ba8fa015d74b52c2f147c0480ba82b0f2e22394776d9499ef1983ea1292e7063370ed73f9719e16f48e2d73abca380d8ba1d157bc691ab8c472953e666b7731e92a087d533995c3c72b7fba43f6431d7ca89cdef035b9506c77d7c3e7e314de2432947fd311085675cfbcd878ada50b8c11a198957e09e162aad2999b0bcece49695d6b8c49a6bf339087cfe21e8550df1c7878f82c32002ab513d35ff0ed4eb8a2c1a273f7599b50702693a5fcfa4d24516e019090b71fcb7ee1b8b3c5d00c92db87af76f3bd6851058d835bf19811ddfaca9bc393569f0730cd913bb839a0bec5d6df496a9620b97300c1f17fc5abb357c03cd5885e6cf5d31ebf4e4063ba0e2c517050f693119bf847dddd2828f0f51773521d668da81cfc88e62538421c681a1852cdb205a28bb8fb830f5dff3f87a71c9d63f63c14ff25ad699262b64c52a66f14ecc5ba2a1321de92c66a6034084bd6dff6eb40c103d361c7442de146ab09f6aeaf72b13f26dc021ceb1ab6ef48810e6b8806728d9ddc00acb5376162cbf5410667ebff06df365172ef3daac64efb1b1f6af63aa23643f1c7734ab21ef16b9b415bc4cfa7b052c1914aaf1e0b02522f594d010e1eef078d6dec327fa41cc73cc1237c1e218429220c803bdbfc48630cc999e380366f9d9faa697765fec013882509d75e07f579155ee65fdc51099495450a35b8a102077e3451b0e16fcfb607bfe0463b9004d1fa0df759ed577558e67b594a7790bf8215aaf175562ade5864ecedd185f2618f7ede430112cddbac488452ac0367676133fd18985ffd34b23f8dd7b6e0583c49e14d6f20446be4a79ef1d2ec2e7a9abd4093152722ebdcf24d2454bc077fd58fd7e281c6dee428deae6e1c341c9048aac614afc220fa5035f4f7ed262d671bbb4fac66ed34fd149d5cfd7f72a4c3797464c7ee566f93e057687e4900c9f1dda5fe45cdc6682eb79e4a8b7705153c1f9826a9846f8d423d96d1f27a555773ee9bdff60b813dfbb5ce5fd24f2d5d80cc56c2cd085f0a156595de99033092c3c6e76d71b8fec8351b489c70514bd788cd194c655fd39e94f3db47193c63d1191138ab14315c0e15c12db7a8509755f71ef69abdc3d7668022fcf85d6f06a2d8a64d05719c89872425a8f4287044708d332f10ba967ca1d183b27b81fef8ccbcda7833357cee44034504ff05162623e63b4af92f8dc2ea52883627fff8760dba72d28b2dcb3e1827f350546a8ae264247c6e65fd2ac3e3370e41317c1011e69859443dc5629f01b8917cd368ee193b2c8cc924e20f1d29879383b239c3399cb7e548173b324e9a67dfb7376f6999c1ddc53f7d3263af0d1338be3ce9fe38444c0821a511c44b4ed5c33c026a08ecd2f55fef48852d7cf409f0f6c4c7be4e242cb72dd9b1fab315590080b5398f3dd2d907c8aed0cc6b1dc9a0a699e84520e397eb8eaa97147dde90f71334841a3a82b010ae968756a0f01add0dfedb146eb8da2030f31af9afd3aef33fb69240ef3d026635e77ee8f2885747adddfdffce5c7606587df70a62ddbb6628f785c7a799cec458ac94f66e4e13b95cc4ef4b41c628c82558f0897b2a6fab6ea1713a6016cd4c987d7c931168f680583d423c00d4c5a3fb4ca8fe4d91cee346c5941823894e099d41466db28c467ac0faab1fde7167767e06841253791e3f32759525e1b4277535eb2c62552a776a2ceb8c1b7119a75d9d21ff09429335e1d72c492e0ac89cf6de3644e3e535af1bc833ff802653feb0af8baf72526a18974df4443a53119da12be5b8086a5705a078fefe3a593fb08ef60e6ca72489d557eb2210fd5a5cf32012283ef6a1c01c37c915aee971be615be0a4a21894aca5d93cd04e0871ff8520e30e0b69f3b53944c1c8c9c2e3a303f9d3b7907db137939fe41e2f49d757198f52bdddca9907d196bd3233e998b0bb076f7cdde0f4741f3170f515769138d51f52e32cd7fffb4d6ca3cc1087dd48bd0a420a1a061a458e9f7480ad86bc9e17e4c4a5d325a01f25815ec8b48cd4e063b64cc2ce24a1c5d15b79c600d133b4acb26f9d94570ca6014457226e0b23ac270a0053a65a8a8d2dc7be87766e7fa58605b39a4cc2fc89917723434c6b04a311d12493a8e3f59dc72bef212218bb42d0b7e5818accabea0d9c4987b77dd71b06e5b8571806a2c226cce7d868980c26f4effc38721ba437c28394d5104931a66514c523fc7a457793584a331e9bcc770e409475c22f0c9e9dacadf49e8c2caea6a30a94f8be8f5cc5b9fa0b5807a5bcaacc98b473fb9b7ad83a29dc63402d7f429839e9d24ba939fef4cb415c6e6c58c159ade6c38ed11f411d305c19843f6b6916026ddcccab9efe8d23360d0fb4efbef2f1c0f30c9e619d2c7d72807be322a46062cba045f36b854e88e4906c26a3a4bc62d1c92c72b58f3e10590152976c7cd21b60270f717c417ff5d85cde11f0e8bf878cf6c7c3710d85f4f0c38743355971426c988a54cb6cd83cb76b6ff442acbf227b016b704c1898168a40f08a22b94ece79a3de45ba294001deada9320e903cc0e4c97d311a2c53a873f3d9b1a3749201eb41b4beda29a9afddf32b11de9d335b1a17d1afe4835b8c39b334efbb27addc33f824992535eba0e23ee19dca4fc288b2ad5305950d4eb8f835a147563ba0db055ba88560c2c36c3ac9bd9d209f54c068d0741bc571c80a6a2ade2cdda4b1fe5fff682b86f87dfd8e549b73b49c4c141dd7d081d4e3c045fd08e0a2c8d982ba824ea4443201714a9cbc67d2fcb1f72e4096494dc4f23280bcde391cd1bb042940c2cda091f6f03325cfa29b7c7bdfb53838170aced8e54c06503a16df0b3ac9a183110d42108206a28770155b2a1e27158238a97a5ccba0f14440405808e971e0afb3314197825e276b84b526e528ec52c0a08456fe70627fe9d14559189090774f43fa5ee1eadb2ee2637f47b9382c5eae3e3e40514cecec48f7ce33afc1d703fe0d7f7700728cae427e87b0630d3f5700941e96b17f636860160c94a00829a0b950253c51e517119031c83c4627d95d210fd047e467987c840b6402356488bce315ebaf1dbbfb18f5e7453b2e3937c07f0c06c933a6728c0a813a2a6796e11ccc672d478eddcb9e04ae9d5d8572473e7dda2f2c7c3b4daddce9d71584ebd0f08c3f733cb9bd83ed2b4a81ee3b58fafccfa3ecf1af375c4cb9ff1df4928e4d8204d3a6094c0c2b49061519c5c1fcfbccbe21729a7e9e04971e6a92c9cb8cd9c76b85942ec8d5a0415d6af3f5147bcb4b0d1278b07fa7db6f89f2e13208f0990362421cc5d6e458cf4e0bd22e18a01d873f02c4f7d4e6eb9ea62598c8c8fb94b4e903099b288df4585c4d4a7ae2c23cd87f6e49880f26fcddaecca1310f3176d335564e47d6c35e110192149cd170ece31dea7a51800a590afb41e54cde581", 0x1000}], 0x2, &(0x7f0000003d80)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={[], [], @multicast2}, r5}}}, @dstopts={{0xd8, 0x29, 0x37, {0x67, 0x17, [], [@calipso={0x7, 0x50, {0xc0, 0x12, 0x0, 0x1, [0x6, 0x9, 0x7f, 0x1, 0x0, 0xffff, 0x8000, 0x2, 0x80000000]}}, @pad1, @pad1, @calipso={0x7, 0x48, {0x9, 0x10, 0x401, 0x0, [0xdb, 0x20, 0x40, 0xa70, 0x371, 0x6, 0x6, 0xae25]}}, @pad1, @hao={0xc9, 0x10, @loopback}, @enc_lim={0x4, 0x1, 0x7f}]}}}, @hopopts_2292={{0x58, 0x29, 0x36, {0x6, 0x7, [], [@pad1, @jumbo={0xc2, 0x4, 0x4}, @generic={0x7, 0x2e, "6e01126fd828d5656d98f48989c95536464b2dc9ba0bfe10a6d5e585263f38659eb844783b9ad4cb8493347e246f"}, @ra={0x5, 0x2, 0x5}]}}}, @dstopts_2292={{0x28, 0x29, 0x4, {0x2b, 0x1, [], [@padn={0x1, 0x4, [0x0, 0x0, 0x0, 0x0]}, @enc_lim={0x4, 0x1, 0xc04d}, @jumbo]}}}, @rthdr_2292={{0x88, 0x29, 0x39, {0xfb, 0xe, 0x1, 0x9, 0x0, [@rand_addr="81cd5a6057a18518db413aee2bc184cf", @rand_addr="b82169112ee951e4e1fad59563317784", @initdev={0xfe, 0x88, [], 0x1, 0x0}, @mcast2, @empty, @mcast2, @rand_addr="04712a0efdd2d860083367fd7fa27f66"]}}}, @dstopts={{0x40, 0x29, 0x37, {0x84, 0x4, [], [@ra={0x5, 0x2, 0x5}, @padn={0x1, 0x3, [0x0, 0x0, 0x0]}, @hao={0xc9, 0x10, @rand_addr="767853ffdd2c7166365afbafd14901ec"}, @ra={0x5, 0x2, 0xffffffffffffffff}, @ra={0x5, 0x2, 0xf31}]}}}, @rthdrdstopts={{0x138, 0x29, 0x37, {0x4, 0x23, [], [@calipso={0x7, 0x10, {0x1f, 0x2, 0x1, 0x100, [0x412]}}, @calipso={0x7, 0x38, {0x7f, 0xc, 0x2081, 0x3f, [0x3, 0x401, 0x7, 0x4, 0x0, 0x8]}}, @ra={0x5, 0x2, 0x5}, @calipso={0x7, 0x30, {0x4, 0xa, 0x4, 0x7ff, [0xa9b0, 0x7, 0xffffffff, 0x5, 0x3]}}, @hao={0xc9, 0x10, @local}, @ra={0x5, 0x2, 0x1}, @hao={0xc9, 0x10, @rand_addr="513eaf7961931ee550704ce16a536e0f"}, @generic={0x6936fd4000000000, 0x71, "e6c7f09bf0d58e6ae5878b844a8185456a303f2cf789ca13cb39f13fc9fecc0b1e069a390dac1df41cc969e3b03287d6c20fd07ef20279859431493a6687dac450baab0334a78ba547f3d867f39d78014c3ed4281f05f820ea83570c271b53c813195334ef1a478dad86b940205d142f8a"}]}}}, @dstopts={{0x18, 0x29, 0x37, {0x87}}}], 0x398}}, {{&(0x7f0000004140)={0xa, 0x4e21, 0x3, @mcast1, 0x6}, 0x1c, &(0x7f0000004940)=[{&(0x7f0000004180)="bf68319599f1fe225af027cae4f718944e636261d20b826071812afce859546f03b8af77bbdb87da38401d26680deeddaa0b7bacfb409539a963a972bba01e62e91ddf61efb817373e18a09bcab089af1da2a22ab30ad1241b932124883cf69712145110edc80c49ad8a0769046a77b08447080bb388f40814f13ced9520b859619547054ab30c746b5230981b426bf21a6c94159c55c0f98c", 0x99}, {&(0x7f0000004240)="42da762696683ce84d651aed4dcb0c914debb10a93de784828acc02df0a4461801d5b20a5693e5b9cbdaec868c6c9f1c883c986b22280fc8185f5294b7eeb86fd2f8391fdf5178433dcfa9f48c729cab5891a028907c2c0abc8d4fb1bdb4701393cf00a1d792b6c8c0ff1128294b1c52ee8ed4cdfff6c22d446b3bff0f56e6bd3a5ea47902126c80076c03bfc1b6c07e67c4ea19f78237f31f7ffae2cf73b0ed1fe2b0ef7ecac06eafd68d9c9f79820e32c7", 0xb2}, {&(0x7f0000004300)="b6c22a51ecdac6a2765188c5", 0xc}, {&(0x7f0000004340)="04e29eada27ed3ed397f5493d25374bfb2ae074b0cecb9515ca6196436891fb1104db637fa1b22fc0057024d75aa5c00ab9e6af798bda4cc764e85af351253e026430d300e999beeae1911331f0f9755315b273a3a8c14944ee1e9f2e1bd379274e64d870196ece5e54a06e8adeb83747c3c5bd555bbb07bf072f42aa1d2bd1db08c584ff510e81ca78227aaaf9cf7052afe57137d4b7cc7e8a83b058e09c427fe", 0xa1}, {&(0x7f0000004400)="89af8fc93752e6b94df957da65274d62ccf5a79ccd713ef4b9e22b4dcf4c34975564713420f9d93dc96179f841162bbfb4f7864a4d6e3d79be8821ff49819d45dc16f6c793bf7a7ccb9b388d932a5437b7db1c62409e6833b78e6040ba3e4b5c1c4f0e34b6ca403580dedcd905674370b824de456e647b3cec27c278786126c32794c6f1927acc81722566c9bd8bf9b1789055cc60aacabeed940c451d8b005ab0b0f4e3e516ea4f5fbec17182c96ec13ae0bdb782cf3d997016a6aa6a826b150246d5c11e564aee5d586dbcd97df2000ff59e01d622389b096644e40ac442a58961301bce200a0f6d0cc5d88a45a1f5a5b60a759a29356a8526c28e6d", 0xfd}, {&(0x7f0000004500)="789738c992f53989f03f135706769bb3a949dc7f6e7d6be78f0004ad6e4be1183db87b33086c8dc730524d4d75de154df7a8f82822d968ac3602815949ba5a698e5eeb12bce919950b5fb0b27b768c59d22cc7b47c04d20d4bcc3d0f204af21436c80345ae5cf056c18b5b60377d6b90c8574f1e8b9d877a942457dfeb71e74addbbe49ffb2fe2e300d741b9fbb0544542217696654368ec642214e4947df9a988052cf445", 0xa5}, {&(0x7f00000045c0)="866ee518fcdfb551468a769759379fb097ea60c653217611400ecdf736d76210ece5d5585871cd7801bc98326737ba81777c0a7e098fb5ec1c32f29f58d970ad456566ef8375bbda622d2ea66953cf3f22c1edeb1c9875af8e40a4b88eac5c55791d7bf3e995a121318c2b87ab7ce71b4628d2883e54fe9c49952ec2c9746618d2137580eac92036d4ed346ba6fc972e9aee6ffedace2e0a5de0c5a0ab4a8418482e08ab57a1cdd7b40a25d3bbf8efa89fcf87ae050773150861f6fe0662be2007a2a6a3376dacbe09dd64d0b6ed50aa38ecd92aac6c14c0f5398b6f1764db50dc0e1c98f517319b416406310e38a8a16b22d68a3b98f5315b39e80a", 0xfc}, {&(0x7f00000046c0)="34879cb0a70fe8b4b084a4686c92ae16708be6afa056483cd1a155bf2d61996c1f8e73c3652d96912e351f533c5bb2134f37af5d4eba7e34f40cc8ad2aac34b92ca7de46c70903412d7c71fe534923975d4151ab837a84cf6b8a571013bd54a22ffde4326fb58b59b0904cf82787cc46cc6b20c7e57555aaa467074e4addf66a4474b4e4ab0530550e92e89705e501106f7e17f87f442c6faa980408028bb00c053b5fc7fa447bc4d3c0675560c9e1b4093e0bbc75123e47456eedd4b8c9f4", 0xbf}, {&(0x7f0000004780)="b2278d25a1bb1c5ee5e0647c714a4d200c5015ee1986e97784116d3d44b581fc863a4f09c2b90b68ee62ae49801011535d6766524f80c0fa2d77c21b27ceb3001bd45100c7f2c75e23ed640e29ed0b00c5acd0f201fcea7987e917c98304d7fce647e61dc1d80429f1734acae8140044e653aed714e16fe91abe4f6b3e951426786858fe0ec47716825f136d15201d4ebbc3da4403acc932a966443603201dcc276aa86330d616f501ef6a4b5c043a1a5eaa85912b9c9abe5d442efeeadc33b141791f5743cdac60ff39b6829877e2c07e32ee3bbb1d72408588efde56af55d5e4077bf4ff07d2", 0xe7}, {&(0x7f0000004880)="72555bef2ec6284be392ba2b52146520e40d26362e26b9fea50bb45f78d29a758034b010c808b93b65e2233e05b28da8aad9e28a1d61958d3bdf0f505bd6abefb769d5734f6f6c85141d38cc17eb2e8e0df8cd98593f5b09bf08202735cb200032bb0acf6d8387cad95873dcfa285422f3c7cc49f5aea768e33e9ec006c8dd57a004192d3dc4d511f4523182ce3db5618bafa539f10e617f48c508b023d3f04bcc8813e00136fc03a4f0f3", 0xab}], 0xa, &(0x7f0000004b40)=[@pktinfo={{0x24, 0x29, 0x32, {@mcast1, r6}}}, @rthdr={{0xa8, 0x29, 0x39, {0x0, 0x12, 0x2, 0xfffffffffffffbe5, 0x0, [@empty, @ipv4={[], [], @local}, @remote, @dev={0xfe, 0x80, [], 0x26}, @ipv4={[], [], @multicast2}, @rand_addr="0e2ae6ea3bc41fc007453cf17ce89ae4", @initdev={0xfe, 0x88, [], 0x0, 0x0}, @mcast1, @mcast1]}}}], 0xd0}}, {{&(0x7f0000004c40)={0xa, 0x4e21, 0x1, @local, 0x6}, 0x1c, &(0x7f0000004d00)=[{&(0x7f0000004c80)="ee9f74fbb658c77f20e453769ff5847cec6541953831d1ed49928eace95208345915d2674ebae860dfae7b6776daaeaf3766c98fe10b8d7f418e58efadd6d664fcd11cfe4f6595239fd8c9273deab7", 0x4f}], 0x1, &(0x7f0000004dc0)=[@pktinfo={{0x24, 0x29, 0x32, {@empty, r7}}}], 0x28}}], 0x8, 0x800) 12:58:57 executing program 3: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x540b, 0x2) [ 1752.005736] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1753.897710] Bluetooth: hci0: command 0x1003 tx timeout [ 1753.903158] Bluetooth: hci0: sending frame failed (-49) [ 1754.697730] Bluetooth: hci1: command 0x1003 tx timeout [ 1754.703175] Bluetooth: hci1: sending frame failed (-49) [ 1755.977807] Bluetooth: hci0: command 0x1001 tx timeout [ 1755.983431] Bluetooth: hci0: sending frame failed (-49) [ 1756.777805] Bluetooth: hci1: command 0x1001 tx timeout [ 1756.783355] Bluetooth: hci1: sending frame failed (-49) [ 1758.057869] Bluetooth: hci0: command 0x1009 tx timeout [ 1758.857793] Bluetooth: hci1: command 0x1009 tx timeout 12:59:08 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$VT_RESIZEX(r0, 0x560a, &(0x7f0000000200)={0x4, 0x5, 0x1, 0x5, 0x7, 0x8}) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) r1 = syz_open_dev$radio(&(0x7f0000000280)='/dev/radio#\x00', 0x0, 0x2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000002c0)={0x0, 0x0}, &(0x7f0000000300)=0xc) ioctl$SIOCAX25DELUID(r1, 0x89e2, &(0x7f0000000340)={0x3, @default, r2}) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x40000, 0x0) ioctl$KDGKBENT(r3, 0x4b46, &(0x7f00000001c0)={0x6, 0x6, 0x3}) ioctl$TIOCLINUX7(r0, 0x541c, &(0x7f0000000100)={0x7, 0x4}) ioctl$FIONREAD(r0, 0x541b, &(0x7f0000000080)) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000140)={0x80000000, 0x7, 0x7f, 0x18b, 0x9, 0x8, 0x4, 0x4, 0x9, 0x5}) ioctl$TIOCGDEV(r1, 0x80045432, &(0x7f0000000380)) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) ioctl$DRM_IOCTL_CONTROL(r3, 0x40086414, &(0x7f0000000180)={0x1, 0x6}) syz_open_dev$mouse(&(0x7f0000000040)='/dev/input/mouse#\x00', 0x8, 0x4000) lremovexattr(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000500)=ANY=[@ANYBLOB="8a7295200082747600000000000000000000000000000000000000aff9742ffb2205fd7528f42806000000547bb3637c4713dc7f801aa2fe0791ad44e73c18b2c6b11427442c8074a878f825df3c2f2bff153fba494f53ac87c2341f33d3ca4fef675bca7423adbb6a7bff01040cbfd978d94f22ff8dcc583cdd00746e8d3d1dc6210754f142ec2d02835c752ffc00eed238eea0dde57acc9ec438102f52f1042ce0666ce68e9896e1eef1b5c6a40b478f136022fd313542635921"]) 12:59:08 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x2) 12:59:08 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) 12:59:08 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c00711007af30501000b000500000000000100cf", 0x1f) 12:59:08 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) 12:59:08 executing program 3: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x540b, 0x2) 12:59:08 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)) ioctl$KDADDIO(r0, 0x400455c8, 0x2) 12:59:08 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x2) 12:59:08 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x40480, 0x0) r1 = dup2(r0, r0) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000040)={[{0x9, 0x4, 0x8, 0x9, 0x21, 0x4, 0xfffffffffffffffa, 0xff, 0x80000000, 0x20, 0x3, 0x4, 0x6}, {0x8, 0x5, 0x1, 0x67, 0xffff, 0x80f, 0x0, 0xfffffffffffff0e1, 0x744, 0x9, 0xffffffff, 0x9, 0x5}, {0x0, 0x6, 0x3, 0x3ff, 0x1, 0xf8, 0x7, 0x0, 0x8, 0x10001, 0x8b9, 0x2, 0x3}], 0x4}) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x1, 0x0) ioctl$VHOST_RESET_OWNER(r2, 0xaf02, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) 12:59:08 executing program 3: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x540b, 0x2) [ 1763.300124] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1763.364374] Bluetooth: hci0: Frame reassembly failed (-84) 12:59:09 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c0071100e0f30501000b000500000000000100cf", 0x1f) 12:59:09 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x2) [ 1763.481076] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1765.417817] Bluetooth: hci0: command 0x1003 tx timeout [ 1765.423449] Bluetooth: hci0: sending frame failed (-49) [ 1766.147788] Bluetooth: hci1: command 0x1003 tx timeout [ 1766.153230] Bluetooth: hci1: sending frame failed (-49) [ 1767.497826] Bluetooth: hci0: command 0x1001 tx timeout [ 1767.503583] Bluetooth: hci0: sending frame failed (-49) [ 1768.217838] Bluetooth: hci1: command 0x1001 tx timeout [ 1768.223314] Bluetooth: hci1: sending frame failed (-49) [ 1769.577924] Bluetooth: hci0: command 0x1009 tx timeout [ 1770.297771] Bluetooth: hci1: command 0x1009 tx timeout 12:59:19 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x8001, 0x0) ioctl$RTC_PIE_ON(r1, 0x7005) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) chdir(&(0x7f00000000c0)='./file0\x00') 12:59:19 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)) ioctl$KDADDIO(r0, 0x400455c8, 0x2) 12:59:19 executing program 3 (fault-call:1 fault-nth:0): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x2) 12:59:19 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x241, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:59:19 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30601000b000500000000000100cf", 0x1f) 12:59:19 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x2) [ 1774.168748] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:59:19 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30801000b000500000000000100cf", 0x1f) 12:59:19 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)) ioctl$KDADDIO(r0, 0x400455c8, 0x2) 12:59:19 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x2) 12:59:19 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)) ioctl$KDADDIO(r0, 0x400455c8, 0x2) 12:59:19 executing program 1: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000040)={0x6, 0x6cf177eb, 0x58, 0x7fffffff, 0x9, 0x0, 0x2, 0x0, 0x4, 0x4, 0x3, 0x1000}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) ioctl$TCSBRKP(r1, 0x5425, 0x2) [ 1774.213123] Bluetooth: hci0: Frame reassembly failed (-84) 12:59:19 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x2) 12:59:19 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x2, 0x2) [ 1774.302002] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:59:19 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30901000b000500000000000100cf", 0x1f) 12:59:20 executing program 1: r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x80440, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) r2 = userfaultfd(0x80000) stat(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r4 = socket$caif_stream(0x25, 0x1, 0x3) sendmsg$nl_netfilter(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x19}, 0xc, &(0x7f0000000140)={&(0x7f0000000280)={0x11c, 0x0, 0xf, 0xa, 0x70bd2b, 0x25dfdbff, {0x0, 0x0, 0x2}, [@nested={0x38, 0x40, [@typed={0xc, 0x68, @u64=0x6}, @typed={0x8, 0x5d, @fd=r1}, @typed={0x8, 0x5f, @fd=r2}, @typed={0x8, 0x5f, @str='\x00'}, @typed={0x8, 0x2a, @u32=0x2}, @typed={0x8, 0x3f, @u32=0x51ac}]}, @typed={0x8, 0x4a, @uid=r3}, @nested={0xc8, 0x8f, [@typed={0x4, 0x7c}, @typed={0x8, 0x39, @fd=r4}, @typed={0x4, 0x8f}, @typed={0x4, 0x92}, @typed={0x8, 0x95, @u32=0x4}, @generic="686a10c411b2930ba2a43b5e7fec7012562f6bffa8922d9588814eb0e7db86d52baa84886632968a10383db8312b6db830e79a23ea5d06963330c3dfaca531a5dad5a55e04bb5ae0ced2a6c9c032b3c7721a42c00f35533c34e266579cd06f8987e8b042cdaa3b970840a525a8db14f8b433b7dfd1006e78eb238454af0e1227d610bd30dd1a6e25a4c92b2408c2058c7b9b813ae18fc83c9d4d67d119d53249cf7507f70737"]}]}, 0x11c}}, 0x8040) getuid() r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r5, 0x540b, 0x0) [ 1774.431367] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1776.217794] Bluetooth: hci0: command 0x1003 tx timeout [ 1776.224238] Bluetooth: hci0: sending frame failed (-49) [ 1777.017822] Bluetooth: hci1: command 0x1003 tx timeout [ 1777.023498] Bluetooth: hci1: sending frame failed (-49) [ 1778.297841] Bluetooth: hci0: command 0x1001 tx timeout [ 1778.303330] Bluetooth: hci0: sending frame failed (-49) [ 1779.097923] Bluetooth: hci1: command 0x1001 tx timeout [ 1779.103409] Bluetooth: hci1: sending frame failed (-49) [ 1780.377861] Bluetooth: hci0: command 0x1009 tx timeout [ 1781.177826] Bluetooth: hci1: command 0x1009 tx timeout 12:59:30 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x8000, 0x0) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080)='nbd\x00') r3 = syz_open_dev$sndpcmp(&(0x7f0000000100)='/dev/snd/pcmC#D#p\x00', 0x5, 0x80000) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x400, 0x0) r5 = open(&(0x7f0000000180)='./file0\x00', 0x220900, 0x100) r6 = syz_open_dev$vcsa(&(0x7f00000001c0)='/dev/vcsa#\x00', 0x5, 0x0) r7 = dup2(r0, r0) r8 = fcntl$dupfd(r0, 0x0, r0) r9 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) sendmsg$NBD_CMD_STATUS(r1, &(0x7f0000000380)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x9c, r2, 0x20, 0x70bd29, 0x25dfdbfe, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x1}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x8}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x9}, @NBD_ATTR_SOCKETS={0x3c, 0x7, [{0x8, 0x1, r3}, {0x8, 0x1, r4}, {0x8, 0x1, r5}, {0x8, 0x1, r6}, {0x8, 0x1, r7}, {0x8, 0x1, r8}, {0x8, 0x1, r9}]}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x400}]}, 0x9c}, 0x1, 0x0, 0x0, 0x48000}, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:59:30 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)) ioctl$KDADDIO(r0, 0x400455c8, 0x2) 12:59:30 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x4b47, 0x2) 12:59:30 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x2) 12:59:30 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30a01000b000500000000000100cf", 0x1f) 12:59:30 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0xffffffffffffffff, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) 12:59:30 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x2) 12:59:30 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)) ioctl$KDADDIO(r0, 0x400455c8, 0x2) 12:59:30 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f35201000b000500000000000100cf", 0x1f) [ 1785.045161] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:59:30 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) fsetxattr$security_capability(r0, &(0x7f0000000000)='security.capability\x00', &(0x7f0000000040)=@v1={0x1000000, [{0xc0}]}, 0xc, 0x1) 12:59:30 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x4b49, 0x2) 12:59:30 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) [ 1785.125966] Bluetooth: hci0: Frame reassembly failed (-84) [ 1785.140582] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1785.229602] Bluetooth: hci1: Frame reassembly failed (-84) [ 1785.884973] Bluetooth: hci2: Frame reassembly failed (-84) [ 1785.891150] Bluetooth: hci2: Frame reassembly failed (-84) [ 1787.177802] Bluetooth: hci0: command 0x1003 tx timeout [ 1787.183253] Bluetooth: hci0: sending frame failed (-49) [ 1787.257838] Bluetooth: hci1: command 0x1003 tx timeout [ 1787.263533] Bluetooth: hci1: sending frame failed (-49) [ 1787.897862] Bluetooth: hci2: command 0x1003 tx timeout [ 1787.904348] Bluetooth: hci2: sending frame failed (-49) [ 1789.257812] Bluetooth: hci0: command 0x1001 tx timeout [ 1789.263510] Bluetooth: hci0: sending frame failed (-49) [ 1789.337800] Bluetooth: hci1: command 0x1001 tx timeout [ 1789.343439] Bluetooth: hci1: sending frame failed (-49) [ 1789.977821] Bluetooth: hci2: command 0x1001 tx timeout [ 1789.983360] Bluetooth: hci2: sending frame failed (-49) [ 1791.337817] Bluetooth: hci0: command 0x1009 tx timeout [ 1791.417825] Bluetooth: hci1: command 0x1009 tx timeout [ 1792.057809] Bluetooth: hci2: command 0x1009 tx timeout 12:59:41 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x2) 12:59:41 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30502000b000500000000000100cf", 0x1f) 12:59:41 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5409, 0x2) 12:59:41 executing program 1: ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x540b, 0x0) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x234800, 0x0) ioctl$KDSKBSENT(r0, 0x4b49, &(0x7f0000000040)="e81d2bb534bc077d92693dbd18487c3882da49f2f77d3841a04de1902cac739c775dd02b940ea9baff19378dc13427fd9be7d87c489d66e2129162cba9af340431654797224fa6321616f9708c2d5565ec3a78057fea86569b705ac17656c56e7cc4fdd13e66aafdaad88c5f05391ae93f5ceffa28ed8dc978f366909087a3e9d53d693ac3a37eec876776acb1be652d29fa40c9e15c731e") ioctl$BLKREPORTZONE(r0, 0xc0101282, &(0x7f0000000100)={0xfffffffffffffbff, 0x2, 0x0, [{0xc8, 0x2, 0xfffffffffffffffe, 0x4, 0x9, 0x8, 0x5}, {0x1000, 0x7fff, 0x7fffffff, 0xb2, 0x5, 0x10001, 0x6}]}) 12:59:41 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) fcntl$notify(r0, 0x402, 0x25) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 12:59:41 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) 12:59:41 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/amemthresh\x00', 0x2, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x0) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x540b, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000000)) 12:59:41 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30505000b000500000000000100cf", 0x1f) 12:59:41 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x2) 12:59:41 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540a, 0x2) [ 1795.927090] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1795.952217] Bluetooth: hci0: Frame reassembly failed (-84) 12:59:41 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x2) [ 1796.025911] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:59:41 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0}, 0x68) r1 = syz_open_procfs(0x0, &(0x7f0000000100)='cmdline\x00') read$FUSE(r1, 0x0, 0x2a1) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00') sendmsg$IPVS_CMD_GET_DEST(r1, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)=ANY=[@ANYBLOB="9038e3e3", @ANYRES16=r2, @ANYBLOB="030529bd7000fddbdf250800000008000500f780000058000100080004004e220000080009006900000014000300fe80000000000000000000000000001a14000300ff020000000000000000000000000001080009004200000014000300fe80000000000000000000000000000f0c0003000800010000000000"], 0x80}, 0x1, 0x0, 0x0, 0x20040080}, 0x80) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000000)=0x80000001) 12:59:41 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540c, 0x2) 12:59:41 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30525000b000500000000000100cf", 0x1f) 12:59:41 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30552000b000500000000000100cf", 0x1f) 12:59:41 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540d, 0x2) [ 1796.148835] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1796.258900] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1796.773186] Bluetooth: hci2: Frame reassembly failed (-84) [ 1797.977832] Bluetooth: hci0: command 0x1003 tx timeout [ 1797.983345] Bluetooth: hci0: sending frame failed (-49) [ 1798.067843] Bluetooth: hci1: command 0x1003 tx timeout [ 1798.073516] Bluetooth: hci1: sending frame failed (-49) [ 1798.777761] Bluetooth: hci2: command 0x1003 tx timeout [ 1798.783603] Bluetooth: hci2: sending frame failed (-49) [ 1800.057976] Bluetooth: hci0: command 0x1001 tx timeout [ 1800.063484] Bluetooth: hci0: sending frame failed (-49) [ 1800.137858] Bluetooth: hci1: command 0x1001 tx timeout [ 1800.143337] Bluetooth: hci1: sending frame failed (-49) [ 1800.857910] Bluetooth: hci2: command 0x1001 tx timeout [ 1800.863458] Bluetooth: hci2: sending frame failed (-49) [ 1802.137988] Bluetooth: hci0: command 0x1009 tx timeout [ 1802.217891] Bluetooth: hci1: command 0x1009 tx timeout [ 1802.937807] Bluetooth: hci2: command 0x1009 tx timeout 12:59:52 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) syz_genetlink_get_family_id$net_dm(&(0x7f0000000080)='NET_DM\x00') ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) r1 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000001980)='/dev/dlm_plock\x00', 0x42002, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001a00)='TIPCv2\x00') sendmsg$TIPC_NL_NODE_GET(r1, &(0x7f0000001b80)={&(0x7f00000019c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000001b40)={&(0x7f0000001a40)={0xfc, r2, 0x2, 0x70bd27, 0x25dfdbfe, {}, [@TIPC_NLA_LINK={0xe8, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x34, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffff001}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}]}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x75}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}]}, @TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x20}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x89fd}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffff}]}, @TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x95}]}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x24000000}, 0x80) lgetxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@random={'trusted.', '/dev/ptmx\x00'}, &(0x7f0000000100)=""/91, 0x5b) 12:59:52 executing program 1: ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x540b, 0x0) 12:59:52 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) 12:59:52 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30523020b000500000000000100cf", 0x1f) 12:59:52 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540e, 0x2) 12:59:52 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) 12:59:52 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x0) ioctl$KDSKBMODE(r0, 0x4b45, &(0x7f0000000000)=0x5) [ 1806.826444] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:59:52 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5411, 0x2) 12:59:52 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30500030b000500000000000100cf", 0x1f) [ 1806.879923] Bluetooth: hci1: Frame reassembly failed (-84) [ 1806.916864] Bluetooth: hci2: Frame reassembly failed (-84) 12:59:52 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5412, 0x2) 12:59:52 executing program 1: signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x800) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000040)={0xffffffffffffffff}) readv(r0, 0x0, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=0x0) syz_open_dev$loop(0x0, 0x0, 0x0) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r2, 0x89a1, &(0x7f00000000c0)={@local={0xfe, 0x80, [0x600, 0x3ef, 0x0, 0x3f00000000000000, 0x100000000000000, 0x0, 0x1103, 0x0, 0x0, 0x0, 0x0, 0x6]}}) ioctl$sock_inet6_SIOCADDRT(r2, 0x89a0, &(0x7f0000000100)={@local={0xfe, 0x80, [0x0, 0xfeff0000]}, @empty, @loopback}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) open(&(0x7f0000000280)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000a60000/0x4000)=nil, 0x4000, 0x8, 0x20810, 0xffffffffffffffff, 0x0) r3 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000200)='/dev/qat_adf_ctl\x00', 0x0, 0x0) ioctl$KDSKBSENT(r3, 0x4b49, &(0x7f0000000240)) tgkill(r1, 0x0, 0x1) [ 1806.998588] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 12:59:52 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f305010003000500000000000100cf", 0x1f) [ 1807.136894] netlink: 11 bytes leftover after parsing attributes in process `syz-executor.4'. [ 1808.937741] Bluetooth: hci2: command 0x1003 tx timeout [ 1808.937759] Bluetooth: hci0: command 0x1003 tx timeout [ 1808.943228] Bluetooth: hci2: sending frame failed (-49) [ 1808.954311] Bluetooth: hci0: sending frame failed (-49) [ 1808.959875] Bluetooth: hci1: command 0x1003 tx timeout [ 1808.965394] Bluetooth: hci1: sending frame failed (-49) [ 1809.737770] Bluetooth: hci3: command 0x1003 tx timeout [ 1809.743198] Bluetooth: hci3: sending frame failed (-49) [ 1811.017801] Bluetooth: hci1: command 0x1001 tx timeout [ 1811.023240] Bluetooth: hci1: sending frame failed (-49) [ 1811.028723] Bluetooth: hci0: command 0x1001 tx timeout [ 1811.034184] Bluetooth: hci0: sending frame failed (-49) [ 1811.039724] Bluetooth: hci2: command 0x1001 tx timeout [ 1811.045132] Bluetooth: hci2: sending frame failed (-49) [ 1811.817777] Bluetooth: hci3: command 0x1001 tx timeout [ 1811.823241] Bluetooth: hci3: sending frame failed (-49) [ 1813.097845] Bluetooth: hci2: command 0x1009 tx timeout [ 1813.103200] Bluetooth: hci0: command 0x1009 tx timeout [ 1813.108761] Bluetooth: hci1: command 0x1009 tx timeout [ 1813.897822] Bluetooth: hci3: command 0x1009 tx timeout 13:00:03 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) lstat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = syz_open_dev$adsp(&(0x7f0000000140)='/dev/adsp#\x00', 0x4, 0x800) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000180)={&(0x7f0000000100)='./file0\x00', r1}, 0x10) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 13:00:03 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5413, 0x2) 13:00:03 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501020b000500000000000100cf", 0x1f) 13:00:03 executing program 1: 13:00:03 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) 13:00:03 executing program 5: 13:00:04 executing program 5: [ 1818.335208] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 13:00:04 executing program 1: 13:00:04 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5414, 0x2) 13:00:04 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501030b000500000000000100cf", 0x1f) [ 1818.445385] Bluetooth: hci1: Frame reassembly failed (-84) 13:00:04 executing program 5: 13:00:04 executing program 1: [ 1818.585450] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1819.209084] Bluetooth: hci2: sending frame failed (-49) [ 1820.377754] Bluetooth: hci0: command 0x1003 tx timeout [ 1820.383406] Bluetooth: hci0: sending frame failed (-49) [ 1820.457748] Bluetooth: hci1: command 0x1003 tx timeout [ 1820.463431] Bluetooth: hci1: sending frame failed (-49) [ 1821.257744] Bluetooth: hci2: command 0x1003 tx timeout [ 1821.263209] Bluetooth: hci2: sending frame failed (-49) [ 1822.457823] Bluetooth: hci0: command 0x1001 tx timeout [ 1822.463384] Bluetooth: hci0: sending frame failed (-49) [ 1822.537791] Bluetooth: hci1: command 0x1001 tx timeout [ 1822.543377] Bluetooth: hci1: sending frame failed (-49) [ 1823.337944] Bluetooth: hci2: command 0x1001 tx timeout [ 1823.343741] Bluetooth: hci2: sending frame failed (-49) [ 1824.537811] Bluetooth: hci0: command 0x1009 tx timeout [ 1824.617803] Bluetooth: hci1: command 0x1009 tx timeout [ 1825.417830] Bluetooth: hci2: command 0x1009 tx timeout 13:00:15 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000300)={0xffffffffffffffff, 0x0, &(0x7f0000000100)}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000100)="21093c45ac32f873a79f23ddd7801ba058cd3b2538c556"}, 0x20) socketpair(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x89f0, &(0x7f0000000300)='gre0\x00') 13:00:15 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000000)) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 13:00:15 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000180)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_hmac_sha256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) recvmmsg(r1, &(0x7f0000004580)=[{{0x0, 0x0, &(0x7f0000001440)=[{&(0x7f0000000080)=""/239, 0xef}, {&(0x7f0000000280)=""/24, 0x20000298}], 0x2}}], 0xcb, 0x0, 0x0) 13:00:15 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501040b000500000000000100cf", 0x1f) 13:00:15 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) 13:00:15 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5415, 0x2) [ 1829.855910] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1829.886605] Bluetooth: hci0: Frame reassembly failed (-84) [ 1829.894760] Bluetooth: hci0: Frame reassembly failed (-84) 13:00:15 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5416, 0x2) 13:00:15 executing program 1: socket$alg(0x26, 0x5, 0x0) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_SET_CHILD_SUBREAPER(0x24, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 13:00:15 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501050b000500000000000100cf", 0x1f) 13:00:15 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) socketpair$unix(0x1, 0x1000000000005, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x5) ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000640)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e3d63a98fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b5365c5dc26ca097ddda7c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df10000174a3ac8694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde318ead4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b2262d66ae793b6304a30b97077f1c131045cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f58e068af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28b774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a800655d127de6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb56d9b962d2fc43fa01a047526865c84f7cff36056cc4ac258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d8191643"}) ioctl$KVM_RUN(r3, 0xae80, 0x0) dup3(r0, r1, 0x0) ioctl$KVM_INTERRUPT(r3, 0x4004ae8b, 0x0) dup2(r1, r3) [ 1829.907998] Bluetooth: hci1: Frame reassembly failed (-84) 13:00:15 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5418, 0x2) [ 1829.990997] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 13:00:15 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501060b000500000000000100cf", 0x1f) 13:00:15 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x541b, 0x2) [ 1830.050288] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 1830.076501] overlayfs: filesystem on './file0' not supported as upperdir [ 1830.093018] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1830.699672] Bluetooth: hci2: Frame reassembly failed (-84) [ 1831.897715] Bluetooth: hci0: command 0x1003 tx timeout [ 1831.903142] Bluetooth: hci0: sending frame failed (-49) [ 1831.977702] Bluetooth: hci1: command 0x1003 tx timeout [ 1831.983195] Bluetooth: hci1: sending frame failed (-49) [ 1832.777704] Bluetooth: hci2: command 0x1003 tx timeout [ 1832.783108] Bluetooth: hci2: sending frame failed (-49) [ 1833.977806] Bluetooth: hci0: command 0x1001 tx timeout [ 1833.983264] Bluetooth: hci0: sending frame failed (-49) [ 1834.057797] Bluetooth: hci1: command 0x1001 tx timeout [ 1834.063228] Bluetooth: hci1: sending frame failed (-49) [ 1834.857782] Bluetooth: hci2: command 0x1001 tx timeout [ 1834.863198] Bluetooth: hci2: sending frame failed (-49) [ 1836.057815] Bluetooth: hci0: command 0x1009 tx timeout [ 1836.137823] Bluetooth: hci1: command 0x1009 tx timeout [ 1836.937830] Bluetooth: hci2: command 0x1009 tx timeout 13:00:26 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) syz_open_pts(r0, 0x800) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$PIO_FONTX(r0, 0x4b6c, &(0x7f0000000000)="70ec3d17e7ced6b5abe70c8603162a0aaac45acee5262f8023bcfc5518a201efbe1cf6932aedbb8e09cf5b3807d306bf43568bd22c31bd84a4619a85e680ab9bd7524f93fec44957f01deee88d90a215d3bc20859f770c14b8aace4ccd7b0e09de835cacbd4470e0dfaeb1855e0eb9bd15a317c44f98d6a2c22f09fbef31316f38d5de3c92c0ba8c") ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 13:00:26 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501070b000500000000000100cf", 0x1f) 13:00:26 executing program 1: socket$alg(0x26, 0x5, 0x0) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_SET_CHILD_SUBREAPER(0x24, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 13:00:26 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x541d, 0x2) 13:00:26 executing program 5: r0 = memfd_create(&(0x7f00000001c0)='\xb3', 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x11, r0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r1, 0x0, 0x0, 0x0, &(0x7f0000000080)={0x2, 0x0, @empty}, 0x10) 13:00:26 executing program 0 (fault-call:2 fault-nth:0): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) [ 1841.384985] audit: type=1400 audit(1564405226.979:82): avc: denied { map } for pid=3746 comm="syz-executor.5" path=2F6D656D66643AB3202864656C6574656429 dev="tmpfs" ino=147299 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:tmpfs_t:s0 tclass=file permissive=1 [ 1841.419973] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1841.429413] FAULT_INJECTION: forcing a failure. 13:00:27 executing program 5 (fault-call:2 fault-nth:0): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) [ 1841.429413] name failslab, interval 1, probability 0, space 0, times 0 13:00:27 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f305010a0b000500000000000100cf", 0x1f) [ 1841.501186] overlayfs: workdir and upperdir must reside under the same mount [ 1841.519638] CPU: 0 PID: 3752 Comm: syz-executor.0 Not tainted 4.19.62 #36 [ 1841.520288] Bluetooth: hci0: Frame reassembly failed (-84) [ 1841.526609] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1841.526620] Call Trace: [ 1841.544235] dump_stack+0x172/0x1f0 13:00:27 executing program 1: socket$alg(0x26, 0x5, 0x0) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_SET_CHILD_SUBREAPER(0x24, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 13:00:27 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x541f, 0x2) [ 1841.547914] should_fail.cold+0xa/0x1b [ 1841.551834] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 1841.556969] ? lock_downgrade+0x810/0x810 [ 1841.561164] __should_failslab+0x121/0x190 [ 1841.565436] should_failslab+0x9/0x14 [ 1841.569263] kmem_cache_alloc_trace+0x2cc/0x760 [ 1841.573973] hci_alloc_dev+0x43/0x1d00 [ 1841.577910] hci_uart_tty_ioctl+0x2d7/0xaf0 [ 1841.582254] tty_ioctl+0x8b5/0x1510 [ 1841.585884] ? hci_uart_init_work+0x140/0x140 [ 1841.590392] ? tty_vhangup+0x30/0x30 [ 1841.594322] ? mark_held_locks+0x100/0x100 [ 1841.598581] ? __fget+0x340/0x540 [ 1841.602082] ? __might_sleep+0x95/0x190 [ 1841.606077] ? tty_vhangup+0x30/0x30 [ 1841.609824] do_vfs_ioctl+0xd5f/0x1380 [ 1841.613846] ? selinux_file_ioctl+0x46f/0x5e0 [ 1841.618354] ? selinux_file_ioctl+0x125/0x5e0 [ 1841.624349] ? ioctl_preallocate+0x210/0x210 [ 1841.628789] ? selinux_file_mprotect+0x620/0x620 [ 1841.633579] ? iterate_fd+0x360/0x360 [ 1841.637382] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1841.643060] ? fput+0x128/0x1a0 [ 1841.646353] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1841.651896] ? security_file_ioctl+0x8d/0xc0 [ 1841.656345] ksys_ioctl+0xab/0xd0 [ 1841.659808] __x64_sys_ioctl+0x73/0xb0 [ 1841.663702] do_syscall_64+0xfd/0x620 [ 1841.667530] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1841.672760] RIP: 0033:0x459829 [ 1841.675951] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1841.694873] RSP: 002b:00007f655e432c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1841.702598] RAX: ffffffffffffffda RBX: 00007f655e432c90 RCX: 0000000000459829 [ 1841.709866] RDX: 0000000000000002 RSI: 00000000400455c8 RDI: 0000000000000003 [ 1841.717219] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 1841.724658] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f655e4336d4 [ 1841.731925] R13: 00000000004c250e R14: 00000000004d5930 R15: 0000000000000004 [ 1841.740833] Bluetooth: Can't allocate HCI device [ 1841.793052] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1841.800661] FAULT_INJECTION: forcing a failure. [ 1841.800661] name failslab, interval 1, probability 0, space 0, times 0 [ 1841.800682] CPU: 1 PID: 3765 Comm: syz-executor.5 Not tainted 4.19.62 #36 [ 1841.800690] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1841.800696] Call Trace: [ 1841.800721] dump_stack+0x172/0x1f0 [ 1841.800744] should_fail.cold+0xa/0x1b [ 1841.800763] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 1841.800779] ? lock_downgrade+0x810/0x810 [ 1841.800817] __should_failslab+0x121/0x190 [ 1841.800836] should_failslab+0x9/0x14 [ 1841.800852] kmem_cache_alloc_trace+0x2cc/0x760 [ 1841.800881] hci_alloc_dev+0x43/0x1d00 [ 1841.800901] hci_uart_tty_ioctl+0x2d7/0xaf0 [ 1841.800928] tty_ioctl+0x8b5/0x1510 [ 1841.873056] ? hci_uart_init_work+0x140/0x140 [ 1841.877681] ? tty_vhangup+0x30/0x30 [ 1841.881422] ? mark_held_locks+0x100/0x100 [ 1841.885691] ? __fget+0x340/0x540 [ 1841.889173] ? __might_sleep+0x95/0x190 [ 1841.893174] ? tty_vhangup+0x30/0x30 [ 1841.896915] do_vfs_ioctl+0xd5f/0x1380 [ 1841.900824] ? selinux_file_ioctl+0x46f/0x5e0 [ 1841.905338] ? selinux_file_ioctl+0x125/0x5e0 [ 1841.909855] ? ioctl_preallocate+0x210/0x210 [ 1841.914280] ? selinux_file_mprotect+0x620/0x620 [ 1841.919066] ? iterate_fd+0x360/0x360 [ 1841.923068] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1841.928624] ? fput+0x128/0x1a0 [ 1841.928649] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1841.928667] ? security_file_ioctl+0x8d/0xc0 [ 1841.928686] ksys_ioctl+0xab/0xd0 [ 1841.937488] __x64_sys_ioctl+0x73/0xb0 [ 1841.937507] do_syscall_64+0xfd/0x620 [ 1841.937525] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1841.937537] RIP: 0033:0x459829 [ 1841.937550] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1841.937558] RSP: 002b:00007f1570331c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 13:00:27 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f305010e0b000500000000000100cf", 0x1f) 13:00:27 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5420, 0x2) [ 1841.937573] RAX: ffffffffffffffda RBX: 00007f1570331c90 RCX: 0000000000459829 [ 1841.937585] RDX: 0000000000000002 RSI: 00000000400455c8 RDI: 0000000000000003 [ 1842.003137] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 1842.010560] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f15703326d4 [ 1842.010569] R13: 00000000004c250e R14: 00000000004d5930 R15: 0000000000000004 [ 1842.014016] Bluetooth: Can't allocate HCI device [ 1842.043602] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1842.184308] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 1843.577793] Bluetooth: hci0: command 0x1003 tx timeout [ 1843.583345] Bluetooth: hci0: sending frame failed (-49) [ 1844.297771] Bluetooth: hci1: command 0x1003 tx timeout [ 1844.303177] Bluetooth: hci1: sending frame failed (-49) [ 1845.657813] Bluetooth: hci0: command 0x1001 tx timeout [ 1845.663250] Bluetooth: hci0: sending frame failed (-49) [ 1846.378587] Bluetooth: hci1: command 0x1001 tx timeout [ 1846.384012] Bluetooth: hci1: sending frame failed (-49) [ 1847.737817] Bluetooth: hci0: command 0x1009 tx timeout [ 1848.457806] Bluetooth: hci1: command 0x1009 tx timeout 13:00:38 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) r1 = dup(r0) ioctl$BLKALIGNOFF(r1, 0x127a, &(0x7f0000000040)) ioctl$KDADDIO(r0, 0x400455c8, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x408000, 0x0) ioctl$TIOCSIG(r0, 0x40045436, 0x30) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) sendto$unix(r1, &(0x7f0000000100)="7c987e42fda7b68fe586f0ae0db3ca5895dffdac015e56e8eaea7331c800e5160ccb142fa8bf182322a29a3f56cd22d2c0520aec19dec370ccfb5f82afd09305aa3002d8025a8c57fd5d0633853a646c56e664c77e6147caf00995a944632a3f169af862edf3b37911f223191d1ab6762337019ed8a2ea8a90f04a77717dc016afcb1f0601b9b5d5d72a2f5bdd5d80a3d40841e74cab833628d2aebe0ad2bdb5006ea4fb7365ec4f35e0f4cbb3f3b2d685c14cca7e0eef59030965", 0xbb, 0x800, 0x0, 0x0) 13:00:38 executing program 0 (fault-call:2 fault-nth:1): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) 13:00:38 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f305010f0b000500000000000100cf", 0x1f) 13:00:38 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5421, 0x2) 13:00:38 executing program 5 (fault-call:2 fault-nth:1): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) 13:00:38 executing program 1: socket$alg(0x26, 0x5, 0x0) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_SET_CHILD_SUBREAPER(0x24, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1852.904630] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1852.921005] FAULT_INJECTION: forcing a failure. [ 1852.921005] name failslab, interval 1, probability 0, space 0, times 0 [ 1852.924017] FAULT_INJECTION: forcing a failure. [ 1852.924017] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1852.944045] CPU: 0 PID: 3790 Comm: syz-executor.5 Not tainted 4.19.62 #36 13:00:38 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501480b000500000000000100cf", 0x1f) [ 1852.950986] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1852.960385] Call Trace: [ 1852.963080] dump_stack+0x172/0x1f0 [ 1852.966734] should_fail.cold+0xa/0x1b [ 1852.970641] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 1852.975760] ? debug_smp_processor_id+0x1c/0x20 [ 1852.980434] ? perf_trace_lock+0xeb/0x510 [ 1852.984587] ? mark_held_locks+0x100/0x100 [ 1852.988834] ? perf_trace_lock+0xeb/0x510 [ 1852.992992] __alloc_pages_nodemask+0x1ee/0x750 [ 1852.997665] ? SOFTIRQ_verbose+0x10/0x10 [ 1853.001735] ? __alloc_pages_slowpath+0x2870/0x2870 [ 1853.006947] cache_grow_begin+0x91/0x8c0 [ 1853.011012] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1853.016552] ? check_preemption_disabled+0x48/0x290 [ 1853.021578] kmem_cache_alloc_trace+0x685/0x760 [ 1853.026267] hci_alloc_dev+0x43/0x1d00 [ 1853.030162] hci_uart_tty_ioctl+0x2d7/0xaf0 [ 1853.034492] tty_ioctl+0x8b5/0x1510 [ 1853.038126] ? hci_uart_init_work+0x140/0x140 [ 1853.042625] ? tty_vhangup+0x30/0x30 [ 1853.046341] ? mark_held_locks+0x100/0x100 [ 1853.050592] ? __fget+0x340/0x540 [ 1853.054142] ? __might_sleep+0x95/0x190 [ 1853.058123] ? tty_vhangup+0x30/0x30 [ 1853.061853] do_vfs_ioctl+0xd5f/0x1380 [ 1853.065752] ? selinux_file_ioctl+0x46f/0x5e0 [ 1853.070263] ? selinux_file_ioctl+0x125/0x5e0 [ 1853.074769] ? ioctl_preallocate+0x210/0x210 [ 1853.079179] ? selinux_file_mprotect+0x620/0x620 [ 1853.083949] ? iterate_fd+0x360/0x360 [ 1853.087754] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1853.093293] ? fput+0x128/0x1a0 [ 1853.096667] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1853.102210] ? security_file_ioctl+0x8d/0xc0 [ 1853.106622] ksys_ioctl+0xab/0xd0 [ 1853.110171] __x64_sys_ioctl+0x73/0xb0 [ 1853.114508] do_syscall_64+0xfd/0x620 [ 1853.118318] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1853.123533] RIP: 0033:0x459829 [ 1853.126729] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1853.145727] RSP: 002b:00007f1570331c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 13:00:38 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5423, 0x2) [ 1853.153450] RAX: ffffffffffffffda RBX: 00007f1570331c90 RCX: 0000000000459829 [ 1853.160733] RDX: 0000000000000002 RSI: 00000000400455c8 RDI: 0000000000000003 [ 1853.168003] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 1853.175277] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f15703326d4 [ 1853.182563] R13: 00000000004c250e R14: 00000000004d5930 R15: 0000000000000004 [ 1853.195847] CPU: 0 PID: 3792 Comm: syz-executor.0 Not tainted 4.19.62 #36 [ 1853.202846] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1853.212205] Call Trace: [ 1853.212229] dump_stack+0x172/0x1f0 [ 1853.212251] should_fail.cold+0xa/0x1b [ 1853.212267] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 1853.212281] ? lock_downgrade+0x810/0x810 [ 1853.212306] __should_failslab+0x121/0x190 [ 1853.212330] should_failslab+0x9/0x14 [ 1853.212343] kmem_cache_alloc_trace+0x2cc/0x760 [ 1853.212358] ? __lockdep_init_map+0x10c/0x5b0 [ 1853.212382] h5_open+0x4e1/0x5e0 [ 1853.222454] ? h5_rx_crc+0x20/0x20 [ 1853.222472] ? device_initialize+0x1a1/0x440 [ 1853.222495] ? hci_init_sysfs+0x7c/0xa0 [ 1853.231831] hci_uart_tty_ioctl+0x704/0xaf0 [ 1853.231853] tty_ioctl+0x8b5/0x1510 [ 1853.231870] ? hci_uart_init_work+0x140/0x140 [ 1853.239877] ? tty_vhangup+0x30/0x30 [ 1853.239891] ? mark_held_locks+0x100/0x100 [ 1853.239915] ? __fget+0x340/0x540 [ 1853.239937] ? __might_sleep+0x95/0x190 [ 1853.239954] ? tty_vhangup+0x30/0x30 [ 1853.239973] do_vfs_ioctl+0xd5f/0x1380 [ 1853.239987] ? selinux_file_ioctl+0x46f/0x5e0 [ 1853.240002] ? selinux_file_ioctl+0x125/0x5e0 [ 1853.256031] ? ioctl_preallocate+0x210/0x210 [ 1853.256049] ? selinux_file_mprotect+0x620/0x620 [ 1853.256071] ? iterate_fd+0x360/0x360 [ 1853.264454] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1853.264470] ? fput+0x128/0x1a0 [ 1853.264494] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1853.277155] ? security_file_ioctl+0x8d/0xc0 [ 1853.277177] ksys_ioctl+0xab/0xd0 [ 1853.277195] __x64_sys_ioctl+0x73/0xb0 [ 1853.349032] do_syscall_64+0xfd/0x620 [ 1853.352838] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1853.358025] RIP: 0033:0x459829 [ 1853.361214] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1853.380213] RSP: 002b:00007f655e432c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1853.387936] RAX: ffffffffffffffda RBX: 00007f655e432c90 RCX: 0000000000459829 [ 1853.395202] RDX: 0000000000000002 RSI: 00000000400455c8 RDI: 0000000000000003 [ 1853.402493] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 1853.409765] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f655e4336d4 [ 1853.417160] R13: 00000000004c250e R14: 00000000004d5930 R15: 0000000000000004 13:00:39 executing program 0 (fault-call:2 fault-nth:2): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) 13:00:39 executing program 5 (fault-call:2 fault-nth:2): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) [ 1853.505007] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1853.523725] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. 13:00:39 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f305014c0b000500000000000100cf", 0x1f) 13:00:39 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5424, 0x2) [ 1853.616096] FAULT_INJECTION: forcing a failure. [ 1853.616096] name failslab, interval 1, probability 0, space 0, times 0 [ 1853.636226] CPU: 0 PID: 3809 Comm: syz-executor.0 Not tainted 4.19.62 #36 [ 1853.643208] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1853.652573] Call Trace: [ 1853.655186] dump_stack+0x172/0x1f0 [ 1853.658837] should_fail.cold+0xa/0x1b [ 1853.662750] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 1853.667870] ? lock_downgrade+0x810/0x810 [ 1853.672045] __should_failslab+0x121/0x190 [ 1853.676306] should_failslab+0x9/0x14 [ 1853.680122] kmem_cache_alloc_trace+0x2cc/0x760 [ 1853.684806] ? __lockdep_init_map+0x10c/0x5b0 [ 1853.689317] h5_open+0x4e1/0x5e0 [ 1853.692674] ? h5_rx_crc+0x20/0x20 [ 1853.696200] ? device_initialize+0x1a1/0x440 [ 1853.700688] ? hci_init_sysfs+0x7c/0xa0 [ 1853.704659] hci_uart_tty_ioctl+0x704/0xaf0 [ 1853.708975] tty_ioctl+0x8b5/0x1510 [ 1853.712593] ? hci_uart_init_work+0x140/0x140 [ 1853.717192] ? tty_vhangup+0x30/0x30 [ 1853.720903] ? mark_held_locks+0x100/0x100 [ 1853.725151] ? __fget+0x340/0x540 [ 1853.728612] ? __might_sleep+0x95/0x190 [ 1853.732632] ? tty_vhangup+0x30/0x30 [ 1853.736366] do_vfs_ioctl+0xd5f/0x1380 [ 1853.740248] ? selinux_file_ioctl+0x46f/0x5e0 [ 1853.744743] ? selinux_file_ioctl+0x125/0x5e0 [ 1853.749227] ? ioctl_preallocate+0x210/0x210 [ 1853.753626] ? selinux_file_mprotect+0x620/0x620 [ 1853.758383] ? iterate_fd+0x360/0x360 [ 1853.762174] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1853.767722] ? fput+0x128/0x1a0 [ 1853.771002] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1853.776533] ? security_file_ioctl+0x8d/0xc0 [ 1853.780994] ksys_ioctl+0xab/0xd0 [ 1853.784435] __x64_sys_ioctl+0x73/0xb0 [ 1853.788503] do_syscall_64+0xfd/0x620 [ 1853.792310] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1853.797494] RIP: 0033:0x459829 [ 1853.800681] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1853.819573] RSP: 002b:00007f655e432c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1853.827277] RAX: ffffffffffffffda RBX: 00007f655e432c90 RCX: 0000000000459829 [ 1853.834556] RDX: 0000000000000002 RSI: 00000000400455c8 RDI: 0000000000000003 [ 1853.841820] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 1853.849096] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f655e4336d4 [ 1853.856357] R13: 00000000004c250e R14: 00000000004d5930 R15: 0000000000000004 [ 1853.880547] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1853.898229] FAULT_INJECTION: forcing a failure. [ 1853.898229] name failslab, interval 1, probability 0, space 0, times 0 [ 1853.927817] CPU: 0 PID: 3813 Comm: syz-executor.5 Not tainted 4.19.62 #36 [ 1853.934877] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1853.944243] Call Trace: [ 1853.946873] dump_stack+0x172/0x1f0 [ 1853.950519] should_fail.cold+0xa/0x1b [ 1853.954420] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 1853.959747] ? mark_held_locks+0xb1/0x100 [ 1853.963907] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 1853.969063] ? __debug_object_init+0x190/0xc30 [ 1853.973665] __should_failslab+0x121/0x190 [ 1853.978079] should_failslab+0x9/0x14 [ 1853.981974] kmem_cache_alloc_node+0x56/0x710 [ 1853.986477] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 1853.991744] ? __debug_object_init+0x190/0xc30 [ 1853.996324] __alloc_skb+0xd5/0x5f0 [ 1853.999944] ? skb_scrub_packet+0x490/0x490 [ 1854.004276] ? __lockdep_init_map+0x10c/0x5b0 [ 1854.008770] h5_link_control.isra.0+0x2f/0xa0 [ 1854.013343] h5_open+0x435/0x5e0 [ 1854.016698] ? h5_rx_crc+0x20/0x20 [ 1854.020233] ? device_initialize+0x1a1/0x440 [ 1854.024728] ? hci_init_sysfs+0x7c/0xa0 [ 1854.028712] hci_uart_tty_ioctl+0x704/0xaf0 [ 1854.033032] tty_ioctl+0x8b5/0x1510 [ 1854.036651] ? hci_uart_init_work+0x140/0x140 [ 1854.041178] ? tty_vhangup+0x30/0x30 [ 1854.044882] ? mark_held_locks+0x100/0x100 [ 1854.049137] ? __fget+0x340/0x540 [ 1854.052604] ? __might_sleep+0x95/0x190 [ 1854.056586] ? tty_vhangup+0x30/0x30 [ 1854.060590] do_vfs_ioctl+0xd5f/0x1380 [ 1854.064480] ? selinux_file_ioctl+0x46f/0x5e0 [ 1854.068976] ? selinux_file_ioctl+0x125/0x5e0 [ 1854.073461] ? ioctl_preallocate+0x210/0x210 [ 1854.077872] ? selinux_file_mprotect+0x620/0x620 [ 1854.082737] ? iterate_fd+0x360/0x360 [ 1854.086615] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1854.092383] ? fput+0x128/0x1a0 [ 1854.095660] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1854.101317] ? security_file_ioctl+0x8d/0xc0 [ 1854.105776] ksys_ioctl+0xab/0xd0 [ 1854.109223] __x64_sys_ioctl+0x73/0xb0 [ 1854.113109] do_syscall_64+0xfd/0x620 [ 1854.116900] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1854.122082] RIP: 0033:0x459829 [ 1854.125265] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1854.144600] RSP: 002b:00007f1570331c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1854.152472] RAX: ffffffffffffffda RBX: 00007f1570331c90 RCX: 0000000000459829 [ 1854.159922] RDX: 0000000000000002 RSI: 00000000400455c8 RDI: 0000000000000003 [ 1854.167193] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 1854.174466] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f15703326d4 [ 1854.181730] R13: 00000000004c250e R14: 00000000004d5930 R15: 0000000000000004 [ 1855.337809] Bluetooth: hci0: command 0x1003 tx timeout [ 1855.343211] Bluetooth: hci0: sending frame failed (-49) [ 1856.217940] Bluetooth: hci1: command 0x1003 tx timeout [ 1856.223393] Bluetooth: hci1: sending frame failed (-49) [ 1857.417760] Bluetooth: hci0: command 0x1001 tx timeout [ 1857.423326] Bluetooth: hci0: sending frame failed (-49) [ 1858.297740] Bluetooth: hci1: command 0x1001 tx timeout [ 1858.303153] Bluetooth: hci1: sending frame failed (-49) [ 1859.497804] Bluetooth: hci0: command 0x1009 tx timeout [ 1860.377961] Bluetooth: hci1: command 0x1009 tx timeout 13:00:49 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="11dca5055e0bcfe47bf070") r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uhid\x00', 0x400000002, 0x0) write$UHID_CREATE(r2, &(0x7f0000001080)={0x0, 'syz1\x00', 'syz1\x00', 'syz0\x00', &(0x7f0000000000)=""/11, 0xb}, 0x120) write$UHID_DESTROY(r2, &(0x7f0000000280), 0xfed0) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000000)=0x0) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r3, 0x10, &(0x7f0000000040)={0xffff}) 13:00:49 executing program 1: socket$alg(0x26, 0x5, 0x0) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)) prctl$PR_SET_CHILD_SUBREAPER(0x24, 0x1) 13:00:49 executing program 0 (fault-call:2 fault-nth:3): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) 13:00:49 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501600b000500000000000100cf", 0x1f) 13:00:49 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5425, 0x2) 13:00:50 executing program 5 (fault-call:2 fault-nth:3): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) [ 1864.416390] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1864.437358] FAULT_INJECTION: forcing a failure. [ 1864.437358] name failslab, interval 1, probability 0, space 0, times 0 [ 1864.447986] FAULT_INJECTION: forcing a failure. [ 1864.447986] name failslab, interval 1, probability 0, space 0, times 0 [ 1864.467144] CPU: 1 PID: 3832 Comm: syz-executor.0 Not tainted 4.19.62 #36 [ 1864.474106] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1864.483467] Call Trace: [ 1864.483493] dump_stack+0x172/0x1f0 [ 1864.483514] should_fail.cold+0xa/0x1b [ 1864.493782] ? SOFTIRQ_verbose+0x10/0x10 [ 1864.497867] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 1864.502978] ? __debug_object_init+0x190/0xc30 [ 1864.502998] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1864.503013] ? should_fail+0x14d/0x85c 13:00:50 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5427, 0x2) [ 1864.517197] __should_failslab+0x121/0x190 [ 1864.521457] should_failslab+0x9/0x14 [ 1864.525281] kmem_cache_alloc_node_trace+0x5a/0x720 [ 1864.530319] ? __alloc_skb+0xd5/0x5f0 [ 1864.534149] __kmalloc_node_track_caller+0x3d/0x80 [ 1864.539110] __kmalloc_reserve.isra.0+0x40/0xf0 [ 1864.543892] __alloc_skb+0x10b/0x5f0 [ 1864.547624] ? skb_scrub_packet+0x490/0x490 [ 1864.552051] ? __lockdep_init_map+0x10c/0x5b0 [ 1864.556576] h5_link_control.isra.0+0x2f/0xa0 [ 1864.561095] h5_open+0x435/0x5e0 [ 1864.564492] ? h5_rx_crc+0x20/0x20 [ 1864.568041] ? device_initialize+0x1a1/0x440 [ 1864.568058] ? hci_init_sysfs+0x7c/0xa0 [ 1864.568080] hci_uart_tty_ioctl+0x704/0xaf0 [ 1864.568101] tty_ioctl+0x8b5/0x1510 [ 1864.568115] ? hci_uart_init_work+0x140/0x140 [ 1864.568132] ? tty_vhangup+0x30/0x30 [ 1864.568147] ? mark_held_locks+0x100/0x100 [ 1864.576518] ? __fget+0x340/0x540 [ 1864.588927] ? __might_sleep+0x95/0x190 [ 1864.588945] ? tty_vhangup+0x30/0x30 [ 1864.588963] do_vfs_ioctl+0xd5f/0x1380 [ 1864.588979] ? selinux_file_ioctl+0x46f/0x5e0 13:00:50 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501680b000500000000000100cf", 0x1f) [ 1864.588991] ? selinux_file_ioctl+0x125/0x5e0 [ 1864.589007] ? ioctl_preallocate+0x210/0x210 [ 1864.589020] ? selinux_file_mprotect+0x620/0x620 [ 1864.589043] ? iterate_fd+0x360/0x360 [ 1864.589065] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1864.589077] ? fput+0x128/0x1a0 [ 1864.589101] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1864.602520] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 1864.604460] ? security_file_ioctl+0x8d/0xc0 [ 1864.604482] ksys_ioctl+0xab/0xd0 [ 1864.604502] __x64_sys_ioctl+0x73/0xb0 [ 1864.604521] do_syscall_64+0xfd/0x620 [ 1864.604541] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1864.604553] RIP: 0033:0x459829 [ 1864.604568] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1864.604577] RSP: 002b:00007f655e432c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1864.604593] RAX: ffffffffffffffda RBX: 00007f655e432c90 RCX: 0000000000459829 [ 1864.604603] RDX: 0000000000000002 RSI: 00000000400455c8 RDI: 0000000000000003 [ 1864.604611] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 1864.604620] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f655e4336d4 [ 1864.604629] R13: 00000000004c250e R14: 00000000004d5930 R15: 0000000000000004 [ 1864.645198] CPU: 1 PID: 3831 Comm: syz-executor.5 Not tainted 4.19.62 #36 [ 1864.660746] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1864.660751] Call Trace: [ 1864.660773] dump_stack+0x172/0x1f0 [ 1864.660793] should_fail.cold+0xa/0x1b [ 1864.660809] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 1864.660824] ? mark_held_locks+0xb1/0x100 [ 1864.660839] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 1864.660858] ? __debug_object_init+0x190/0xc30 [ 1864.660881] __should_failslab+0x121/0x190 [ 1864.660900] should_failslab+0x9/0x14 [ 1864.660913] kmem_cache_alloc_node+0x56/0x710 [ 1864.660923] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 1864.660937] ? __debug_object_init+0x190/0xc30 [ 1864.660958] __alloc_skb+0xd5/0x5f0 [ 1864.703783] ? skb_scrub_packet+0x490/0x490 [ 1864.703802] ? __lockdep_init_map+0x10c/0x5b0 [ 1864.703827] h5_link_control.isra.0+0x2f/0xa0 [ 1864.703849] h5_open+0x435/0x5e0 [ 1864.703864] ? h5_rx_crc+0x20/0x20 [ 1864.703878] ? device_initialize+0x1a1/0x440 [ 1864.703894] ? hci_init_sysfs+0x7c/0xa0 [ 1864.703916] hci_uart_tty_ioctl+0x704/0xaf0 [ 1864.703936] tty_ioctl+0x8b5/0x1510 [ 1864.703949] ? hci_uart_init_work+0x140/0x140 [ 1864.703964] ? tty_vhangup+0x30/0x30 13:00:50 executing program 1: socket$alg(0x26, 0x5, 0x0) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)) prctl$PR_SET_CHILD_SUBREAPER(0x24, 0x1) [ 1864.703975] ? mark_held_locks+0x100/0x100 [ 1864.704005] ? __fget+0x340/0x540 [ 1864.721350] hid (null): unknown global tag 0xe [ 1864.726264] ? __might_sleep+0x95/0x190 [ 1864.726284] ? tty_vhangup+0x30/0x30 [ 1864.726302] do_vfs_ioctl+0xd5f/0x1380 [ 1864.726322] ? selinux_file_ioctl+0x46f/0x5e0 [ 1864.748131] ? selinux_file_ioctl+0x125/0x5e0 [ 1864.748150] ? ioctl_preallocate+0x210/0x210 [ 1864.748162] ? selinux_file_mprotect+0x620/0x620 [ 1864.748185] ? iterate_fd+0x360/0x360 [ 1864.748201] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1864.748215] ? fput+0x128/0x1a0 [ 1864.748234] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1864.748251] ? security_file_ioctl+0x8d/0xc0 [ 1864.748268] ksys_ioctl+0xab/0xd0 [ 1864.748285] __x64_sys_ioctl+0x73/0xb0 [ 1864.748303] do_syscall_64+0xfd/0x620 [ 1864.748322] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1864.748334] RIP: 0033:0x459829 [ 1864.748347] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1864.748359] RSP: 002b:00007f1570331c78 EFLAGS: 00000246 [ 1864.764651] ORIG_RAX: 0000000000000010 [ 1864.764662] RAX: ffffffffffffffda RBX: 00007f1570331c90 RCX: 0000000000459829 [ 1864.764671] RDX: 0000000000000002 RSI: 00000000400455c8 RDI: 0000000000000003 [ 1864.764684] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 13:00:50 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5428, 0x2) 13:00:50 executing program 0 (fault-call:2 fault-nth:4): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) 13:00:50 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f305016c0b000500000000000100cf", 0x1f) [ 1864.779852] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f15703326d4 [ 1864.779861] R13: 00000000004c250e R14: 00000000004d5930 R15: 0000000000000004 [ 1864.844812] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1864.899849] hid-generic 0000:0000:0000.0003: unknown main item tag 0x1 [ 1865.048439] hid-generic 0000:0000:0000.0003: unknown global tag 0xe [ 1865.098062] FAULT_INJECTION: forcing a failure. [ 1865.098062] name failslab, interval 1, probability 0, space 0, times 0 [ 1865.122890] hid-generic 0000:0000:0000.0003: item 0 0 1 14 parsing failed [ 1865.134992] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1865.143663] hid-generic: probe of 0000:0000:0000.0003 failed with error -22 [ 1865.159331] CPU: 0 PID: 3853 Comm: syz-executor.0 Not tainted 4.19.62 #36 [ 1865.166307] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1865.175673] Call Trace: [ 1865.178287] dump_stack+0x172/0x1f0 [ 1865.181947] should_fail.cold+0xa/0x1b [ 1865.185852] ? SOFTIRQ_verbose+0x10/0x10 [ 1865.189931] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 1865.195048] ? __debug_object_init+0x190/0xc30 [ 1865.199644] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1865.205195] ? should_fail+0x14d/0x85c [ 1865.209103] __should_failslab+0x121/0x190 [ 1865.213358] should_failslab+0x9/0x14 [ 1865.217164] kmem_cache_alloc_node_trace+0x5a/0x720 [ 1865.222187] ? __alloc_skb+0xd5/0x5f0 [ 1865.225990] __kmalloc_node_track_caller+0x3d/0x80 [ 1865.230929] __kmalloc_reserve.isra.0+0x40/0xf0 [ 1865.235607] __alloc_skb+0x10b/0x5f0 [ 1865.239344] ? skb_scrub_packet+0x490/0x490 [ 1865.243672] ? __lockdep_init_map+0x10c/0x5b0 [ 1865.248182] h5_link_control.isra.0+0x2f/0xa0 [ 1865.252786] h5_open+0x435/0x5e0 [ 1865.254269] hid (null): unknown global tag 0xe [ 1865.256164] ? h5_rx_crc+0x20/0x20 [ 1865.264273] ? device_initialize+0x1a1/0x440 [ 1865.264299] ? hci_init_sysfs+0x7c/0xa0 [ 1865.264322] hci_uart_tty_ioctl+0x704/0xaf0 [ 1865.264342] tty_ioctl+0x8b5/0x1510 [ 1865.272695] ? hci_uart_init_work+0x140/0x140 [ 1865.272715] ? tty_vhangup+0x30/0x30 [ 1865.272729] ? mark_held_locks+0x100/0x100 [ 1865.272755] ? __fget+0x340/0x540 [ 1865.280684] ? __might_sleep+0x95/0x190 [ 1865.280702] ? tty_vhangup+0x30/0x30 [ 1865.280722] do_vfs_ioctl+0xd5f/0x1380 [ 1865.280738] ? selinux_file_ioctl+0x46f/0x5e0 [ 1865.280753] ? selinux_file_ioctl+0x125/0x5e0 [ 1865.280766] ? ioctl_preallocate+0x210/0x210 [ 1865.280781] ? selinux_file_mprotect+0x620/0x620 [ 1865.291095] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 1865.293197] ? iterate_fd+0x360/0x360 [ 1865.293217] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1865.293232] ? fput+0x128/0x1a0 [ 1865.293252] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1865.296823] hid-generic 0000:0000:0000.0004: unknown global tag 0xe [ 1865.300654] ? security_file_ioctl+0x8d/0xc0 [ 1865.300673] ksys_ioctl+0xab/0xd0 [ 1865.300692] __x64_sys_ioctl+0x73/0xb0 [ 1865.300712] do_syscall_64+0xfd/0x620 [ 1865.300734] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1865.300748] RIP: 0033:0x459829 [ 1865.304754] hid-generic 0000:0000:0000.0004: item 0 0 1 14 parsing failed [ 1865.308323] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1865.308332] RSP: 002b:00007f655e432c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1865.308349] RAX: ffffffffffffffda RBX: 00007f655e432c90 RCX: 0000000000459829 [ 1865.308358] RDX: 0000000000000002 RSI: 00000000400455c8 RDI: 0000000000000003 [ 1865.308367] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 1865.308376] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f655e4336d4 [ 1865.308384] R13: 00000000004c250e R14: 00000000004d5930 R15: 0000000000000004 [ 1865.315419] hid-generic: probe of 0000:0000:0000.0004 failed with error -22 [ 1865.447927] Bluetooth: Invalid header checksum [ 1866.937774] Bluetooth: hci0: command 0x1003 tx timeout [ 1866.943195] Bluetooth: hci0: sending frame failed (-49) [ 1869.017766] Bluetooth: hci0: command 0x1001 tx timeout [ 1869.023234] Bluetooth: hci0: sending frame failed (-49) [ 1871.097834] Bluetooth: hci0: command 0x1009 tx timeout 13:01:00 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/autofs\x00', 0x300ffd, 0x0) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r1, &(0x7f00000003c0)={0x40000000}) write$USERIO_CMD_REGISTER(r1, &(0x7f0000000040)={0x0, 0x3}, 0x2) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0)='TIPC\x00') sendmsg$TIPC_CMD_RESET_LINK_STATS(r1, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2101}, 0xc, &(0x7f0000000340)={&(0x7f0000000540)=ANY=[@ANYBLOB="280000008802b251f388f0e56942c5cca703c3e956de2ac188801af56327dab0626bd3952f21500393a9648075df3bba315da08c9f7e8f7e603cf14011dbe3d3709893571c9e960f1c4361684d43cfd5b9c48b839a196fad529ad3624af8a1a020e640d28563414a80e137b0d84e710c2a83432b00b8fe7d32d82ec97e357233f8599176835dac1f4f9901fae05a0ec39bd810662c7db356e56bde84b8027a3a0196e64715a9f4f457efd9be47a4c134d26dd1df39e50c98efb4b67ac9029833ddfe98dd56a0b549690e62fae890b380e9545f2b636a6cc85d98bf48c82730b4eb39a774a5f786856a7a81aecd8805e288e9594062f6c620728d43413e00616329587597c709c4a30cb301ecb8dcf852e3cbafb9a40dc4e5b5d9502589b449bc20d403d41cc36980f899616aabefade3ddfaf5b204e1dcad06a25e831d4ddeab37c3b2b819c8c29d560fac2fd01c1ea526a3d54d18c070285a3fa327d41b1048b9b942144b53dec46962bd4ee0e98f02be0ae414f2e768cbcee3352db960cbd5e32ad8beed41964fe481ff2f44c3566657ceb7e81375185aff94d11d9005b634df8e9efea0f17d99e39cf9076d368e299e34569993363647bb03b38cce38bf64ddfd0ffbf96233fb708430de5cf8efbcf6dd90fa0242b08d673a21c1d936523c8628e619", @ANYRES16=r2, @ANYBLOB="02062bbd7000fcdbdf2501000000000000000c410000000c001473797a3100000000"], 0x28}, 0x1, 0x0, 0x0, 0x40000}, 0x20000841) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) r3 = syz_genetlink_get_family_id$fou(&(0x7f0000000100)='fou\x00') sendmsg$FOU_CMD_ADD(r1, &(0x7f0000000200)={&(0x7f0000000000), 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x48, r3, 0x20, 0x70bd2d, 0x25dfdbff, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @loopback}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PEER_V6={0x14, 0x9, @dev={0xfe, 0x80, [], 0xe}}, @FOU_ATTR_PEER_V6={0x14, 0x9, @loopback}]}, 0x48}, 0x1, 0x0, 0x0, 0x8000}, 0x20000085) syz_open_dev$dmmidi(&(0x7f0000000300)='/dev/dmmidi#\x00', 0x0, 0x0) 13:01:00 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501740b000500000000000100cf", 0x1f) 13:01:00 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x2) 13:01:00 executing program 5 (fault-call:2 fault-nth:4): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) 13:01:00 executing program 1: socket$alg(0x26, 0x5, 0x0) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)) prctl$PR_SET_CHILD_SUBREAPER(0x24, 0x1) 13:01:00 executing program 0 (fault-call:2 fault-nth:5): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) [ 1875.333294] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1875.349583] FAULT_INJECTION: forcing a failure. [ 1875.349583] name failslab, interval 1, probability 0, space 0, times 0 13:01:01 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5441, 0x2) [ 1875.379127] CPU: 0 PID: 3879 Comm: syz-executor.5 Not tainted 4.19.62 #36 [ 1875.386567] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1875.397074] Call Trace: [ 1875.399697] dump_stack+0x172/0x1f0 [ 1875.403360] should_fail.cold+0xa/0x1b [ 1875.407282] ? SOFTIRQ_verbose+0x10/0x10 [ 1875.411371] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 1875.411392] ? __debug_object_init+0x190/0xc30 [ 1875.421077] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1875.421092] ? should_fail+0x14d/0x85c [ 1875.421114] __should_failslab+0x121/0x190 [ 1875.421133] should_failslab+0x9/0x14 [ 1875.421152] kmem_cache_alloc_node_trace+0x5a/0x720 [ 1875.421172] ? __alloc_skb+0xd5/0x5f0 [ 1875.421199] __kmalloc_node_track_caller+0x3d/0x80 [ 1875.421218] __kmalloc_reserve.isra.0+0x40/0xf0 [ 1875.421239] __alloc_skb+0x10b/0x5f0 [ 1875.421259] ? skb_scrub_packet+0x490/0x490 [ 1875.421277] ? __lockdep_init_map+0x10c/0x5b0 [ 1875.421305] h5_link_control.isra.0+0x2f/0xa0 [ 1875.474502] h5_open+0x435/0x5e0 [ 1875.477867] ? h5_rx_crc+0x20/0x20 [ 1875.481406] ? device_initialize+0x1a1/0x440 [ 1875.485867] ? hci_init_sysfs+0x7c/0xa0 [ 1875.489879] hci_uart_tty_ioctl+0x704/0xaf0 [ 1875.494220] tty_ioctl+0x8b5/0x1510 [ 1875.497861] ? hci_uart_init_work+0x140/0x140 [ 1875.502368] ? tty_vhangup+0x30/0x30 [ 1875.506075] ? mark_held_locks+0x100/0x100 [ 1875.510417] ? __fget+0x340/0x540 [ 1875.513873] ? __might_sleep+0x95/0x190 [ 1875.517854] ? tty_vhangup+0x30/0x30 [ 1875.521579] do_vfs_ioctl+0xd5f/0x1380 [ 1875.525459] ? selinux_file_ioctl+0x46f/0x5e0 [ 1875.529976] ? selinux_file_ioctl+0x125/0x5e0 [ 1875.534469] ? ioctl_preallocate+0x210/0x210 [ 1875.538888] ? selinux_file_mprotect+0x620/0x620 [ 1875.543651] ? iterate_fd+0x360/0x360 [ 1875.547445] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1875.552988] ? fput+0x128/0x1a0 [ 1875.556290] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1875.561846] ? security_file_ioctl+0x8d/0xc0 [ 1875.566263] ksys_ioctl+0xab/0xd0 [ 1875.569751] __x64_sys_ioctl+0x73/0xb0 [ 1875.573644] do_syscall_64+0xfd/0x620 [ 1875.577445] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1875.582626] RIP: 0033:0x459829 [ 1875.585825] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1875.604746] RSP: 002b:00007f1570331c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1875.612478] RAX: ffffffffffffffda RBX: 00007f1570331c90 RCX: 0000000000459829 [ 1875.619768] RDX: 0000000000000002 RSI: 00000000400455c8 RDI: 0000000000000003 [ 1875.627042] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 1875.634333] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f15703326d4 [ 1875.641632] R13: 00000000004c250e R14: 00000000004d5930 R15: 0000000000000004 13:01:01 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f305017a0b000500000000000100cf", 0x1f) [ 1875.702371] Bluetooth: hci0: Frame reassembly failed (-84) [ 1875.705566] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. 13:01:01 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) 13:01:01 executing program 5 (fault-call:2 fault-nth:5): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) 13:01:01 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5450, 0x2) 13:01:01 executing program 1: socket$alg(0x26, 0x5, 0x0) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1875.803345] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 1876.129886] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 1877.737716] Bluetooth: hci0: command 0x1003 tx timeout [ 1877.743111] Bluetooth: hci0: sending frame failed (-49) [ 1878.537765] Bluetooth: hci1: command 0x1003 tx timeout [ 1878.543336] Bluetooth: hci1: sending frame failed (-49) [ 1879.817746] Bluetooth: hci0: command 0x1001 tx timeout [ 1879.823337] Bluetooth: hci0: sending frame failed (-49) [ 1880.617773] Bluetooth: hci1: command 0x1001 tx timeout [ 1880.623192] Bluetooth: hci1: sending frame failed (-49) [ 1881.897760] Bluetooth: hci0: command 0x1009 tx timeout [ 1882.697770] Bluetooth: hci1: command 0x1009 tx timeout 13:01:12 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x2, 0x2) 13:01:12 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501e00b000500000000000100cf", 0x1f) 13:01:12 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5451, 0x2) 13:01:12 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) 13:01:12 executing program 2: r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) sendmsg$TEAM_CMD_NOOP(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000080)={0xfffffffffffffffe}, 0x1, 0x0, 0x0, 0x80}, 0x40000) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r1, 0x5437, 0x0) 13:01:12 executing program 1: socket$alg(0x26, 0x5, 0x0) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 1886.817107] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 13:01:12 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f305010012000500000000000100cf", 0x1f) 13:01:12 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5452, 0x2) [ 1886.901318] Bluetooth: hci0: Frame reassembly failed (-84) 13:01:12 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x4b47, 0x2) [ 1886.959461] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. 13:01:12 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x2, 0x2) [ 1887.000103] netlink: 11 bytes leftover after parsing attributes in process `syz-executor.4'. 13:01:12 executing program 1: socket$alg(0x26, 0x5, 0x0) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 13:01:12 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x545d, 0x2) 13:01:12 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f305010052000500000000000100cf", 0x1f) 13:01:12 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x4b49, 0x2) 13:01:12 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x4b47, 0x2) [ 1887.208668] netlink: 11 bytes leftover after parsing attributes in process `syz-executor.4'. 13:01:12 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5409, 0x2) [ 1887.372642] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 1888.937727] Bluetooth: hci0: command 0x1003 tx timeout [ 1888.943167] Bluetooth: hci0: sending frame failed (-49) [ 1889.737726] Bluetooth: hci1: command 0x1003 tx timeout [ 1889.743188] Bluetooth: hci1: sending frame failed (-49) [ 1891.017824] Bluetooth: hci0: command 0x1001 tx timeout [ 1891.023242] Bluetooth: hci0: sending frame failed (-49) [ 1891.817806] Bluetooth: hci1: command 0x1001 tx timeout [ 1891.823223] Bluetooth: hci1: sending frame failed (-49) [ 1893.097824] Bluetooth: hci0: command 0x1009 tx timeout [ 1893.897837] Bluetooth: hci1: command 0x1009 tx timeout 13:01:23 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f305010003000500000000000100cf", 0x1f) 13:01:23 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5460, 0x2) 13:01:23 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x4b49, 0x2) 13:01:23 executing program 1: socket$alg(0x26, 0x5, 0x0) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 13:01:23 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/mls\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000000140)=ANY=[@ANYRES32=0x0, @ANYBLOB="3a0000005b02cd88b79706df2b01fc7482657b0fa76809b65e69c9d531fc3364c583269b831008491e11b5dabd32a635"], &(0x7f00000001c0)=0x42) syz_open_pts(r1, 0x0) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000000000)={r2, 0xffffffff}, &(0x7f0000000040)=0xa0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x1) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 13:01:23 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x540b, 0x2) [ 1898.358663] netlink: 11 bytes leftover after parsing attributes in process `syz-executor.4'. 13:01:24 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x40045431, 0x2) 13:01:24 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x540c, 0x2) 13:01:24 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f305010012000500000000000100cf", 0x1f) 13:01:24 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x3, 0x70, 0x9, 0x9, 0x8001, 0x754, 0x0, 0x66c1a98e, 0x0, 0x1, 0x4, 0xfffffffffffffffc, 0xb2, 0xb41, 0x8, 0x100, 0x7ff, 0x8, 0x3f, 0x5, 0x0, 0x9, 0x3, 0x80, 0xfffffffffffffffe, 0x9, 0x8001, 0x8, 0x1f, 0x0, 0x1, 0x1, 0x8, 0x10001, 0x401, 0x4, 0xc4e, 0x0, 0x0, 0x80000000, 0x2, @perf_config_ext={0x1, 0x2}, 0x8, 0x5, 0x2, 0x8, 0x100000001, 0x6, 0x1000}, r1, 0xe, 0xffffffffffffffff, 0x0) 13:01:24 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5409, 0x2) [ 1898.539142] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 1898.561033] netlink: 11 bytes leftover after parsing attributes in process `syz-executor.4'. 13:01:24 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x540d, 0x2) 13:01:24 executing program 1: socket$alg(0x26, 0x5, 0x0) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1898.626453] Bluetooth: hci0: Frame reassembly failed (-84) 13:01:24 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x40045436, 0x2) 13:01:24 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x540b, 0x2) 13:01:24 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f305010052000500000000000100cf", 0x1f) 13:01:24 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x40049409, 0x2) 13:01:24 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x540e, 0x2) [ 1898.822258] netlink: 11 bytes leftover after parsing attributes in process `syz-executor.4'. 13:01:24 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x540c, 0x2) 13:01:24 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b020500000000000100cf", 0x1f) 13:01:24 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x40086602, 0x2) [ 1899.068688] overlayfs: lowerdir is in-use as upperdir/workdir [ 1899.112724] netlink: 11 bytes leftover after parsing attributes in process `syz-executor.4'. [ 1900.697773] Bluetooth: hci0: command 0x1003 tx timeout [ 1900.703174] Bluetooth: hci0: sending frame failed (-49) [ 1901.427742] Bluetooth: hci1: command 0x1003 tx timeout [ 1901.433156] Bluetooth: hci1: sending frame failed (-49) [ 1902.777821] Bluetooth: hci0: command 0x1001 tx timeout [ 1902.783227] Bluetooth: hci0: sending frame failed (-49) [ 1903.497805] Bluetooth: hci1: command 0x1001 tx timeout [ 1903.503386] Bluetooth: hci1: sending frame failed (-49) [ 1904.857776] Bluetooth: hci0: command 0x1009 tx timeout [ 1905.577818] Bluetooth: hci1: command 0x1009 tx timeout 13:01:35 executing program 1: socket$alg(0x26, 0x5, 0x0) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 13:01:35 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x200, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x101400, 0x0) ioctl$VIDIOC_ENUM_FREQ_BANDS(r1, 0xc0405665, &(0x7f0000000040)={0x9, 0x1, 0x5f, 0x100, 0xfffffffffffffffd, 0x5, 0x2}) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0x400000000f) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) ioctl$KDGKBMETA(r0, 0x4b62, &(0x7f0000000080)) 13:01:35 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x540f, 0x2) 13:01:35 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x540d, 0x2) 13:01:35 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b030500000000000100cf", 0x1f) 13:01:35 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x40087602, 0x2) [ 1909.867404] netlink: 11 bytes leftover after parsing attributes in process `syz-executor.4'. 13:01:35 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x540e, 0x2) 13:01:35 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5410, 0x2) 13:01:35 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x4020940d, 0x2) 13:01:35 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b040500000000000100cf", 0x1f) [ 1909.990737] overlayfs: lowerdir is in-use as upperdir/workdir 13:01:35 executing program 1: socket$alg(0x26, 0x5, 0x0) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1910.080402] netlink: 11 bytes leftover after parsing attributes in process `syz-executor.4'. 13:01:35 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x540f, 0x2) 13:01:35 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5412, 0x2) [ 1910.336237] overlayfs: lowerdir is in-use as upperdir/workdir [ 1911.977819] Bluetooth: hci0: command 0x1003 tx timeout [ 1911.983223] Bluetooth: hci0: sending frame failed (-49) [ 1912.777875] Bluetooth: hci1: command 0x1003 tx timeout [ 1912.783293] Bluetooth: hci1: sending frame failed (-49) [ 1914.057843] Bluetooth: hci0: command 0x1001 tx timeout [ 1914.064663] Bluetooth: hci0: sending frame failed (-49) [ 1914.857925] Bluetooth: hci1: command 0x1001 tx timeout [ 1914.863367] Bluetooth: hci1: sending frame failed (-49) [ 1916.137798] Bluetooth: hci0: command 0x1009 tx timeout [ 1916.937858] Bluetooth: hci1: command 0x1009 tx timeout 13:01:46 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x11c010, 0xffffffffffffffff, 0x0) madvise(&(0x7f000007c000/0x4000)=nil, 0x4000, 0xf) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x9) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 13:01:46 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x80045430, 0x2) 13:01:46 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b050500000000000100cf", 0x1f) 13:01:46 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5413, 0x2) 13:01:46 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5410, 0x2) 13:01:46 executing program 1: socket$alg(0x26, 0x5, 0x0) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1921.375687] netlink: 11 bytes leftover after parsing attributes in process `syz-executor.4'. 13:01:47 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5412, 0x2) 13:01:47 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b060500000000000100cf", 0x1f) 13:01:47 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5414, 0x2) 13:01:47 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x80045432, 0x2) [ 1921.461383] overlayfs: lowerdir is in-use as upperdir/workdir [ 1921.546956] netlink: 11 bytes leftover after parsing attributes in process `syz-executor.4'. 13:01:47 executing program 1: socket$alg(0x26, 0x5, 0x0) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 13:01:47 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5413, 0x2) [ 1921.778606] overlayfs: lowerdir is in-use as upperdir/workdir [ 1922.245154] Bluetooth: hci1: Frame reassembly failed (-84) [ 1923.577804] Bluetooth: hci0: command 0x1003 tx timeout [ 1923.583498] Bluetooth: hci0: sending frame failed (-49) [ 1924.297753] Bluetooth: hci1: command 0x1003 tx timeout [ 1924.303505] Bluetooth: hci1: sending frame failed (-49) [ 1925.657931] Bluetooth: hci0: command 0x1001 tx timeout [ 1925.664321] Bluetooth: hci0: sending frame failed (-49) [ 1926.377864] Bluetooth: hci1: command 0x1001 tx timeout [ 1926.383744] Bluetooth: hci1: sending frame failed (-49) [ 1927.737851] Bluetooth: hci0: command 0x1009 tx timeout [ 1928.457844] Bluetooth: hci1: command 0x1009 tx timeout 13:01:58 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5415, 0x2) 13:01:58 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b070500000000000100cf", 0x1f) 13:01:58 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) ioctl$TUNSETVNETLE(r1, 0x400454dc, &(0x7f0000000040)) 13:01:58 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x80045438, 0x2) 13:01:58 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5414, 0x2) 13:01:58 executing program 1: socket$alg(0x26, 0x5, 0x0) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1932.904040] netlink: 11 bytes leftover after parsing attributes in process `syz-executor.4'. 13:01:58 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x80045439, 0x2) [ 1932.956719] overlayfs: lowerdir is in-use as upperdir/workdir [ 1932.990847] Bluetooth: hci0: Frame reassembly failed (-84) 13:01:58 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5416, 0x2) 13:01:58 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b0a0500000000000100cf", 0x1f) 13:01:58 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5415, 0x2) 13:01:58 executing program 1: socket$alg(0x26, 0x5, 0x0) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1933.163360] netlink: 11 bytes leftover after parsing attributes in process `syz-executor.4'. 13:01:58 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5416, 0x2) 13:01:58 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x80045440, 0x2) 13:01:58 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b0e0500000000000100cf", 0x1f) [ 1933.265122] overlayfs: failed to resolve './file1': -2 [ 1933.365551] netlink: 11 bytes leftover after parsing attributes in process `syz-executor.4'. [ 1933.740776] Bluetooth: hci1: Frame reassembly failed (-84) [ 1933.746786] Bluetooth: hci1: Frame reassembly failed (-84) [ 1935.017781] Bluetooth: hci0: command 0x1003 tx timeout [ 1935.023192] Bluetooth: hci0: sending frame failed (-49) [ 1935.817755] Bluetooth: hci1: command 0x1003 tx timeout [ 1935.823233] Bluetooth: hci1: sending frame failed (-49) [ 1937.097729] Bluetooth: hci0: command 0x1001 tx timeout [ 1937.103142] Bluetooth: hci0: sending frame failed (-49) [ 1937.897817] Bluetooth: hci1: command 0x1001 tx timeout [ 1937.903430] Bluetooth: hci1: sending frame failed (-49) [ 1939.177798] Bluetooth: hci0: command 0x1009 tx timeout [ 1939.977794] Bluetooth: hci1: command 0x1009 tx timeout 13:02:09 executing program 1: socket$alg(0x26, 0x5, 0x0) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 13:02:09 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5418, 0x2) 13:02:09 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b0f0500000000000100cf", 0x1f) 13:02:09 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5418, 0x2) 13:02:10 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200)='/dev/hwrng\x00', 0x0, 0x0) ioctl$sock_inet6_udp_SIOCOUTQ(r1, 0x5411, &(0x7f0000000280)) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) r2 = syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') socket$inet(0x2, 0x80800, 0x8) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000100)={{{@in6=@remote, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@local}}, &(0x7f0000000080)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000007c0)={{{@in=@loopback, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in=@dev}}, &(0x7f00000008c0)=0xe8) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000900)={'bridge_slave_1\x00', 0x0}) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000940)={@initdev, @remote, 0x0}, &(0x7f0000000980)=0xc) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000009c0)={{{@in6=@remote, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@broadcast}}, &(0x7f0000000ac0)=0xe8) sendmsg$TEAM_CMD_PORT_LIST_GET(r0, &(0x7f0000000cc0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000c80)={&(0x7f0000000b00)={0x160, r2, 0x100, 0x70bd2d, 0x25dfdbfc, {}, [{{0x8, 0x1, r3}, {0x3c, 0x2, [{0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x8}}}]}}, {{0x8, 0x1, r4}, {0xbc, 0x2, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r5}}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x10000}}, {0x8, 0x6, r6}}}]}}, {{0x8, 0x1, r7}, {0x3c, 0x2, [{0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0xffffffff}}}]}}]}, 0x160}, 0x1, 0x0, 0x0, 0x840}, 0x4000004) 13:02:10 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x80086601, 0x2) [ 1944.444465] netlink: 11 bytes leftover after parsing attributes in process `syz-executor.4'. 13:02:10 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x80087601, 0x2) 13:02:10 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x541b, 0x2) 13:02:10 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x541b, 0x2) [ 1944.493780] overlayfs: failed to resolve './file1': -2 13:02:10 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b480500000000000100cf", 0x1f) [ 1944.541500] Bluetooth: hci0: Frame reassembly failed (-84) 13:02:10 executing program 1: socket$alg(0x26, 0x5, 0x0) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 13:02:10 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0xc0045878, 0x2) [ 1944.700774] netlink: 11 bytes leftover after parsing attributes in process `syz-executor.4'. [ 1944.763097] overlayfs: failed to resolve './file1': -2 13:02:10 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b4c0500000000000100cf", 0x1f) [ 1944.876621] netlink: 11 bytes leftover after parsing attributes in process `syz-executor.4'. [ 1945.275914] Bluetooth: hci1: Frame reassembly failed (-84) [ 1946.617816] Bluetooth: hci0: command 0x1003 tx timeout [ 1946.623407] Bluetooth: hci0: sending frame failed (-49) [ 1947.347717] Bluetooth: hci1: command 0x1003 tx timeout [ 1947.353369] Bluetooth: hci1: sending frame failed (-49) [ 1948.697901] Bluetooth: hci0: command 0x1001 tx timeout [ 1948.703482] Bluetooth: hci0: sending frame failed (-49) [ 1949.417865] Bluetooth: hci1: command 0x1001 tx timeout [ 1949.423572] Bluetooth: hci1: sending frame failed (-49) [ 1950.777899] Bluetooth: hci0: command 0x1009 tx timeout [ 1951.497827] Bluetooth: hci1: command 0x1009 tx timeout 13:02:21 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={0x0, 0xffffffffffffffff, 0x0, 0xa, &(0x7f0000000000)='/dev/ptmx\x00'}, 0x30) fcntl$setown(r0, 0x8, r1) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x2400, 0x5) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 13:02:21 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x541d, 0x2) 13:02:21 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x541d, 0x2) 13:02:21 executing program 1: socket$alg(0x26, 0x5, 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 13:02:21 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0xc0045878, 0x2) 13:02:21 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b600500000000000100cf", 0x1f) 13:02:21 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x541f, 0x2) [ 1955.930451] netlink: 11 bytes leftover after parsing attributes in process `syz-executor.4'. 13:02:21 executing program 1: socket$alg(0x26, 0x5, 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 13:02:21 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0xc0189436, 0x2) 13:02:21 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x541f, 0x2) [ 1955.977482] Bluetooth: hci0: Frame reassembly failed (-84) 13:02:21 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b680500000000000100cf", 0x1f) 13:02:21 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5420, 0x2) [ 1956.100442] netlink: 11 bytes leftover after parsing attributes in process `syz-executor.4'. [ 1957.977875] Bluetooth: hci0: command 0x1003 tx timeout [ 1957.983568] Bluetooth: hci0: sending frame failed (-49) [ 1958.787729] Bluetooth: hci1: command 0x1003 tx timeout [ 1958.793268] Bluetooth: hci1: sending frame failed (-49) [ 1960.057789] Bluetooth: hci0: command 0x1001 tx timeout [ 1960.063398] Bluetooth: hci0: sending frame failed (-49) [ 1960.857813] Bluetooth: hci1: command 0x1001 tx timeout [ 1960.863770] Bluetooth: hci1: sending frame failed (-49) [ 1962.137853] Bluetooth: hci0: command 0x1009 tx timeout [ 1962.937818] Bluetooth: hci1: command 0x1009 tx timeout 13:02:32 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0xc020660b, 0x2) 13:02:32 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5420, 0x2) 13:02:32 executing program 2: r0 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x0, 0x0) ioctl$SIOCX25GSUBSCRIP(r0, 0x89e0, &(0x7f0000000100)={'vcan0\x00', 0x8001, 0x1}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) ioctl$sock_inet6_udp_SIOCOUTQ(r0, 0x5411, 0xfffffffffffffffd) ioctl$KDADDIO(r1, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r1, 0x5437, 0x0) 13:02:32 executing program 1: socket$alg(0x26, 0x5, 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 13:02:32 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b6c0500000000000100cf", 0x1f) 13:02:32 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5421, 0x2) 13:02:32 executing program 3: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0xf9, 0x42a00) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f0000000040)={0x3f, 0x5, 0x0, 0xcd4, 0x0}, &(0x7f0000000180)=0xfffffffffffffcdb) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r0, 0x84, 0x78, &(0x7f00000000c0)=r1, 0x4) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r2, 0x540b, 0x2) ioctl$VIDIOC_SUBDEV_G_FMT(r0, 0xc0585604, &(0x7f0000000100)={0x0, 0x0, {0xfffffffffffffff9, 0x2f54, 0x1017, 0x2, 0xb, 0x4, 0x0, 0x6}}) 13:02:32 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5422, 0x2) 13:02:32 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5421, 0x2) [ 1966.823133] netlink: 11 bytes leftover after parsing attributes in process `syz-executor.4'. 13:02:32 executing program 1: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 13:02:32 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b740500000000000100cf", 0x1f) [ 1966.896347] Bluetooth: hci0: Frame reassembly failed (-84) [ 1966.950234] netlink: 11 bytes leftover after parsing attributes in process `syz-executor.4'. 13:02:32 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5423, 0x2) 13:02:32 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000080)='/dev/media#\x00', 0x1, 0x100) ioctl$EVIOCGID(r1, 0x80084502, &(0x7f0000000140)=""/91) ioctl$KVM_S390_UCAS_MAP(r1, 0x4018ae50, &(0x7f00000001c0)={0x9, 0x1, 0x1}) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000240)='TIPCv2\x00') sendmsg$TIPC_NL_MEDIA_GET(r1, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x94, r2, 0x2, 0x70bd2b, 0x25dfdbfd, {}, [@TIPC_NLA_SOCK={0x14, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x3fbb}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xe9}]}, @TIPC_NLA_SOCK={0x3c, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9b}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xa7c}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x5}, @TIPC_NLA_SOCK_REF={0x8}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_SOCK={0x20, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xfff}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9000000000000000}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_NODE={0x10, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x400}, @TIPC_NLA_NODE_UP={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x1}, 0x80) r3 = accept4$vsock_stream(r1, &(0x7f00000000c0)={0x28, 0x0, 0xffffffff, @hyper}, 0x10, 0x80000) ioctl$TIOCSRS485(r0, 0x542f, &(0x7f0000000040)={0x7071, 0x2, 0x5}) ioctl$TIOCVHANGUP(r0, 0x540b, 0x2) ioctl$sock_inet_SIOCGIFBRDADDR(r3, 0x8919, &(0x7f0000000100)={'lapb0\x00', {0x2, 0x4e20, @loopback}}) 13:02:32 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b7a0500000000000100cf", 0x1f) [ 1967.079000] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 1967.118280] netlink: 11 bytes leftover after parsing attributes in process `syz-executor.4'. [ 1968.937728] Bluetooth: hci0: command 0x1003 tx timeout [ 1968.943266] Bluetooth: hci0: sending frame failed (-49) [ 1969.737732] Bluetooth: hci1: command 0x1003 tx timeout [ 1969.744155] Bluetooth: hci1: sending frame failed (-49) [ 1971.017872] Bluetooth: hci0: command 0x1001 tx timeout [ 1971.023275] Bluetooth: hci0: sending frame failed (-49) [ 1971.817791] Bluetooth: hci1: command 0x1001 tx timeout [ 1971.823209] Bluetooth: hci1: sending frame failed (-49) [ 1973.097854] Bluetooth: hci0: command 0x1009 tx timeout [ 1973.897793] Bluetooth: hci1: command 0x1009 tx timeout 13:02:43 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0x14) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 13:02:43 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5422, 0x2) 13:02:43 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5424, 0x2) 13:02:43 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000be00500000000000100cf", 0x1f) 13:02:43 executing program 1: mkdir(0x0, 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 13:02:43 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x1000000000000, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x2) [ 1978.363686] netlink: 11 bytes leftover after parsing attributes in process `syz-executor.4'. 13:02:44 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$void(r0, 0xc0045878) ioctl$TIOCVHANGUP(r0, 0x540b, 0x2) 13:02:44 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5425, 0x2) 13:02:44 executing program 1: mkdir(0x0, 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 13:02:44 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5423, 0x2) 13:02:44 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b000600000000000100cf", 0x1f) 13:02:44 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x40002, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000100)={0x0, 0x20, &(0x7f00000000c0)=[@in={0x2, 0x4e22, @broadcast}, @in={0x2, 0x4e24, @multicast1}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r1, 0x84, 0x73, &(0x7f0000000180)={r2, 0xff, 0x30, 0x9, 0x6}, &(0x7f00000001c0)=0x18) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000540)) syz_mount_image$nfs(&(0x7f0000000200)='nfs\x00', &(0x7f0000000280)='./file0\x00', 0x3, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="5c8fd13298fedf64dfdb4f441b8b7bf09c3983295d1796d0d70d8763e53f305c927e78a707321e790b45cfb1020a23dba2d2d4", 0x33, 0x5}, {&(0x7f0000000300)="16e3c4b0ee6c86c8de9dc6ac87b7dfe09075ab44786a1d2e1f869f0a7407213d63fd9d8c244e6dd04d9e358811117d4b908be3151fe6c38a6080c65ba6eb661e75e79e6e048e922a052fbdcd578c6e6e28e862d8d1c08c16135b0174f09b479ad56b701d0501c5f815a6c6e23f6015caaec56f4a1c22f3bb049f70af726fa2a3780945ea9f3c244aa5a194336a685753a77af73131461a5589e254715d7a48c6c5e64b338511d81b88432c4a", 0xac, 0x1}, {&(0x7f00000003c0)="b38026461c725e2bd4e0a340f6449e66addbaa534df40693e2028234c239dd9b7eb3a3b2179661a339667ad12437efaec83c1d59a22aaa9a3e22f7b6a6e71cfb0087b7d2c2e25a3578fa0bf1a701ef54c3d598ece87a9b910ab76b639e63e318b277d38c08e119e8f90f5df2ee3045a93bfc026104b61274683e216fc981cb05b5144f57c7", 0x85, 0x401}], 0x2000, &(0x7f0000000500)='\x00') unlink(&(0x7f0000000580)='./file0\x00') r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x400000, 0x0) ioctl$KVM_ASSIGN_SET_MSIX_ENTRY(r3, 0x4010ae74, &(0x7f0000000040)={0x400, 0x8872, 0x8}) ioctl$TIOCVHANGUP(r0, 0x540b, 0x2) [ 1978.646878] netlink: 'syz-executor.4': attribute type 6 has an invalid length. 13:02:44 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) lgetxattr(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)=ANY=[@ANYBLOB="747275737461642e6d2d5775752fbef83c18696d655f747970656d696d655f74"], &(0x7f0000000100), 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x40000) 13:02:44 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5427, 0x2) 13:02:44 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5424, 0x2) 13:02:44 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b000900000000000100cf", 0x1f) 13:02:44 executing program 1: mkdir(0x0, 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 13:02:44 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x2) 13:02:44 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5428, 0x2) 13:02:44 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b000a00000000000100cf", 0x1f) [ 1979.051246] Bluetooth: hci0: Frame reassembly failed (-84) 13:02:44 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5425, 0x2) 13:02:44 executing program 1: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 13:02:44 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x2) ioctl$KDMKTONE(r0, 0x4b30, 0x0) 13:02:44 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b005200000000000100cf", 0x1f) [ 1979.441274] overlayfs: failed to resolve './file1': -2 [ 1981.097803] Bluetooth: hci0: command 0x1003 tx timeout [ 1981.103225] Bluetooth: hci0: sending frame failed (-49) [ 1983.177821] Bluetooth: hci0: command 0x1001 tx timeout [ 1983.183233] Bluetooth: hci0: sending frame failed (-49) [ 1985.257790] Bluetooth: hci0: command 0x1009 tx timeout 13:02:54 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x9, 0x42) ioctl$EVIOCGID(r1, 0x80084502, &(0x7f0000000040)=""/15) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000080)=@assoc_value={0x0}, &(0x7f0000000100)=0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000140)={r2, 0x4, 0x13}, 0x8) 13:02:54 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5429, 0x2) 13:02:54 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5427, 0x2) 13:02:54 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000000)={0x4e6a, 0x3, 0x5}, 0xc) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r1, 0x540b, 0x2) 13:02:54 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b000600000000000100cf", 0x1f) 13:02:54 executing program 1: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1989.214208] netlink: 'syz-executor.4': attribute type 6 has an invalid length. [ 1989.244930] overlayfs: failed to resolve './file1': -2 13:02:54 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b000800000000000100cf", 0x1f) 13:02:54 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5428, 0x2) 13:02:54 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) r1 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000000)) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000040)={{{@in6=@loopback, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in=@multicast2}}, &(0x7f0000000140)=0xe8) setsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f00000001c0)={r2, @local, @loopback}, 0xc) ioctl$TIOCVHANGUP(r0, 0x540b, 0x2) 13:02:54 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5437, 0x2) [ 1989.304886] Bluetooth: hci0: Frame reassembly failed (-84) 13:02:55 executing program 1: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 13:02:55 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b000900000000000100cf", 0x1f) [ 1989.586381] overlayfs: failed to resolve './file1': -2 [ 1991.337766] Bluetooth: hci0: command 0x1003 tx timeout [ 1991.343387] Bluetooth: hci0: sending frame failed (-49) [ 1992.137736] Bluetooth: hci1: command 0x1003 tx timeout [ 1992.143202] Bluetooth: hci1: sending frame failed (-49) [ 1993.417795] Bluetooth: hci0: command 0x1001 tx timeout [ 1993.423214] Bluetooth: hci0: sending frame failed (-49) [ 1994.217770] Bluetooth: hci1: command 0x1001 tx timeout [ 1994.223196] Bluetooth: hci1: sending frame failed (-49) [ 1995.497835] Bluetooth: hci0: command 0x1009 tx timeout [ 1996.297740] Bluetooth: hci1: command 0x1009 tx timeout 13:03:06 executing program 2: r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vsock\x00', 0x121000, 0x0) getsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f00000001c0)={0x0, 0x80000000, 0x5, 0x6}, &(0x7f0000000200)=0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000280)={r1, @in={{0x2, 0x4e21, @rand_addr=0x4}}, 0xd42, 0x9, 0x5, 0x2, 0x11}, 0x98) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$KDADDIO(r2, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r2, 0x5437, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl(r0, 0x5, &(0x7f00000000c0)="42ee6543cef806dff9c6e8a050f17310dee10f64326c75e08809a3df736411b6c436594cea8f457269cb6f3e7c94a2a17269699a524491bf92bd32acebfa641e1c05a5597e38e7c4f9ee1e142f03daf186160b21e1cb2d42bf6517c5f1d84debe4adf064174e82dff9cb81decd292d92467981c543de11603327a2967cbee6ba6d712b28394455466a") ioctl$TUNSETSTEERINGEBPF(r3, 0x800454e0, &(0x7f0000000040)=r3) 13:03:06 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5429, 0x2) 13:03:06 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5441, 0x2) 13:03:06 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x2) 13:03:06 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b000a00000000000100cf", 0x1f) 13:03:06 executing program 1: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 13:03:06 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b005200000000000100cf", 0x1f) 13:03:06 executing program 3: r0 = open(&(0x7f0000000000)='./file0\x00', 0x4800, 0x80) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000080)={0x5, 0xf1b, 0x2, 0x3ac1800000, 0xc, 0x7, 0x40, 0x6, 0x5, 0x8}) ioctl$KVM_ASSIGN_PCI_DEVICE(r0, 0x8040ae69, &(0x7f0000000040)={0x80000000, 0x3, 0x4, 0x4, 0x1}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r1, 0x540b, 0x2) [ 2000.784339] overlayfs: lowerdir is in-use as upperdir/workdir [ 2000.836730] Unknown ioctl 5 13:03:06 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5437, 0x2) [ 2000.868865] Unknown ioctl 5 13:03:06 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5450, 0x2) 13:03:06 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b000502000000000100cf", 0x1f) 13:03:06 executing program 1: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 13:03:06 executing program 2: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.stat\x00', 0x0, 0x0) ioctl$TCSBRK(r0, 0x5409, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x40, 0x0) 13:03:06 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x2) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) bind$rds(r1, &(0x7f0000000040)={0x2, 0x4e20, @local}, 0x10) 13:03:06 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b000503000000000100cf", 0x1f) 13:03:06 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5451, 0x2) [ 2001.113171] overlayfs: lowerdir is in-use as upperdir/workdir 13:03:06 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5441, 0x2) 13:03:06 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x401, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/avc/cache_stats\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_NEW_SERVICE(r1, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1001800}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x30, r2, 0x800, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e24}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x5381}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x7}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) ioctl$TIOCMGET(r0, 0x5415, &(0x7f0000000100)) r3 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x0, 0x2) ioctl$TCSETSW(r3, 0x5403, &(0x7f0000000040)={0x4, 0x401, 0x6, 0x0, 0x19, 0x3, 0x2, 0xffffffffffff7fef, 0xf, 0x5, 0x5, 0x1ff}) ioctl$VT_WAITACTIVE(r3, 0x5607) setsockopt$IP_VS_SO_SET_EDIT(r3, 0x0, 0x483, &(0x7f0000000180)={0xbb, @multicast1, 0x4e22, 0x2, 'lblcr\x00', 0x2, 0x5, 0xb}, 0x2c) openat(r3, &(0x7f0000000080)='./file0\x00', 0x8000, 0x4) 13:03:06 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r0, 0x80845663, &(0x7f00000000c0)={0x0, @reserved}) openat$selinux_validatetrans(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/validatetrans\x00', 0x1, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x2) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e20, 0x649, @local, 0x80}, @in={0x2, 0x4e21, @local}, @in={0x2, 0x4e22, @multicast2}, @in={0x2, 0x4e21, @loopback}, @in={0x2, 0x4e23, @broadcast}], 0x5c) 13:03:06 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b000504000000000100cf", 0x1f) 13:03:06 executing program 1: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 13:03:06 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5452, 0x2) [ 2001.368910] Bluetooth: hci0: Frame reassembly failed (-84) 13:03:07 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5450, 0x2) 13:03:07 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b000505000000000100cf", 0x1f) 13:03:07 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCGICOUNT(r0, 0x545d, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffe1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x7, r1, 0x0) bpf$MAP_CREATE(0xe0030000000000, &(0x7f0000000080)={0x6, 0x4, 0x20000000007ffd, 0x7d, 0x0, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) ioctl$TIOCVHANGUP(r0, 0x540b, 0x2) accept(r1, &(0x7f00000000c0)=@in6={0xa, 0x0, 0x0, @local}, &(0x7f0000000040)=0x80) 13:03:07 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x545d, 0x2) [ 2001.510413] overlayfs: lowerdir is in-use as upperdir/workdir 13:03:07 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5451, 0x2) 13:03:07 executing program 1: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 13:03:07 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b000506000000000100cf", 0x1f) [ 2001.738047] overlayfs: lowerdir is in-use as upperdir/workdir [ 2002.134232] Bluetooth: hci1: Frame reassembly failed (-84) [ 2003.417706] Bluetooth: hci0: command 0x1003 tx timeout [ 2003.423208] Bluetooth: hci0: sending frame failed (-49) [ 2004.137815] Bluetooth: hci1: command 0x1003 tx timeout [ 2004.143412] Bluetooth: hci1: sending frame failed (-49) [ 2005.497797] Bluetooth: hci0: command 0x1001 tx timeout [ 2005.503193] Bluetooth: hci0: sending frame failed (-49) [ 2006.217831] Bluetooth: hci1: command 0x1001 tx timeout [ 2006.223241] Bluetooth: hci1: sending frame failed (-49) [ 2007.577907] Bluetooth: hci0: command 0x1009 tx timeout [ 2008.297815] Bluetooth: hci1: command 0x1009 tx timeout 13:03:17 executing program 2: r0 = open(&(0x7f0000000500)='./file0\x00', 0x88000, 0x8) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000580)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_STATS(r0, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x1c, r1, 0x400, 0x70bd27, 0x25dfdbff}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x4010) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r2, 0x5437, 0x0) 13:03:17 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5452, 0x2) 13:03:17 executing program 1: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 13:03:17 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5460, 0x2) 13:03:17 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0xba3, 0x2000) execveat(r1, &(0x7f0000000040)='./file0\x00', &(0x7f0000000100)=[&(0x7f0000000080)='/dev/ptmx\x00', &(0x7f00000000c0)='posix_acl_access\x00'], &(0x7f0000000380)=[&(0x7f0000000140)='+lomd5sum/\x00', &(0x7f0000000180)='/dev/ptmx\x00', &(0x7f00000001c0)='/dev/ptmx\x00', &(0x7f0000000200)='/dev/ptmx\x00', &(0x7f0000000280)='-trustedmd5sum!posix_acl_accesseth0em1-\\+\x00', &(0x7f00000002c0)='/dev/ptmx\x00', &(0x7f0000000300)='/dev/ptmx\x00', &(0x7f0000000340)='&\x00'], 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x2) 13:03:17 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b000507000000000100cf", 0x1f) 13:03:17 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b00050a000000000100cf", 0x1f) [ 2012.311899] overlayfs: lowerdir is in-use as upperdir/workdir 13:03:17 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x545d, 0x2) 13:03:17 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x2) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) syz_mount_image$minix(&(0x7f0000000200)='minix\x00', &(0x7f0000000280)='./file0\x00', 0xffff, 0x1, &(0x7f0000000340)=[{&(0x7f00000002c0)="59fdfbd68959385c7b2c51ea6a217cf626f2331c5cd3df529eb299f3a5071e12fc5825cde1ef115442fdef42d7aecaf3c48bcd8a20b8a47cf570014277b1dd8800f8e33c6db5cdecf2fb664f2b9b2f3e38733dce453e023e40a77c89493d7ae3ac04896209c17958c22540383e817093ca70b79922f3dd5cd8", 0x79}], 0x4, 0x0) write$vnet(r1, &(0x7f0000000180)={0x1, {&(0x7f0000000040)=""/220, 0xdc, &(0x7f0000000140)=""/43, 0x3, 0x3}}, 0x68) 13:03:18 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x40045431, 0x2) [ 2012.352386] Bluetooth: hci0: Frame reassembly failed (-84) 13:03:18 executing program 1: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 13:03:18 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b00050b000000000100cf", 0x1f) [ 2012.502167] VFS: Can't find a Minix filesystem V1 | V2 | V3 on device loop3. [ 2012.610954] overlayfs: lowerdir is in-use as upperdir/workdir [ 2014.377780] Bluetooth: hci0: command 0x1003 tx timeout [ 2014.383181] Bluetooth: hci0: sending frame failed (-49) [ 2016.457911] Bluetooth: hci0: command 0x1001 tx timeout [ 2016.463334] Bluetooth: hci0: sending frame failed (-49) [ 2018.537946] Bluetooth: hci0: command 0x1009 tx timeout 13:03:28 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x4b34, 0xe) r1 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x1, 0x400) ioctl$TIOCGPTPEER(r0, 0x5441, 0x6) ioctl$BLKRESETZONE(r1, 0x40101283, &(0x7f0000000100)={0x9, 0xfffffffffffff4fe}) ioctl$KDADDIO(r0, 0x400455c8, 0x0) 13:03:28 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x5460, 0x2) 13:03:28 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x40045436, 0x2) 13:03:28 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x2) ioctl$KDSKBLED(r0, 0x4b65, 0x4) socket$inet_dccp(0x2, 0x6, 0x0) 13:03:28 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b00050e000000000100cf", 0x1f) 13:03:28 executing program 1: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 13:03:28 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b00050f000000000100cf", 0x1f) 13:03:28 executing program 3: r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x88000, 0x0) bpf$OBJ_PIN_PROG(0x6, &(0x7f00000000c0)={&(0x7f0000000080)='./file0\x00', r0}, 0x10) ioctl$KDSKBMODE(r0, 0x4b45, &(0x7f0000000040)=0x1) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000100)={0x2, [0x0, 0x0]}, &(0x7f0000000140)=0xc) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000180)={r2, 0x3, 0x3}, &(0x7f00000001c0)=0x8) ioctl$TIOCVHANGUP(r1, 0x540b, 0x2) 13:03:28 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x40045431, 0x2) 13:03:28 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455cb, 0x2) [ 2022.548422] overlayfs: lowerdir is in-use as upperdir/workdir [ 2022.572660] Bluetooth: hci0: Frame reassembly failed (-84) 13:03:28 executing program 1: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 13:03:28 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b000548000000000100cf", 0x1f) [ 2022.715652] QAT: Invalid ioctl [ 2022.766313] QAT: Invalid ioctl [ 2022.836241] overlayfs: lowerdir is in-use as upperdir/workdir [ 2024.617829] Bluetooth: hci0: command 0x1003 tx timeout [ 2024.623379] Bluetooth: hci0: sending frame failed (-49) [ 2026.697806] Bluetooth: hci0: command 0x1001 tx timeout [ 2026.703326] Bluetooth: hci0: sending frame failed (-49) [ 2028.777786] Bluetooth: hci0: command 0x1009 tx timeout 13:03:38 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x40049409, 0x2) 13:03:38 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x40045436, 0x2) 13:03:38 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b00054c000000000100cf", 0x1f) 13:03:38 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x400000, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x2) 13:03:38 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x20000) bind$bt_rfcomm(r1, &(0x7f0000000040)={0x1f, {0x6, 0x5, 0x5, 0x100000000, 0x1, 0x1}, 0x6}, 0xa) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000400)=ANY=[@ANYRES32=0x0, @ANYBLOB="0baff2e3fdff0e64d8d1e7541b78b2feec0c2baa93d60e796995074065f473306117d4155ab6e0c4bba1937f6fd89ab8ae89ca3d0f3e951d481985a7433b919601b1cb3c9b12ba2e113cef2534604f68295082c1814f484338cd26be0312eb18848ef22e3932bdb342a054fa4ebd38d35c270c65fdfa5918beba24fb5a61902b359e8cea5d08d89f00a7dab63c48b8c845da413377265cb9352172bcc88382a0de725829a21de165306ab58f1b"], &(0x7f0000000200)=0xc) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f0000000140)=@sack_info={0x0, 0x8000, 0x100000001}, &(0x7f0000000180)=0xc) getsockopt$inet_sctp_SCTP_STATUS(r1, 0x84, 0xe, &(0x7f0000000340)={r2, 0x4, 0x2, 0x5, 0x3f46, 0x5, 0xfffffffffffff49d, 0x2, {r3, @in6={{0xa, 0x4e21, 0x1, @remote}}, 0x4, 0xf93f, 0x9, 0x7}}, &(0x7f00000001c0)=0xb0) getsockopt$packet_buf(r1, 0x107, 0xf, &(0x7f0000000280)=""/176, &(0x7f0000000100)=0xb0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 13:03:38 executing program 1: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 13:03:38 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b000560000000000100cf", 0x1f) 13:03:38 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x40086602, 0x2) 13:03:38 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r0, 0x660c) ioctl$TIOCVHANGUP(r0, 0x540b, 0x2) ioctl$KDSKBSENT(r0, 0x4b49, &(0x7f0000000000)="610c148e56cc7a1f7d4af8aa23657f74e676651b3dc58d0b742b71c358990ab9e0ea6091aeb7c41f777b0c32093c27d5eb4e6d1fb1fa24302267ffbc85e89318b3545286e0371bf04d58865b3a9a10e15308376d2b7985d81b898f417f2e398d6e965f7277c72bdd2fe8f3a5e48c8c873638f21b5c9cd50a8dcf443c5c313ef8ec512ebe64fe527cdac6786f42faccff511756e3d504627d5f66acfc3aaa7ef306c7b319") [ 2032.775803] overlayfs: lowerdir is in-use as upperdir/workdir 13:03:38 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455cb, 0x2) 13:03:38 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b000568000000000100cf", 0x1f) 13:03:38 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x1ffff, 0x0) readahead(r0, 0x2, 0x36c) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sync_refresh_period\x00', 0x2, 0x0) setsockopt$l2tp_PPPOL2TP_SO_RECVSEQ(r1, 0x111, 0x2, 0x0, 0xffffffffffffffde) ioctl$TIOCVHANGUP(r0, 0x540b, 0x2) 13:03:38 executing program 1: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 13:03:38 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b00056c000000000100cf", 0x1f) 13:03:38 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x40087602, 0x2) 13:03:38 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x40049409, 0x2) [ 2033.005388] overlayfs: lowerdir is in-use as upperdir/workdir [ 2033.558918] Bluetooth: hci1: Frame reassembly failed (-84) [ 2034.857764] Bluetooth: hci0: command 0x1003 tx timeout [ 2034.863204] Bluetooth: hci0: sending frame failed (-49) [ 2035.577757] Bluetooth: hci1: command 0x1003 tx timeout [ 2035.583158] Bluetooth: hci1: sending frame failed (-49) [ 2036.937781] Bluetooth: hci0: command 0x1001 tx timeout [ 2036.943380] Bluetooth: hci0: sending frame failed (-49) [ 2037.657886] Bluetooth: hci1: command 0x1001 tx timeout [ 2037.663327] Bluetooth: hci1: sending frame failed (-49) [ 2039.017796] Bluetooth: hci0: command 0x1009 tx timeout [ 2039.737787] Bluetooth: hci1: command 0x1009 tx timeout 13:03:49 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x7) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$inet6_opts(r1, 0x29, 0x3b, &(0x7f0000000100)=""/159, &(0x7f0000000040)=0x9f) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 13:03:49 executing program 3: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x200, 0x0) ioctl$TIOCSISO7816(r0, 0xc0285443, &(0x7f0000000040)={0x80000000, 0x8, 0x7, 0x80000000, 0x1}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) 13:03:49 executing program 1: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 13:03:49 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x4020940d, 0x2) 13:03:49 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b000574000000000100cf", 0x1f) 13:03:49 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x40086602, 0x2) 13:03:49 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x40087602, 0x2) 13:03:49 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b00057a000000000100cf", 0x1f) 13:03:49 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) r1 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x4, 0x2000) ioctl$SIOCRSGCAUSE(r1, 0x89e0, &(0x7f0000000040)) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) alarm(0x5) 13:03:49 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x80045430, 0x2) [ 2043.716346] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. 13:03:49 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x2) r1 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x0, 0x100) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0x34e9, 0x8, 0x1}) 13:03:49 executing program 1: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, 0x0, &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 13:03:49 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b0005e0000000000100cf", 0x1f) [ 2043.856892] Bluetooth: hci0: Frame reassembly failed (-84) 13:03:49 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x80045432, 0x2) 13:03:49 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x4020940d, 0x2) 13:03:49 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b0005f0000000000100cf", 0x1f) 13:03:49 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x88000, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x2) ioctl$TIOCSSERIAL(r0, 0x541f, &(0x7f0000000100)={0x10000, 0x1f, 0x3c, 0xfffffffffffff701, 0xc7, 0x9, 0x9, 0x0, 0x1000, 0x4, 0x5, 0x3, 0x5, 0x5, &(0x7f0000000040)=""/148, 0xffff, 0x2, 0x3f}) 13:03:49 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x80045438, 0x2) 13:03:49 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b000500030000000100cf", 0x1f) 13:03:49 executing program 1: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, 0x0, &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 2044.250475] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 2045.897779] Bluetooth: hci0: command 0x1003 tx timeout [ 2045.903184] Bluetooth: hci0: sending frame failed (-49) [ 2046.697735] Bluetooth: hci1: command 0x1003 tx timeout [ 2046.703131] Bluetooth: hci1: sending frame failed (-49) [ 2047.977799] Bluetooth: hci0: command 0x1001 tx timeout [ 2047.983328] Bluetooth: hci0: sending frame failed (-49) [ 2048.777899] Bluetooth: hci1: command 0x1001 tx timeout [ 2048.783409] Bluetooth: hci1: sending frame failed (-49) [ 2050.057864] Bluetooth: hci0: command 0x1009 tx timeout [ 2050.857881] Bluetooth: hci1: command 0x1009 tx timeout 13:04:00 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TCXONC(r0, 0x540a, 0x10001) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) ioctl$TCGETS2(r0, 0x802c542a, &(0x7f0000000040)) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) 13:04:00 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x80045430, 0x2) 13:04:00 executing program 3: r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x3, [@volatile={0x7, 0x0, 0x0, 0x9, 0x1}, @fwd={0xe}]}, {0x0, [0x0]}}, &(0x7f0000000040)=""/25, 0x33, 0x19, 0x1}, 0x20) fsetxattr$trusted_overlay_opaque(r0, &(0x7f00000000c0)='trusted.overlay.opaque\x00', &(0x7f0000000100)='y\x00', 0x2, 0x3) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) r2 = socket$inet(0x10, 0x80003, 0x0) sendmsg(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000240)="240000001e0007121dff18946f610400020000001f0000000000080008000a000400ff7e", 0x24}], 0x1}, 0x0) ioctl$TIOCLINUX3(r1, 0x541c, &(0x7f0000000140)) ioctl$TIOCVHANGUP(r1, 0x540b, 0x2) 13:04:00 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x80045439, 0x2) 13:04:00 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b000500050000000100cf", 0x1f) 13:04:00 executing program 1: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, 0x0, &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 2055.158786] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 13:04:00 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000480)='/dev/ptmx\x00', 0x4040, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x2) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x400, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000040)={0x0, @in6={{0xa, 0x4e22, 0x9, @mcast2, 0x9}}, 0xdc5, 0x61}, &(0x7f0000000100)=0x90) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000600)='/dev/ptmx\x00', 0x800, 0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f00000003c0)='IPVS\x00') sendmsg$IPVS_CMD_SET_SERVICE(r1, &(0x7f0000000500)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x5808}, 0xc, &(0x7f00000004c0)={&(0x7f0000000400)={0x80, r3, 0x1, 0x70bd25, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DAEMON={0xc, 0x3, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0xc7bb}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x7}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e24}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}, @IPVS_CMD_ATTR_DAEMON={0x3c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast2}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'irlan0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x3}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x4040800}, 0x84) ioctl$VIDIOC_SUBDEV_S_FMT(r1, 0xc0585605, &(0x7f0000000580)={0x1, 0x0, {0x9, 0x1, 0x301f, 0x4, 0x6, 0xc, 0x0, 0x7}}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000380)={0x1, &(0x7f0000000340)=[{0x1e3, 0x400, 0xfff, 0xe72}]}, 0x10) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f0000000140)={r2, 0x200}, &(0x7f0000000180)=0x8) ioctl$VFIO_IOMMU_GET_INFO(r1, 0x3b70, &(0x7f0000000540)={0x10}) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000200)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r1, &(0x7f0000000300)={&(0x7f00000001c0), 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x1c, r4, 0x100, 0x70bd2c, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xffffffffffffff01}]}, 0x1c}}, 0x20004880) r5 = shmget(0x3, 0x2000, 0x40, &(0x7f0000ffb000/0x2000)=nil) shmat(r5, &(0x7f0000ffc000/0x3000)=nil, 0x3000) 13:04:00 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x80045440, 0x2) 13:04:00 executing program 1: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 13:04:00 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x80045432, 0x2) [ 2055.200644] Bluetooth: hci0: Frame reassembly failed (-84) 13:04:00 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b000500060000000100cf", 0x1f) 13:04:01 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x800455c9, 0x2) [ 2055.376838] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 2057.257708] Bluetooth: hci0: command 0x1003 tx timeout [ 2057.263131] Bluetooth: hci0: sending frame failed (-49) [ 2057.977950] Bluetooth: hci1: command 0x1003 tx timeout [ 2057.983383] Bluetooth: hci1: sending frame failed (-49) [ 2059.337747] Bluetooth: hci0: command 0x1001 tx timeout [ 2059.343204] Bluetooth: hci0: sending frame failed (-49) [ 2060.057883] Bluetooth: hci1: command 0x1001 tx timeout [ 2060.063505] Bluetooth: hci1: sending frame failed (-49) [ 2061.417775] Bluetooth: hci0: command 0x1009 tx timeout [ 2062.137799] Bluetooth: hci1: command 0x1009 tx timeout 13:04:11 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) r1 = dup3(r0, r0, 0x80000) ioctl$sock_SIOCINQ(r1, 0x541b, &(0x7f0000000000)) 13:04:11 executing program 1: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 13:04:11 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b000500070000000100cf", 0x1f) 13:04:11 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x80045438, 0x2) 13:04:11 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x44040, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x2) 13:04:11 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x800455ca, 0x2) [ 2066.026490] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 13:04:11 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x80045439, 0x2) 13:04:11 executing program 1: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 13:04:11 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x800455cc, 0x2) 13:04:11 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r0, 0x530b}, {r0, 0x4}, {r0, 0x202}, {r0, 0x2000}], 0x4, 0x8) ioctl$TIOCVHANGUP(r0, 0x540b, 0x2) poll(&(0x7f0000000000)=[{r0, 0x200}, {r0, 0x413}, {r0, 0x4}, {r0, 0xf222}, {r0}, {r0, 0x40}], 0x6, 0x0) [ 2066.102292] Bluetooth: hci0: Frame reassembly failed (-84) 13:04:11 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b0005000a0000000100cf", 0x1f) 13:04:11 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x80045440, 0x2) [ 2066.335355] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 2066.866958] Bluetooth: hci1: Frame reassembly failed (-84) [ 2068.137737] Bluetooth: hci0: command 0x1003 tx timeout [ 2068.143189] Bluetooth: hci0: sending frame failed (-49) [ 2068.937758] Bluetooth: hci1: command 0x1003 tx timeout [ 2068.943680] Bluetooth: hci1: sending frame failed (-49) [ 2070.217760] Bluetooth: hci0: command 0x1001 tx timeout [ 2070.223267] Bluetooth: hci0: sending frame failed (-49) [ 2071.017834] Bluetooth: hci1: command 0x1001 tx timeout [ 2071.023265] Bluetooth: hci1: sending frame failed (-49) [ 2072.297797] Bluetooth: hci0: command 0x1009 tx timeout [ 2073.097779] Bluetooth: hci1: command 0x1009 tx timeout 13:04:23 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b0005000b0000000100cf", 0x1f) 13:04:23 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x80086601, 0x2) 13:04:23 executing program 1: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 13:04:23 executing program 3: r0 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0xe3, 0x649f3aa3924d25bc) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x5) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r1, 0x540b, 0x2) 13:04:23 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x1, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 13:04:23 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x800455c9, 0x2) [ 2077.551268] overlayfs: missing 'lowerdir' [ 2077.556511] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 13:04:23 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x80087601, 0x2) 13:04:23 executing program 1: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 13:04:23 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b0005000e0000000100cf", 0x1f) 13:04:23 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000140)='/dev/nullb0\x00', 0xc000, 0x0) preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x1, 0x0) ioctl$TIOCVHANGUP(r2, 0x540b, 0x2) 13:04:23 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x800455ca, 0x2) [ 2077.735397] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 2077.735753] overlayfs: missing 'lowerdir' 13:04:23 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0xc0045878, 0x2) 13:04:23 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b0005c00e0000000100cf", 0x1f) 13:04:23 executing program 1: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 13:04:23 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x800455cc, 0x2) 13:04:23 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000100)) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x101000, 0x0) getsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000040)={0x0, 0x6, 0x6, 0x6}, &(0x7f0000000080)=0x10) ioctl$PPPIOCGIDLE(r1, 0x8010743f, &(0x7f0000000200)) getsockopt$inet_sctp_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f0000000180)={r2, 0x3, 0x7b0000000000000, 0x7}, &(0x7f00000001c0)=0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f00000000c0)={r2, 0x4e5, 0x1}, 0x8) ioctl$TIOCVHANGUP(r0, 0x540b, 0x2) ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000140)={0x4, 0x4, 0x100, 0x8, 0x6, 0x1f}) [ 2077.899558] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 2077.960226] overlayfs: missing 'lowerdir' [ 2079.657706] Bluetooth: hci0: command 0x1003 tx timeout [ 2079.663172] Bluetooth: hci0: sending frame failed (-49) [ 2080.457742] Bluetooth: hci1: command 0x1003 tx timeout [ 2080.463196] Bluetooth: hci1: sending frame failed (-49) [ 2081.737764] Bluetooth: hci0: command 0x1001 tx timeout [ 2081.743758] Bluetooth: hci0: sending frame failed (-49) [ 2082.537836] Bluetooth: hci1: command 0x1001 tx timeout [ 2082.543492] Bluetooth: hci1: sending frame failed (-49) [ 2083.817762] Bluetooth: hci0: command 0x1009 tx timeout [ 2084.617797] Bluetooth: hci1: command 0x1009 tx timeout 13:04:34 executing program 2: r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/qat_adf_ctl\x00', 0x880, 0x0) ioctl$TIOCLINUX6(r0, 0x541c, &(0x7f0000000180)={0x6, 0x6}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x101000, 0x4) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000140)=0x20009) fcntl$notify(r2, 0x402, 0x80000012) ioctl$KDADDIO(r1, 0x400455c8, 0x0) r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x101902, 0x0) ioctl$EVIOCSABS2F(r3, 0x401845ef, &(0x7f00000000c0)={0x6, 0x8, 0x8, 0x9, 0x1f73, 0x6}) dup2(r2, r2) ioctl$TIOCVHANGUP(r1, 0x5437, 0x0) ioctl$KDADDIO(r1, 0x4b34, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) 13:04:34 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0xc0045878, 0x2) 13:04:34 executing program 1: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 13:04:34 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b0005000f0000000100cf", 0x1f) 13:04:34 executing program 3: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x7, 0x200080) ioctl$VIDIOC_S_AUDOUT(r0, 0x40345632, &(0x7f0000000040)={0x6, "65318b8c9528bba555ee8f7c4b6595f62a6df3e3ecdc84a3b37886c50923c4ca", 0x1, 0x5}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) r2 = syz_open_dev$dmmidi(&(0x7f0000000080)='/dev/dmmidi#\x00', 0x4, 0x440000) ioctl$TIOCVHANGUP(r1, 0x540b, 0x2) setsockopt$IP_VS_SO_SET_EDITDEST(r2, 0x0, 0x489, &(0x7f00000000c0)={{0xff, @rand_addr=0x8, 0x4e21, 0x0, 'sh\x00', 0x2, 0x100000000, 0x67}, {@remote, 0x4e20, 0x10000, 0x5, 0x3, 0xcc}}, 0x44) 13:04:34 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x80086601, 0x2) [ 2089.068269] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 13:04:34 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0xc0189436, 0x2) [ 2089.122761] overlayfs: missing 'workdir' [ 2089.133672] QAT: Invalid ioctl 13:04:34 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b000500200000000100cf", 0x1f) 13:04:34 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) stat(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000140)={0x0, 0x0, 0x0}, &(0x7f0000000180)=0xc) fchownat(r1, &(0x7f0000000040)='./file0\x00', r2, r3, 0x400) ioctl$TIOCVHANGUP(r0, 0x540b, 0x2) [ 2089.172343] QAT: Invalid ioctl 13:04:34 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x80087601, 0x2) 13:04:34 executing program 1: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 2089.245337] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 13:04:34 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) r1 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x6, 0x80000) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f0000000040)=0x8, 0x4) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 13:04:34 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b0005003f0000000100cf", 0x1f) 13:04:34 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0xc020660b, 0x2) 13:04:35 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0xc0045878, 0x2) [ 2089.383780] overlayfs: missing 'workdir' 13:04:35 executing program 3: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @remote}}}, &(0x7f0000000080)=0x80) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r0, 0x28, 0x1, &(0x7f00000000c0)=0x7, 0x8) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r1, 0x540b, 0x2) [ 2089.440203] netlink: 'syz-executor.4': attribute type 5 has an invalid length. 13:04:35 executing program 1: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000001b80)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 13:04:35 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0xc0045878, 0x2) 13:04:35 executing program 4: r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000100)="1f0000000107ff02003b54c007110000f30501000b000500400000000100cf", 0x1f) 13:04:35 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0xb) 13:04:35 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x540b, 0x2) [ 2089.592027] netlink: 'syz-executor.4': attribute type 5 has an invalid length. [ 2089.631986] overlayfs: missing 'workdir' [ 2089.636544] ------------[ cut here ]------------ [ 2089.641918] WARNING: CPU: 0 PID: 27167 at drivers/tty/tty_ioctl.c:319 tty_set_termios.cold+0x11/0x1f [ 2089.651199] Kernel panic - not syncing: panic_on_warn set ... [ 2089.651199] [ 2089.658574] CPU: 0 PID: 27167 Comm: kworker/u5:4 Not tainted 4.19.62 #36 [ 2089.665413] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2089.674782] Workqueue: hci1 hci_power_on [ 2089.678846] Call Trace: [ 2089.681445] dump_stack+0x172/0x1f0 [ 2089.685085] panic+0x263/0x507 [ 2089.688285] ? __warn_printk+0xf3/0xf3 [ 2089.692185] ? tty_set_termios.cold+0x11/0x1f [ 2089.696694] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2089.702234] ? __warn.cold+0x5/0x4a [ 2089.705864] ? __warn+0xe8/0x1d0 [ 2089.709221] ? tty_set_termios.cold+0x11/0x1f [ 2089.713706] __warn.cold+0x20/0x4a [ 2089.717236] ? tty_set_termios.cold+0x11/0x1f [ 2089.721725] report_bug+0x263/0x2b0 [ 2089.725348] do_error_trap+0x204/0x360 [ 2089.729226] ? math_error+0x340/0x340 [ 2089.733019] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2089.738546] ? wake_up_klogd+0x99/0xd0 [ 2089.742422] ? vprintk_emit+0x1ab/0x690 [ 2089.746383] ? error_entry+0x76/0xd0 [ 2089.750092] ? trace_hardirqs_off_caller+0x65/0x220 [ 2089.755102] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 2089.759951] do_invalid_op+0x1b/0x20 [ 2089.763649] invalid_op+0x14/0x20 [ 2089.767090] RIP: 0010:tty_set_termios.cold+0x11/0x1f [ 2089.772181] Code: ff e8 12 0a 3b fe e9 f5 fe ff ff e8 08 0a 3b fe eb c7 e8 01 0a 3b fe eb 9d e8 3a 77 04 fe 48 c7 c7 40 d1 8c 87 e8 62 e8 ee fd <0f> 0b e9 d1 d7 ff ff 90 90 90 90 90 90 90 55 48 89 e5 41 55 41 54 [ 2089.791068] RSP: 0018:ffff88808a357990 EFLAGS: 00010282 [ 2089.796436] RAX: 0000000000000024 RBX: ffff88808a357a50 RCX: 0000000000000000 [ 2089.803701] RDX: 0000000000000000 RSI: ffffffff8155d376 RDI: ffffed101146af24 [ 2089.811065] RBP: ffff88808a357a78 R08: 0000000000000024 R09: ffffed1015d05079 [ 2089.818339] R10: ffffed1015d05078 R11: ffff8880ae8283c7 R12: ffff88808a357ab8 [ 2089.825595] R13: 0000000000010004 R14: 1ffff1101146af51 R15: ffff888056aa8540 [ 2089.832866] ? vprintk_func+0x86/0x189 [ 2089.836748] ? tty_wait_until_sent+0x580/0x580 [ 2089.841322] ? __mutex_lock+0x3cd/0x1300 [ 2089.845544] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2089.851070] ? tty_termios_encode_baud_rate+0x3ca/0x4e0 [ 2089.856427] hci_uart_set_baudrate+0x157/0x1c0 [ 2089.860998] ? hci_uart_set_speeds+0x90/0x90 [ 2089.865448] ? debug_object_deactivate+0x1e4/0x360 [ 2089.870366] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2089.875901] hci_uart_setup+0xa2/0x490 [ 2089.879799] ? hci_uart_set_baudrate+0x1c0/0x1c0 [ 2089.884542] hci_dev_do_open+0x674/0x14a0 [ 2089.888681] ? hci_rx_work+0xaa0/0xaa0 [ 2089.892556] ? kasan_check_read+0x11/0x20 [ 2089.896692] ? process_one_work+0x890/0x1750 [ 2089.901088] ? find_held_lock+0x35/0x130 [ 2089.905315] ? process_one_work+0x890/0x1750 [ 2089.909710] hci_power_on+0x10d/0x580 [ 2089.913497] ? hci_error_reset+0xf0/0xf0 [ 2089.917561] ? __lock_is_held+0xb6/0x140 [ 2089.921622] process_one_work+0x989/0x1750 [ 2089.925852] ? pwq_dec_nr_in_flight+0x320/0x320 [ 2089.930548] ? lock_acquire+0x16f/0x3f0 [ 2089.934513] ? kasan_check_write+0x14/0x20 [ 2089.938736] ? do_raw_spin_lock+0xc8/0x240 [ 2089.942960] worker_thread+0x98/0xe40 [ 2089.946749] ? trace_hardirqs_on+0x67/0x220 [ 2089.951068] kthread+0x354/0x420 [ 2089.954421] ? process_one_work+0x1750/0x1750 [ 2089.958903] ? kthread_cancel_delayed_work_sync+0x20/0x20 [ 2089.964460] ret_from_fork+0x24/0x30 [ 2089.969875] Kernel Offset: disabled [ 2089.973687] Rebooting in 86400 seconds..