z_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de", 0x1) 15:29:37 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, 0xffffffffffffffff, &(0x7f0000000080)={0x8000000b}) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, 0xffffffffffffffff, &(0x7f0000000080)={0x8000000b}) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) 15:29:37 executing program 3: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async, rerun: 32) r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (rerun: 32) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x10000000) (async, rerun: 32) syz_io_uring_setup(0x28d, &(0x7f0000000080)={0x0, 0x84c, 0x20, 0x1, 0x37d}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000000), &(0x7f0000000100)) (async, rerun: 32) pipe2$watch_queue(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) write$tcp_mem(r1, &(0x7f0000000180)={0x619a, 0x20, 0x9b, 0x20, 0x8000000000000001}, 0x48) (async) write$qrtrtun(r0, 0x0, 0xfffffffffffffdba) 15:29:37 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, 0x0, 0x0) 15:29:37 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x0) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:37 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de", 0x1) 15:29:37 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async, rerun: 64) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (rerun: 64) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, 0xffffffffffffffff, &(0x7f0000000080)={0x8000000b}) (async, rerun: 64) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (rerun: 64) 15:29:37 executing program 2: ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x0, 0x3}) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000000c0)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x3, 0x0, r0, 0x0, &(0x7f0000000080)="87cd3934354234048c75b835e82b96f90fb4512070da9e41fbc2ea14cb7a1e929f29d8bf2d678a9ebf1a8f3b8a373b319400dccb551891", 0x37, 0x8041}, 0x56) (async, rerun: 64) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0) (async, rerun: 64) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0xa041) write$qrtrtun(r1, 0x0, 0x7ffff000) write$qrtrtun(r1, &(0x7f0000000140)="db", 0x1) (async) read$qrtrtun(r1, &(0x7f0000000000)=""/52, 0x34) 15:29:37 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x0) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:37 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de", 0x1) 15:29:37 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, 0x0, 0x0) 15:29:37 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f00000001c0), 0x2000000008, 0x200) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) epoll_wait(r0, &(0x7f0000000180)=[{}, {}, {}], 0x3, 0x40) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.net/syz1\x00', 0x200002, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) r2 = openat$cgroup_ro(r1, &(0x7f0000000040)='blkio.bfq.empty_time\x00', 0x0, 0x0) write$qrtrtun(r2, &(0x7f00000000c0)="01843892e2d3a1c5fec3ebfab4fc3d462e5400000000000000000000000000a4bbf11a9a97649e8613688f64b7c849d5b442c98cc10988807af4ee7577cc3e2a650bb847b9f0764345f192dba6f96a8c8537910ba2590f32551705cca44187f47876791a7dd5b95667e4bbab8fa17ca16a6e14e10bf3f00990b986c8b36d3feb95cfb50de90e5fb45126e9e4", 0x8c) socketpair(0x5, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) setsockopt$MRT_ADD_VIF(r3, 0x0, 0xca, &(0x7f0000000240)={0x0, 0x0, 0x6f, 0xfffffffd, @vifc_lcl_ifindex, @dev={0xac, 0x14, 0x14, 0xf}}, 0x10) 15:29:37 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x0) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:37 executing program 3: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x10000000) syz_io_uring_setup(0x28d, &(0x7f0000000080)={0x0, 0x84c, 0x20, 0x1, 0x37d}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000000), &(0x7f0000000100)) pipe2$watch_queue(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) write$tcp_mem(r1, &(0x7f0000000180)={0x619a, 0x20, 0x9b, 0x20, 0x8000000000000001}, 0x48) write$qrtrtun(r0, 0x0, 0xfffffffffffffdba) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x10000000) (async) syz_io_uring_setup(0x28d, &(0x7f0000000080)={0x0, 0x84c, 0x20, 0x1, 0x37d}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000000), &(0x7f0000000100)) (async) pipe2$watch_queue(&(0x7f0000000140), 0x80) (async) write$tcp_mem(r1, &(0x7f0000000180)={0x619a, 0x20, 0x9b, 0x20, 0x8000000000000001}, 0x48) (async) write$qrtrtun(r0, 0x0, 0xfffffffffffffdba) (async) 15:29:37 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, 0x0, 0x0) 15:29:37 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fe", 0x9) 15:29:37 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300), 0x0) 15:29:37 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x1a0c1) write$qrtrtun(r0, 0x0, 0x0) 15:29:37 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de81", 0x2) 15:29:37 executing program 2: ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x0, 0x3}) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f00000000c0)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x3, 0x0, r0, 0x0, &(0x7f0000000080)="87cd3934354234048c75b835e82b96f90fb4512070da9e41fbc2ea14cb7a1e929f29d8bf2d678a9ebf1a8f3b8a373b319400dccb551891", 0x37, 0x8041}, 0x56) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0) (async) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0xa041) write$qrtrtun(r1, 0x0, 0x7ffff000) (async) write$qrtrtun(r1, &(0x7f0000000140)="db", 0x1) (async) read$qrtrtun(r1, &(0x7f0000000000)=""/52, 0x34) 15:29:37 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:37 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300), 0x0) 15:29:37 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f00000001c0), 0x2000000008, 0x200) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) epoll_wait(r0, &(0x7f0000000180)=[{}, {}, {}], 0x3, 0x40) (async) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.net/syz1\x00', 0x200002, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) r2 = openat$cgroup_ro(r1, &(0x7f0000000040)='blkio.bfq.empty_time\x00', 0x0, 0x0) write$qrtrtun(r2, &(0x7f00000000c0)="01843892e2d3a1c5fec3ebfab4fc3d462e5400000000000000000000000000a4bbf11a9a97649e8613688f64b7c849d5b442c98cc10988807af4ee7577cc3e2a650bb847b9f0764345f192dba6f96a8c8537910ba2590f32551705cca44187f47876791a7dd5b95667e4bbab8fa17ca16a6e14e10bf3f00990b986c8b36d3feb95cfb50de90e5fb45126e9e4", 0x8c) (async, rerun: 64) socketpair(0x5, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) (rerun: 64) setsockopt$MRT_ADD_VIF(r3, 0x0, 0xca, &(0x7f0000000240)={0x0, 0x0, 0x6f, 0xfffffffd, @vifc_lcl_ifindex, @dev={0xac, 0x14, 0x14, 0xf}}, 0x10) 15:29:37 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de81", 0x2) 15:29:37 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x1a0c1) write$qrtrtun(r0, 0x0, 0x0) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x1a0c1) (async) write$qrtrtun(r0, 0x0, 0x0) (async) 15:29:37 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:37 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de81", 0x2) 15:29:37 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300), 0x0) 15:29:37 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x1a0c1) write$qrtrtun(r0, 0x0, 0x0) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x1a0c1) (async) write$qrtrtun(r0, 0x0, 0x0) (async) 15:29:37 executing program 2: pipe2$watch_queue(&(0x7f0000000000), 0x80) pipe2$watch_queue(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) inotify_add_watch(r0, &(0x7f0000000080)='./file0\x00', 0xd6) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0xa041) write$qrtrtun(r1, 0x0, 0x7ffff000) write$qrtrtun(r1, &(0x7f0000000140)="db", 0x1) 15:29:37 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:37 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28f", 0x6) 15:29:37 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, 0x0, 0x0) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:37 executing program 2: pipe2$watch_queue(&(0x7f0000000000), 0x80) (async, rerun: 64) pipe2$watch_queue(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (rerun: 64) inotify_add_watch(r0, &(0x7f0000000080)='./file0\x00', 0xd6) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0xa041) write$qrtrtun(r1, 0x0, 0x7ffff000) (async, rerun: 64) write$qrtrtun(r1, &(0x7f0000000140)="db", 0x1) (rerun: 64) 15:29:38 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f00000001c0), 0x2000000008, 0x200) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) (async) epoll_wait(r0, &(0x7f0000000180)=[{}, {}, {}], 0x3, 0x40) (async) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.net/syz1\x00', 0x200002, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) r2 = openat$cgroup_ro(r1, &(0x7f0000000040)='blkio.bfq.empty_time\x00', 0x0, 0x0) write$qrtrtun(r2, &(0x7f00000000c0)="01843892e2d3a1c5fec3ebfab4fc3d462e5400000000000000000000000000a4bbf11a9a97649e8613688f64b7c849d5b442c98cc10988807af4ee7577cc3e2a650bb847b9f0764345f192dba6f96a8c8537910ba2590f32551705cca44187f47876791a7dd5b95667e4bbab8fa17ca16a6e14e10bf3f00990b986c8b36d3feb95cfb50de90e5fb45126e9e4", 0x8c) (async) socketpair(0x5, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) setsockopt$MRT_ADD_VIF(r3, 0x0, 0xca, &(0x7f0000000240)={0x0, 0x0, 0x6f, 0xfffffffd, @vifc_lcl_ifindex, @dev={0xac, 0x14, 0x14, 0xf}}, 0x10) 15:29:38 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afe", 0x3) 15:29:38 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xe941) write$qrtrtun(r0, 0x0, 0x0) r1 = syz_open_dev$vcsa(&(0x7f0000000000), 0x0, 0x40001) read$qrtrtun(r1, &(0x7f0000000080)=""/156, 0x9c) 15:29:38 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:38 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, 0x0, 0x0) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:38 executing program 2: pipe2$watch_queue(&(0x7f0000000000), 0x80) (async) pipe2$watch_queue(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) inotify_add_watch(r0, &(0x7f0000000080)='./file0\x00', 0xd6) (async, rerun: 64) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0xa041) (rerun: 64) write$qrtrtun(r1, 0x0, 0x7ffff000) (async) write$qrtrtun(r1, &(0x7f0000000140)="db", 0x1) 15:29:38 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, 0x0, 0x0) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:38 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afe", 0x3) 15:29:38 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xe941) write$qrtrtun(r0, 0x0, 0x0) r1 = syz_open_dev$vcsa(&(0x7f0000000000), 0x0, 0x40001) read$qrtrtun(r1, &(0x7f0000000080)=""/156, 0x9c) 15:29:38 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000), 0x0) 15:29:38 executing program 2: ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000080)=0x0) r1 = syz_open_dev$vcsa(&(0x7f0000000180), 0xffffffffffffffff, 0x400001) sendmsg$NL80211_CMD_SET_COALESCE(r1, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x30, 0x0, 0x400, 0x70bd2c, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0xe1, 0x57}}}}, [@NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0x400}, @NL80211_ATTR_COALESCE_RULE_CONDITION={0x8}]}, 0x30}}, 0x20000008) ioctl$BINDER_GET_FROZEN_INFO(0xffffffffffffffff, 0xc00c620f, &(0x7f00000000c0)={r0}) ioctl$SNDRV_TIMER_IOCTL_TREAD(0xffffffffffffffff, 0x40045402, &(0x7f0000000000)=0x1) r2 = syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0xa041) write$qrtrtun(r2, 0x0, 0x7ffff000) write$qrtrtun(r2, &(0x7f0000000140)="db", 0x1) fcntl$getownex(r2, 0x10, &(0x7f0000000100)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000002c0)='./cgroup.net/syz0\x00', 0x200002, 0x0) openat$cgroup_ro(r2, &(0x7f0000000300)='cpuset.memory_pressure\x00', 0x0, 0x0) syz_open_dev$ptys(0xc, 0x3, 0x0) 15:29:38 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afe", 0x3) 15:29:38 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0x29a, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:38 executing program 2: ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000080)=0x0) r1 = syz_open_dev$vcsa(&(0x7f0000000180), 0xffffffffffffffff, 0x400001) sendmsg$NL80211_CMD_SET_COALESCE(r1, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x30, 0x0, 0x400, 0x70bd2c, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0xe1, 0x57}}}}, [@NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0x400}, @NL80211_ATTR_COALESCE_RULE_CONDITION={0x8}]}, 0x30}}, 0x20000008) ioctl$BINDER_GET_FROZEN_INFO(0xffffffffffffffff, 0xc00c620f, &(0x7f00000000c0)={r0}) ioctl$SNDRV_TIMER_IOCTL_TREAD(0xffffffffffffffff, 0x40045402, &(0x7f0000000000)=0x1) r2 = syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0xa041) write$qrtrtun(r2, 0x0, 0x7ffff000) write$qrtrtun(r2, &(0x7f0000000140)="db", 0x1) fcntl$getownex(r2, 0x10, &(0x7f0000000100)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000002c0)='./cgroup.net/syz0\x00', 0x200002, 0x0) openat$cgroup_ro(r2, &(0x7f0000000300)='cpuset.memory_pressure\x00', 0x0, 0x0) syz_open_dev$ptys(0xc, 0x3, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000080)) (async) syz_open_dev$vcsa(&(0x7f0000000180), 0xffffffffffffffff, 0x400001) (async) sendmsg$NL80211_CMD_SET_COALESCE(r1, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x30, 0x0, 0x400, 0x70bd2c, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0xe1, 0x57}}}}, [@NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0x400}, @NL80211_ATTR_COALESCE_RULE_CONDITION={0x8}]}, 0x30}}, 0x20000008) (async) ioctl$BINDER_GET_FROZEN_INFO(0xffffffffffffffff, 0xc00c620f, &(0x7f00000000c0)={r0}) (async) ioctl$SNDRV_TIMER_IOCTL_TREAD(0xffffffffffffffff, 0x40045402, &(0x7f0000000000)=0x1) (async) syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0xa041) (async) write$qrtrtun(r2, 0x0, 0x7ffff000) (async) write$qrtrtun(r2, &(0x7f0000000140)="db", 0x1) (async) fcntl$getownex(r2, 0x10, &(0x7f0000000100)) (async) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000002c0)='./cgroup.net/syz0\x00', 0x200002, 0x0) (async) openat$cgroup_ro(r2, &(0x7f0000000300)='cpuset.memory_pressure\x00', 0x0, 0x0) (async) syz_open_dev$ptys(0xc, 0x3, 0x0) (async) 15:29:38 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300), 0x0) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:38 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000), 0x0) 15:29:38 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xe941) write$qrtrtun(r0, 0x0, 0x0) r1 = syz_open_dev$vcsa(&(0x7f0000000000), 0x0, 0x40001) read$qrtrtun(r1, &(0x7f0000000080)=""/156, 0x9c) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xe941) (async) write$qrtrtun(r0, 0x0, 0x0) (async) syz_open_dev$vcsa(&(0x7f0000000000), 0x0, 0x40001) (async) read$qrtrtun(r1, &(0x7f0000000080)=""/156, 0x9c) (async) 15:29:38 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef2", 0x4) 15:29:38 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300), 0x0) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:38 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0x29a, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) syz_open_dev$vcsa(&(0x7f0000000080), 0x29a, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) 15:29:38 executing program 2: ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000080)=0x0) (async) r1 = syz_open_dev$vcsa(&(0x7f0000000180), 0xffffffffffffffff, 0x400001) sendmsg$NL80211_CMD_SET_COALESCE(r1, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x30, 0x0, 0x400, 0x70bd2c, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0xe1, 0x57}}}}, [@NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0x400}, @NL80211_ATTR_COALESCE_RULE_CONDITION={0x8}]}, 0x30}}, 0x20000008) (async) ioctl$BINDER_GET_FROZEN_INFO(0xffffffffffffffff, 0xc00c620f, &(0x7f00000000c0)={r0}) (async) ioctl$SNDRV_TIMER_IOCTL_TREAD(0xffffffffffffffff, 0x40045402, &(0x7f0000000000)=0x1) (async) r2 = syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0xa041) write$qrtrtun(r2, 0x0, 0x7ffff000) (async) write$qrtrtun(r2, &(0x7f0000000140)="db", 0x1) fcntl$getownex(r2, 0x10, &(0x7f0000000100)) (async) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000002c0)='./cgroup.net/syz0\x00', 0x200002, 0x0) openat$cgroup_ro(r2, &(0x7f0000000300)='cpuset.memory_pressure\x00', 0x0, 0x0) (async) syz_open_dev$ptys(0xc, 0x3, 0x0) 15:29:38 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0x29a, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) syz_open_dev$vcsa(&(0x7f0000000080), 0x29a, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) 15:29:38 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000), 0x0) 15:29:38 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300), 0x0) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:38 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef2", 0x4) 15:29:38 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.net/syz0\x00', 0x200002, 0x0) write$qrtrtun(r0, 0x0, 0x0) r1 = socket$tipc(0x1e, 0x5, 0x0) fcntl$getownex(r1, 0x10, &(0x7f0000000080)) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r2, 0x54a3) inotify_init1(0x80800) 15:29:38 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x8001) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2, 0x4000010, r0, 0x10000000) write$qrtrtun(r1, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:38 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef2", 0x4) 15:29:38 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:38 executing program 2: socketpair(0xf, 0x6, 0xffffffff, &(0x7f0000000000)={0xffffffffffffffff}) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=@getspdinfo={0x14, 0x25, 0x300, 0x70bd28, 0x25dfdbff, 0x5, ["", "", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x4000) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x34, 0x0, 0x20, 0x70bd29, 0x25dfdbfe, {{}, {}, {0x18, 0x17, {0x4, 0xb22, @l2={'eth', 0x3a, 'sit0\x00'}}}}, ["", "", "", "", "", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x1}, 0x8000) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0xa041) write$qrtrtun(r1, 0x0, 0x7ffff000) write$qrtrtun(r1, &(0x7f0000000140)="db", 0x1) 15:29:38 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de81", 0x2) 15:29:38 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:38 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.net/syz0\x00', 0x200002, 0x0) (async) write$qrtrtun(r0, 0x0, 0x0) r1 = socket$tipc(0x1e, 0x5, 0x0) fcntl$getownex(r1, 0x10, &(0x7f0000000080)) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r2, 0x54a3) inotify_init1(0x80800) 15:29:38 executing program 2: socketpair(0xf, 0x6, 0xffffffff, &(0x7f0000000000)={0xffffffffffffffff}) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=@getspdinfo={0x14, 0x25, 0x300, 0x70bd28, 0x25dfdbff, 0x5, ["", "", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x4000) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x34, 0x0, 0x20, 0x70bd29, 0x25dfdbfe, {{}, {}, {0x18, 0x17, {0x4, 0xb22, @l2={'eth', 0x3a, 'sit0\x00'}}}}, ["", "", "", "", "", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x1}, 0x8000) (async, rerun: 64) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0xa041) (rerun: 64) write$qrtrtun(r1, 0x0, 0x7ffff000) (async, rerun: 32) write$qrtrtun(r1, &(0x7f0000000140)="db", 0x1) (rerun: 32) 15:29:38 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de", 0x1) 15:29:38 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de81", 0x2) 15:29:38 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x8001) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2, 0x4000010, r0, 0x10000000) write$qrtrtun(r1, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x8001) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2, 0x4000010, r0, 0x10000000) (async) write$qrtrtun(r1, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) 15:29:38 executing program 2: socketpair(0xf, 0x6, 0xffffffff, &(0x7f0000000000)={0xffffffffffffffff}) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=@getspdinfo={0x14, 0x25, 0x300, 0x70bd28, 0x25dfdbff, 0x5, ["", "", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x4000) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x34, 0x0, 0x20, 0x70bd29, 0x25dfdbfe, {{}, {}, {0x18, 0x17, {0x4, 0xb22, @l2={'eth', 0x3a, 'sit0\x00'}}}}, ["", "", "", "", "", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x1}, 0x8000) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0xa041) write$qrtrtun(r1, 0x0, 0x7ffff000) write$qrtrtun(r1, &(0x7f0000000140)="db", 0x1) socketpair(0xf, 0x6, 0xffffffff, &(0x7f0000000000)) (async) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=@getspdinfo={0x14, 0x25, 0x300, 0x70bd28, 0x25dfdbff, 0x5, ["", "", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x4000) (async) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x34, 0x0, 0x20, 0x70bd29, 0x25dfdbfe, {{}, {}, {0x18, 0x17, {0x4, 0xb22, @l2={'eth', 0x3a, 'sit0\x00'}}}}, ["", "", "", "", "", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x1}, 0x8000) (async) syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0xa041) (async) write$qrtrtun(r1, 0x0, 0x7ffff000) (async) write$qrtrtun(r1, &(0x7f0000000140)="db", 0x1) (async) 15:29:38 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:38 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de81", 0x2) 15:29:38 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.net/syz0\x00', 0x200002, 0x0) write$qrtrtun(r0, 0x0, 0x0) (async) r1 = socket$tipc(0x1e, 0x5, 0x0) fcntl$getownex(r1, 0x10, &(0x7f0000000080)) (async) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r2, 0x54a3) (async) inotify_init1(0x80800) 15:29:38 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de", 0x1) 15:29:38 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:38 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, 0x0, 0x0) 15:29:38 executing program 3: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) 15:29:38 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x8001) (async) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2, 0x4000010, r0, 0x10000000) (async) write$qrtrtun(r1, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:38 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, 0x0, 0x0) 15:29:38 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0xa041) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) write$qrtrtun(r1, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032abd7000fbdbdf250500000005002200010000000c001000010000000000000005000500000000000c000f00000000000000000008000c0003000000080009000000000008000c000100000008001900ac1414bb"], 0x5c}, 0x1, 0x0, 0x0, 0xc0}, 0x0) write$qrtrtun(r0, &(0x7f0000000140)="db", 0x1) 15:29:38 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de", 0x1) 15:29:38 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = gettid() r2 = gettid() r3 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) kcmp$KCMP_EPOLL_TFD(r1, r2, 0x7, r0, &(0x7f0000000080)={r3, r0, 0x8e5b}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r4, 0x10000000) r5 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r6 = getpgid(r1) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f00000000c0)={r6, 0x0, 0x2}) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r5, 0x10000000) write$qrtrtun(r5, &(0x7f0000000000)="de813892e20800c5fec3ebfa5ec0983857de4badba8f2751ffff0000000000", 0x1f) 15:29:38 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:38 executing program 3: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) 15:29:38 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, 0x0, 0x0) 15:29:38 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) r1 = gettid() (async) r2 = gettid() (async) r3 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) (async) kcmp$KCMP_EPOLL_TFD(r1, r2, 0x7, r0, &(0x7f0000000080)={r3, r0, 0x8e5b}) (async) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r4, 0x10000000) (async) r5 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) r6 = getpgid(r1) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f00000000c0)={r6, 0x0, 0x2}) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r5, 0x10000000) (async) write$qrtrtun(r5, &(0x7f0000000000)="de813892e20800c5fec3ebfa5ec0983857de4badba8f2751ffff0000000000", 0x1f) 15:29:38 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de", 0x1) 15:29:38 executing program 3: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) 15:29:38 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:38 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0xa041) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) write$qrtrtun(r1, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032abd7000fbdbdf250500000005002200010000000c001000010000000000000005000500000000000c000f00000000000000000008000c0003000000080009000000000008000c000100000008001900ac1414bb"], 0x5c}, 0x1, 0x0, 0x0, 0xc0}, 0x0) write$qrtrtun(r0, &(0x7f0000000140)="db", 0x1) syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0xa041) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) (async) write$qrtrtun(r1, 0x0, 0x0) (async) socket$inet6_udp(0xa, 0x2, 0x0) (async) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032abd7000fbdbdf250500000005002200010000000c001000010000000000000005000500000000000c000f00000000000000000008000c0003000000080009000000000008000c000100000008001900ac1414bb"], 0x5c}, 0x1, 0x0, 0x0, 0xc0}, 0x0) (async) write$qrtrtun(r0, &(0x7f0000000140)="db", 0x1) (async) 15:29:38 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de", 0x1) 15:29:38 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000), 0x0) 15:29:38 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:38 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000), 0x0) 15:29:38 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de", 0x1) 15:29:38 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) r1 = gettid() r2 = gettid() r3 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) (async) kcmp$KCMP_EPOLL_TFD(r1, r2, 0x7, r0, &(0x7f0000000080)={r3, r0, 0x8e5b}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r4, 0x10000000) (async) r5 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) r6 = getpgid(r1) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f00000000c0)={r6, 0x0, 0x2}) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r5, 0x10000000) write$qrtrtun(r5, &(0x7f0000000000)="de813892e20800c5fec3ebfa5ec0983857de4badba8f2751ffff0000000000", 0x1f) 15:29:38 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) epoll_pwait2(r0, &(0x7f0000000080)=[{}, {}, {}], 0x3, &(0x7f00000000c0), &(0x7f0000000100)={[0x7]}, 0x8) socketpair(0x1f, 0x5, 0x7, &(0x7f0000000140)={0xffffffffffffffff}) setsockopt$MRT_PIM(r1, 0x0, 0xcf, &(0x7f0000000180)=0x2, 0x4) write$qrtrtun(r0, 0x0, 0x0) openat$cgroup_devices(r0, &(0x7f0000000000)='devices.allow\x00', 0x2, 0x0) 15:29:38 executing program 0: write$qrtrtun(0xffffffffffffffff, &(0x7f0000000300)="9f", 0x1) 15:29:38 executing program 5: write$qrtrtun(0xffffffffffffffff, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)="de", 0x1) 15:29:38 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) epoll_pwait2(r0, &(0x7f0000000080)=[{}, {}, {}], 0x3, &(0x7f00000000c0), &(0x7f0000000100)={[0x7]}, 0x8) socketpair(0x1f, 0x5, 0x7, &(0x7f0000000140)={0xffffffffffffffff}) setsockopt$MRT_PIM(r1, 0x0, 0xcf, &(0x7f0000000180)=0x2, 0x4) write$qrtrtun(r0, 0x0, 0x0) openat$cgroup_devices(r0, &(0x7f0000000000)='devices.allow\x00', 0x2, 0x0) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) epoll_pwait2(r0, &(0x7f0000000080)=[{}, {}, {}], 0x3, &(0x7f00000000c0), &(0x7f0000000100)={[0x7]}, 0x8) (async) socketpair(0x1f, 0x5, 0x7, &(0x7f0000000140)) (async) setsockopt$MRT_PIM(r1, 0x0, 0xcf, &(0x7f0000000180)=0x2, 0x4) (async) write$qrtrtun(r0, 0x0, 0x0) (async) openat$cgroup_devices(r0, &(0x7f0000000000)='devices.allow\x00', 0x2, 0x0) (async) 15:29:38 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0xa041) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) write$qrtrtun(r1, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032abd7000fbdbdf250500000005002200010000000c001000010000000000000005000500000000000c000f00000000000000000008000c0003000000080009000000000008000c000100000008001900ac1414bb"], 0x5c}, 0x1, 0x0, 0x0, 0xc0}, 0x0) write$qrtrtun(r0, &(0x7f0000000140)="db", 0x1) syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0xa041) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) (async) write$qrtrtun(r1, 0x0, 0x0) (async) socket$inet6_udp(0xa, 0x2, 0x0) (async) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032abd7000fbdbdf250500000005002200010000000c001000010000000000000005000500000000000c000f00000000000000000008000c0003000000080009000000000008000c000100000008001900ac1414bb"], 0x5c}, 0x1, 0x0, 0x0, 0xc0}, 0x0) (async) write$qrtrtun(r0, &(0x7f0000000140)="db", 0x1) (async) 15:29:38 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000), 0x0) 15:29:38 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) r1 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1000000, 0x2010, r0, 0x8000000) syz_io_uring_setup(0x6abc, &(0x7f0000000080)={0x0, 0x18a8, 0x2, 0x3, 0xce, 0x0, r0}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x2, 0x0, 0x8000, 0x0, &(0x7f0000000180)="28e744fc0f26a17016ed96f8c2dea5179f8b557111804a11c36b", 0xac4, 0x0, 0x1}, 0x3ff) 15:29:38 executing program 0: write$qrtrtun(0xffffffffffffffff, &(0x7f0000000300)="9f", 0x1) 15:29:38 executing program 5: write$qrtrtun(0xffffffffffffffff, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)="de", 0x1) 15:29:38 executing program 0: write$qrtrtun(0xffffffffffffffff, &(0x7f0000000300)="9f", 0x1) 15:29:38 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4bad", 0x10) 15:29:38 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) epoll_pwait2(r0, &(0x7f0000000080)=[{}, {}, {}], 0x3, &(0x7f00000000c0), &(0x7f0000000100)={[0x7]}, 0x8) (async) socketpair(0x1f, 0x5, 0x7, &(0x7f0000000140)={0xffffffffffffffff}) setsockopt$MRT_PIM(r1, 0x0, 0xcf, &(0x7f0000000180)=0x2, 0x4) (async) write$qrtrtun(r0, 0x0, 0x0) openat$cgroup_devices(r0, &(0x7f0000000000)='devices.allow\x00', 0x2, 0x0) 15:29:38 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (fail_nth: 1) 15:29:38 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) r1 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1000000, 0x2010, r0, 0x8000000) syz_io_uring_setup(0x6abc, &(0x7f0000000080)={0x0, 0x18a8, 0x2, 0x3, 0xce, 0x0, r0}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x2, 0x0, 0x8000, 0x0, &(0x7f0000000180)="28e744fc0f26a17016ed96f8c2dea5179f8b557111804a11c36b", 0xac4, 0x0, 0x1}, 0x3ff) 15:29:38 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de", 0x1) 15:29:38 executing program 5: write$qrtrtun(0xffffffffffffffff, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)="de", 0x1) 15:29:38 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) r1 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1000000, 0x2010, r0, 0x8000000) syz_io_uring_setup(0x6abc, &(0x7f0000000080)={0x0, 0x18a8, 0x2, 0x3, 0xce, 0x0, r0}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x2, 0x0, 0x8000, 0x0, &(0x7f0000000180)="28e744fc0f26a17016ed96f8c2dea5179f8b557111804a11c36b", 0xac4, 0x0, 0x1}, 0x3ff) 15:29:38 executing program 0: r0 = syz_open_dev$vcsa(0x0, 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:38 executing program 3: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0x2, 0x80200) write$qrtrtun(r0, 0x0, 0x28) 15:29:38 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de", 0x1) 15:29:38 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (fail_nth: 2) 15:29:38 executing program 5: r0 = syz_open_dev$vcsa(0x0, 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de", 0x1) 15:29:38 executing program 0: r0 = syz_open_dev$vcsa(0x0, 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:38 executing program 0: r0 = syz_open_dev$vcsa(0x0, 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:38 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:38 executing program 5: r0 = syz_open_dev$vcsa(0x0, 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de", 0x1) 15:29:38 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) [ 3271.661669][T20366] FAULT_INJECTION: forcing a failure. [ 3271.661669][T20366] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 3271.675327][T20366] CPU: 1 PID: 20366 Comm: syz-executor.2 Not tainted 5.19.0-syzkaller-dirty #0 [ 3271.675350][T20366] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 [ 3271.675360][T20366] Call Trace: 15:29:38 executing program 5: r0 = syz_open_dev$vcsa(0x0, 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de", 0x1) [ 3271.675366][T20366] [ 3271.675383][T20366] dump_stack_lvl+0xd6/0x122 [ 3271.675410][T20366] dump_stack+0x11/0x12 [ 3271.675430][T20366] should_fail+0x242/0x250 [ 3271.675450][T20366] should_fail_usercopy+0x16/0x20 [ 3271.675469][T20366] _copy_from_user+0x1a/0xc0 [ 3271.675538][T20366] vcs_write+0x38b/0xc20 [ 3271.675573][T20366] ? avc_policy_seqno+0x22/0x30 [ 3271.675592][T20366] ? selinux_file_permission+0x223/0x350 [ 3271.675615][T20366] ? fsnotify_perm+0x5a/0x370 [ 3271.675709][T20366] ? vcs_read+0xae0/0xae0 [ 3271.675728][T20366] vfs_write+0x26d/0x890 [ 3271.675778][T20366] ? __fget_files+0x1a7/0x1e0 [ 3271.675799][T20366] ksys_write+0xe8/0x1a0 [ 3271.675817][T20366] __x64_sys_write+0x3e/0x50 [ 3271.675836][T20366] do_syscall_64+0x2b/0x70 [ 3271.675909][T20366] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 3271.675933][T20366] RIP: 0033:0x7fcad8893209 [ 3271.675949][T20366] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 3271.675975][T20366] RSP: 002b:00007fcad8009168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 3271.675992][T20366] RAX: ffffffffffffffda RBX: 00007fcad89a5f60 RCX: 00007fcad8893209 [ 3271.676068][T20366] RDX: 0000000000000003 RSI: 0000000020000000 RDI: 0000000000000003 [ 3271.676079][T20366] RBP: 00007fcad80091d0 R08: 0000000000000000 R09: 0000000000000000 [ 3271.676161][T20366] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 15:29:38 executing program 4: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x10000000) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:38 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:38 executing program 3: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0x2, 0x80200) write$qrtrtun(r0, 0x0, 0x28) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) syz_open_dev$vcsa(&(0x7f0000000000), 0x2, 0x80200) (async) write$qrtrtun(r0, 0x0, 0x28) (async) 15:29:38 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de", 0x1) 15:29:38 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de", 0x1) 15:29:38 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (fail_nth: 3) 15:29:38 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x0) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:38 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fe", 0x9) 15:29:38 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de", 0x1) [ 3271.676217][T20366] R13: 00007ffcfc6c59ef R14: 00007fcad8009300 R15: 0000000000022000 [ 3271.676232][T20366] 15:29:38 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de", 0x1) 15:29:38 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x0) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:38 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x0) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de", 0x1) [ 3271.906588][T20397] FAULT_INJECTION: forcing a failure. [ 3271.906588][T20397] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 3271.919701][T20397] CPU: 1 PID: 20397 Comm: syz-executor.2 Not tainted 5.19.0-syzkaller-dirty #0 [ 3271.928801][T20397] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 [ 3271.938947][T20397] Call Trace: [ 3271.942230][T20397] [ 3271.945342][T20397] dump_stack_lvl+0xd6/0x122 [ 3271.945370][T20397] dump_stack+0x11/0x12 [ 3271.945396][T20397] should_fail+0x242/0x250 [ 3271.945415][T20397] should_fail_usercopy+0x16/0x20 [ 3271.963877][T20397] _copy_to_user+0x1a/0x90 [ 3271.963893][T20397] simple_read_from_buffer+0xab/0x120 [ 3271.963916][T20397] proc_fail_nth_read+0x10d/0x150 [ 3271.963929][T20397] ? proc_fault_inject_write+0x230/0x230 [ 3271.963972][T20397] vfs_read+0x1a1/0x6a0 [ 3271.963983][T20397] ? __fget_files+0x1a7/0x1e0 [ 3271.964015][T20397] ksys_read+0xe8/0x1a0 [ 3271.964069][T20397] __x64_sys_read+0x3e/0x50 [ 3271.964080][T20397] do_syscall_64+0x2b/0x70 [ 3271.964160][T20397] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 3272.012245][T20397] RIP: 0033:0x7fcad8845dbc [ 3272.012257][T20397] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 [ 3272.012307][T20397] RSP: 002b:00007fcad8009160 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 3272.012319][T20397] RAX: ffffffffffffffda RBX: 00007fcad89a5f60 RCX: 00007fcad8845dbc 15:29:38 executing program 4: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x10000000) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x10000000) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) 15:29:38 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x0) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:38 executing program 3: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0x2, 0x80200) write$qrtrtun(r0, 0x0, 0x28) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) syz_open_dev$vcsa(&(0x7f0000000000), 0x2, 0x80200) (async) write$qrtrtun(r0, 0x0, 0x28) (async) 15:29:38 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:38 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x0) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de", 0x1) 15:29:38 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fe", 0x9) 15:29:38 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:38 executing program 0: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000300)="9f", 0x1) 15:29:38 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de81", 0x2) 15:29:38 executing program 4: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x10000000) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) [ 3272.012327][T20397] RDX: 000000000000000f RSI: 00007fcad80091e0 RDI: 0000000000000004 [ 3272.012334][T20397] RBP: 00007fcad80091d0 R08: 0000000000000000 R09: 0000000000000000 [ 3272.012341][T20397] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3272.012348][T20397] R13: 00007ffcfc6c59ef R14: 00007fcad8009300 R15: 0000000000022000 [ 3272.012403][T20397] 15:29:38 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) getpeername$l2tp(r0, &(0x7f0000000000)={0x2, 0x0, @dev}, &(0x7f0000000100)=0x10) write$qrtrtun(r0, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) ioctl$SNDRV_TIMER_IOCTL_STATUS64(r1, 0x80605414, &(0x7f0000000080)) 15:29:38 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x7ffff000) 15:29:38 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x0) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de", 0x1) 15:29:39 executing program 0: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000300)="9f", 0x1) 15:29:39 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) getpeername$l2tp(r0, &(0x7f0000000000)={0x2, 0x0, @dev}, &(0x7f0000000100)=0x10) (async) write$qrtrtun(r0, 0x0, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) ioctl$SNDRV_TIMER_IOCTL_STATUS64(r1, 0x80605414, &(0x7f0000000080)) 15:29:39 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) kcmp$KCMP_EPOLL_TFD(0x0, 0x0, 0x7, r0, &(0x7f0000000080)={r1, r2, 0xe4}) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:39 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x7ffffffff000) 15:29:39 executing program 0: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000300)="9f", 0x1) 15:29:39 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de81", 0x2) 15:29:39 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de", 0x1) 15:29:39 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) getpeername$l2tp(r0, &(0x7f0000000000)={0x2, 0x0, @dev}, &(0x7f0000000100)=0x10) (async) write$qrtrtun(r0, 0x0, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) ioctl$SNDRV_TIMER_IOCTL_STATUS64(r1, 0x80605414, &(0x7f0000000080)) 15:29:39 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, 0x0, 0x0) 15:29:39 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) kcmp$KCMP_EPOLL_TFD(0x0, 0x0, 0x7, r0, &(0x7f0000000080)={r1, r2, 0xe4}) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:39 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de", 0x1) 15:29:39 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, 0x0, 0x0) 15:29:39 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) kcmp$KCMP_EPOLL_TFD(0x0, 0x0, 0x7, r0, &(0x7f0000000080)={r1, r2, 0xe4}) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:39 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de", 0x1) 15:29:39 executing program 3: r0 = pkey_alloc(0x0, 0x2) pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) pkey_free(r0) getsockopt$MRT(r1, 0x0, 0xcf, &(0x7f0000000080), &(0x7f00000000c0)=0x4) r2 = syz_open_dev$vcsa(&(0x7f0000000040), 0x8, 0x103002) r3 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) ioctl$BINDER_THREAD_EXIT(r3, 0x40046208, 0x0) write$qrtrtun(r2, 0x0, 0x0) ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0) 15:29:39 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) openat$cgroup(r0, &(0x7f00000002c0)='syz0\x00', 0x200002, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r3, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, r3, 0x4, 0x70bd29, 0x25dfdbff, {{}, {@void, @void}}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x40) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000080)) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:39 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de81", 0x2) 15:29:39 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, 0x0, 0x0) 15:29:39 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) openat$cgroup(r0, &(0x7f00000002c0)='syz0\x00', 0x200002, 0x0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r3, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}}, 0x0) (async, rerun: 32) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, r3, 0x4, 0x70bd29, 0x25dfdbff, {{}, {@void, @void}}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x40) (async, rerun: 32) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) fcntl$getownex(r4, 0x10, &(0x7f0000000080)) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:39 executing program 3: r0 = pkey_alloc(0x0, 0x2) (async) pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) pkey_free(r0) (async, rerun: 64) getsockopt$MRT(r1, 0x0, 0xcf, &(0x7f0000000080), &(0x7f00000000c0)=0x4) (async, rerun: 64) r2 = syz_open_dev$vcsa(&(0x7f0000000040), 0x8, 0x103002) (async) r3 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) (async, rerun: 64) ioctl$BINDER_THREAD_EXIT(r3, 0x40046208, 0x0) (async, rerun: 64) write$qrtrtun(r2, 0x0, 0x0) (async) ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0) 15:29:39 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, 0x0, 0x0) write$qrtrtun(r0, &(0x7f0000000000)="de", 0x1) 15:29:39 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f00000000c0), 0x10006, 0x469000) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan0\x00'}) fcntl$getownex(r0, 0x10, &(0x7f0000000040)) 15:29:39 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28f", 0x6) 15:29:39 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300), 0x0) 15:29:39 executing program 3: r0 = pkey_alloc(0x0, 0x2) (async) pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) pkey_free(r0) (async) getsockopt$MRT(r1, 0x0, 0xcf, &(0x7f0000000080), &(0x7f00000000c0)=0x4) r2 = syz_open_dev$vcsa(&(0x7f0000000040), 0x8, 0x103002) r3 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) (async, rerun: 32) ioctl$BINDER_THREAD_EXIT(r3, 0x40046208, 0x0) (async, rerun: 32) write$qrtrtun(r2, 0x0, 0x0) ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0) 15:29:39 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:39 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async, rerun: 32) openat$cgroup(r0, &(0x7f00000002c0)='syz0\x00', 0x200002, 0x0) (async, rerun: 32) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r3, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}}, 0x0) (async) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, r3, 0x4, 0x70bd29, 0x25dfdbff, {{}, {@void, @void}}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x40) (async, rerun: 64) r4 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64) sendmsg$TIPC_CMD_SET_NETID(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) fcntl$getownex(r4, 0x10, &(0x7f0000000080)) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:39 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, 0x0, 0x0) write$qrtrtun(r0, &(0x7f0000000000)="de", 0x1) 15:29:39 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300), 0x0) 15:29:39 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, 0x0, 0x0) write$qrtrtun(r0, &(0x7f0000000000)="de", 0x1) 15:29:39 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_MCAST_REPLICAST(r1, 0x10f, 0x86) setsockopt$TIPC_GROUP_LEAVE(r1, 0x10f, 0x88) r2 = socket$igmp(0x2, 0x3, 0x2) ioctl$SIOCGETMIFCNT_IN6(r2, 0x89e0, &(0x7f0000000000)) write$qrtrtun(r0, &(0x7f0000000440)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481f5782d9fb72caa6ea3a617840c9b90e557c139092dc7b774cdd0334eaa472340560f8bf27bc298e4b1c6c1d0e514a94524cafffdfc7ee13cdcf30929dacad59e4ccfc0744ce353efa41e0b9314c7d12adb17c2b53a9feff7f00000000000087176a320a38d439c80469ae3725c104019c95cedc23037950d52f73c7ea826509b873f535ea8267e6a0eff62142f9b11c830fd43e9cd94d955ef6cb5bccff4cc4b0bbc442415716a6b2539b073b2903cf9fb27092cf8ede52bad1789d7f7e707b08dd7ec4cc6d888abe63be08b5063d83aa0eb644beeaefc1bb4ec74895286db8a12fe2bf06b7ce94074bf097547f4f391b134681239e4ee4c1a0b77a83bfb0294d9b0be801c4b075cdb1bd21bc13b6ddd038cc69ac7c6f3d76634fe84351a03227cbed703c0e02c7ce0253864e33127503183f89aaaf2b168ac67aad863a9f7c58ab2a9b671d", 0x15e) write$qrtrtun(r0, &(0x7f0000000080)="8138e6dcbdb6657fc6700c0c020900b14d9f3db20251c46adfc1e40c044f709cfd5adc6eb9acb72a1b3954aad403aaa28229004107109e72de6e48b91c9b38a7938b16508b8d376c8f20f70839bf736aaa0654a9130b948b55e6bedf3cf3a609c2e0c532172b4f2db8025dad0117154fe563114a5f938fe70322542a4fe0385c47f4418a614c9a24739e44f6da4239a884bab11d81f075a2c3bd234d96afccaf50456a731aadc0b9f2316a7fc93cb0de95d5c56b4bc556c83051858ac17a8561e46c2d8f33bae4fd78648b4c2a05bd442e6d60d35a8a38794cf5deacb7915fc6ed6b9566613f8d602a236e79cc68b21fd394e50dec0ebee7005299ab264b799abff6dc7b49c152ee0b5aaeb5829faec5d49b9f45bba6ee423275b33c3942f61885d086fcd7544266683c5f7c7d9e7a2b7c9775295054d3d191648796e2467cde1c0d46f772fa80", 0x147) 15:29:39 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000), 0x0) 15:29:39 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f00000000c0), 0x10006, 0x469000) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan0\x00'}) fcntl$getownex(r0, 0x10, &(0x7f0000000040)) syz_open_dev$vcsa(&(0x7f00000000c0), 0x10006, 0x469000) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan0\x00'}) (async) fcntl$getownex(r0, 0x10, &(0x7f0000000040)) (async) 15:29:39 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300), 0x0) 15:29:39 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300), 0x0) write$qrtrtun(r0, &(0x7f0000000000)="de", 0x1) 15:29:39 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000), 0x0) 15:29:39 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_MCAST_REPLICAST(r1, 0x10f, 0x86) (async) setsockopt$TIPC_GROUP_LEAVE(r1, 0x10f, 0x88) (async) r2 = socket$igmp(0x2, 0x3, 0x2) ioctl$SIOCGETMIFCNT_IN6(r2, 0x89e0, &(0x7f0000000000)) write$qrtrtun(r0, &(0x7f0000000440)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481f5782d9fb72caa6ea3a617840c9b90e557c139092dc7b774cdd0334eaa472340560f8bf27bc298e4b1c6c1d0e514a94524cafffdfc7ee13cdcf30929dacad59e4ccfc0744ce353efa41e0b9314c7d12adb17c2b53a9feff7f00000000000087176a320a38d439c80469ae3725c104019c95cedc23037950d52f73c7ea826509b873f535ea8267e6a0eff62142f9b11c830fd43e9cd94d955ef6cb5bccff4cc4b0bbc442415716a6b2539b073b2903cf9fb27092cf8ede52bad1789d7f7e707b08dd7ec4cc6d888abe63be08b5063d83aa0eb644beeaefc1bb4ec74895286db8a12fe2bf06b7ce94074bf097547f4f391b134681239e4ee4c1a0b77a83bfb0294d9b0be801c4b075cdb1bd21bc13b6ddd038cc69ac7c6f3d76634fe84351a03227cbed703c0e02c7ce0253864e33127503183f89aaaf2b168ac67aad863a9f7c58ab2a9b671d", 0x15e) write$qrtrtun(r0, &(0x7f0000000080)="8138e6dcbdb6657fc6700c0c020900b14d9f3db20251c46adfc1e40c044f709cfd5adc6eb9acb72a1b3954aad403aaa28229004107109e72de6e48b91c9b38a7938b16508b8d376c8f20f70839bf736aaa0654a9130b948b55e6bedf3cf3a609c2e0c532172b4f2db8025dad0117154fe563114a5f938fe70322542a4fe0385c47f4418a614c9a24739e44f6da4239a884bab11d81f075a2c3bd234d96afccaf50456a731aadc0b9f2316a7fc93cb0de95d5c56b4bc556c83051858ac17a8561e46c2d8f33bae4fd78648b4c2a05bd442e6d60d35a8a38794cf5deacb7915fc6ed6b9566613f8d602a236e79cc68b21fd394e50dec0ebee7005299ab264b799abff6dc7b49c152ee0b5aaeb5829faec5d49b9f45bba6ee423275b33c3942f61885d086fcd7544266683c5f7c7d9e7a2b7c9775295054d3d191648796e2467cde1c0d46f772fa80", 0x147) 15:29:39 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000380)=@IORING_OP_TEE={0x21, 0x0, 0x0, @fd_index=0x8, 0x0, 0x0, 0x200, 0x8, 0x1, {0x0, 0x0, r1}}, 0x7) bind$tipc(r0, 0x0, 0x0) read$qrtrtun(r0, &(0x7f0000000140)=""/227, 0xe3) r2 = syz_io_uring_setup(0x176f, &(0x7f0000000080), &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_setup(0x176f, &(0x7f0000000080), &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000006, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_MADVISE={0x19, 0x0, 0x0, 0x0, 0x0, &(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000340)=@IORING_OP_NOP={0x0, 0x3}, 0xdec2) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) sendmsg$TIPC_CMD_RESET_LINK_STATS(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x28, 0x0, 0x10, 0x70bd25, 0x25dfdbfc, {{}, {}, {0xc, 0x14, 'syz1\x00'}}, [""]}, 0x28}, 0x1, 0x0, 0x0, 0x40040}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r5, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r5, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x2c, 0x0, 0x1, 0x70bd26, 0x25dfdbfe, {}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x3}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}]}, 0x2c}}, 0x40804) 15:29:39 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:39 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300), 0x0) write$qrtrtun(r0, &(0x7f0000000000)="de", 0x1) 15:29:39 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000), 0x0) 15:29:39 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000380)=@IORING_OP_TEE={0x21, 0x0, 0x0, @fd_index=0x8, 0x0, 0x0, 0x200, 0x8, 0x1, {0x0, 0x0, r1}}, 0x7) (async) bind$tipc(r0, 0x0, 0x0) read$qrtrtun(r0, &(0x7f0000000140)=""/227, 0xe3) (async) r2 = syz_io_uring_setup(0x176f, &(0x7f0000000080), &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_setup(0x176f, &(0x7f0000000080), &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)) (async) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000006, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_MADVISE={0x19, 0x0, 0x0, 0x0, 0x0, &(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000340)=@IORING_OP_NOP={0x0, 0x3}, 0xdec2) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) sendmsg$TIPC_CMD_RESET_LINK_STATS(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x28, 0x0, 0x10, 0x70bd25, 0x25dfdbfc, {{}, {}, {0xc, 0x14, 'syz1\x00'}}, [""]}, 0x28}, 0x1, 0x0, 0x0, 0x40040}, 0x0) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r5, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r5, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x2c, 0x0, 0x1, 0x70bd26, 0x25dfdbfe, {}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x3}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}]}, 0x2c}}, 0x40804) 15:29:39 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:39 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f00000000c0), 0x10006, 0x469000) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan0\x00'}) fcntl$getownex(r0, 0x10, &(0x7f0000000040)) syz_open_dev$vcsa(&(0x7f00000000c0), 0x10006, 0x469000) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan0\x00'}) (async) fcntl$getownex(r0, 0x10, &(0x7f0000000040)) (async) 15:29:39 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300), 0x0) write$qrtrtun(r0, &(0x7f0000000000)="de", 0x1) 15:29:39 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_MCAST_REPLICAST(r1, 0x10f, 0x86) (async, rerun: 32) setsockopt$TIPC_GROUP_LEAVE(r1, 0x10f, 0x88) (async, rerun: 32) r2 = socket$igmp(0x2, 0x3, 0x2) ioctl$SIOCGETMIFCNT_IN6(r2, 0x89e0, &(0x7f0000000000)) write$qrtrtun(r0, &(0x7f0000000440)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481f5782d9fb72caa6ea3a617840c9b90e557c139092dc7b774cdd0334eaa472340560f8bf27bc298e4b1c6c1d0e514a94524cafffdfc7ee13cdcf30929dacad59e4ccfc0744ce353efa41e0b9314c7d12adb17c2b53a9feff7f00000000000087176a320a38d439c80469ae3725c104019c95cedc23037950d52f73c7ea826509b873f535ea8267e6a0eff62142f9b11c830fd43e9cd94d955ef6cb5bccff4cc4b0bbc442415716a6b2539b073b2903cf9fb27092cf8ede52bad1789d7f7e707b08dd7ec4cc6d888abe63be08b5063d83aa0eb644beeaefc1bb4ec74895286db8a12fe2bf06b7ce94074bf097547f4f391b134681239e4ee4c1a0b77a83bfb0294d9b0be801c4b075cdb1bd21bc13b6ddd038cc69ac7c6f3d76634fe84351a03227cbed703c0e02c7ce0253864e33127503183f89aaaf2b168ac67aad863a9f7c58ab2a9b671d", 0x15e) (async) write$qrtrtun(r0, &(0x7f0000000080)="8138e6dcbdb6657fc6700c0c020900b14d9f3db20251c46adfc1e40c044f709cfd5adc6eb9acb72a1b3954aad403aaa28229004107109e72de6e48b91c9b38a7938b16508b8d376c8f20f70839bf736aaa0654a9130b948b55e6bedf3cf3a609c2e0c532172b4f2db8025dad0117154fe563114a5f938fe70322542a4fe0385c47f4418a614c9a24739e44f6da4239a884bab11d81f075a2c3bd234d96afccaf50456a731aadc0b9f2316a7fc93cb0de95d5c56b4bc556c83051858ac17a8561e46c2d8f33bae4fd78648b4c2a05bd442e6d60d35a8a38794cf5deacb7915fc6ed6b9566613f8d602a236e79cc68b21fd394e50dec0ebee7005299ab264b799abff6dc7b49c152ee0b5aaeb5829faec5d49b9f45bba6ee423275b33c3942f61885d086fcd7544266683c5f7c7d9e7a2b7c9775295054d3d191648796e2467cde1c0d46f772fa80", 0x147) 15:29:39 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de81", 0x2) 15:29:39 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:39 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767", 0x10) write$qrtrtun(r0, &(0x7f0000000000)="de", 0x1) 15:29:39 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de81", 0x2) 15:29:39 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, 0x0, 0x0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000380)=@IORING_OP_TEE={0x21, 0x0, 0x0, @fd_index=0x8, 0x0, 0x0, 0x200, 0x8, 0x1, {0x0, 0x0, r1}}, 0x7) (async) bind$tipc(r0, 0x0, 0x0) (async) read$qrtrtun(r0, &(0x7f0000000140)=""/227, 0xe3) (async) r2 = syz_io_uring_setup(0x176f, &(0x7f0000000080), &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_setup(0x176f, &(0x7f0000000080), &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)) (async) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000006, 0x12, r2, 0x10000000) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_MADVISE={0x19, 0x0, 0x0, 0x0, 0x0, &(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x0) (async) syz_io_uring_submit(0x0, r4, &(0x7f0000000340)=@IORING_OP_NOP={0x0, 0x3}, 0xdec2) (async) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) sendmsg$TIPC_CMD_RESET_LINK_STATS(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x28, 0x0, 0x10, 0x70bd25, 0x25dfdbfc, {{}, {}, {0xc, 0x14, 'syz1\x00'}}, [""]}, 0x28}, 0x1, 0x0, 0x0, 0x40040}, 0x0) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r5, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r5, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x2c, 0x0, 0x1, 0x70bd26, 0x25dfdbfe, {}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x3}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}]}, 0x2c}}, 0x40804) 15:29:39 executing program 2: r0 = socket$l2tp(0x2, 0x2, 0x73) sendto$l2tp(r0, &(0x7f0000000080)="00f9cb4cc33ab8428d3cd3f3c1f8fd2292b68ab71ba53e85058cbc2690402b37cd918d4166c6bda9c7c48b70bb79f98d4f95127be21ca22a2ae60371215ebbede5ed632ad676c825f95aa6ec18e9b87a8b9d3c1790afbcf150815905e2bd41d3", 0x60, 0x400c0d1, &(0x7f0000000100)={0x2, 0x0, @private=0xa010102, 0x3}, 0x10) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)="de8138", 0x3) 15:29:39 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:39 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767", 0x10) write$qrtrtun(r0, &(0x7f0000000000)="de", 0x1) 15:29:39 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (fail_nth: 1) 15:29:39 executing program 4: ioctl$IOC_WATCH_QUEUE_SET_FILTER(0xffffffffffffffff, 0x5761, &(0x7f0000000080)={0x3, 0x0, [{0x0, 0xfb7, 0x8001, [0x1ff, 0x9, 0xe4b9, 0x1, 0x5, 0x0, 0xfff, 0x1]}, {0x101, 0x0, 0x401, [0x3, 0x0, 0x6, 0x7fff, 0x4, 0x1, 0x5, 0x6]}, {0x7fffffff, 0x800, 0x6, [0x60, 0xfffffffc, 0x10001, 0x2703, 0x6, 0xffff, 0x2, 0x9]}]}) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:39 executing program 2: r0 = socket$l2tp(0x2, 0x2, 0x73) sendto$l2tp(r0, &(0x7f0000000080)="00f9cb4cc33ab8428d3cd3f3c1f8fd2292b68ab71ba53e85058cbc2690402b37cd918d4166c6bda9c7c48b70bb79f98d4f95127be21ca22a2ae60371215ebbede5ed632ad676c825f95aa6ec18e9b87a8b9d3c1790afbcf150815905e2bd41d3", 0x60, 0x400c0d1, &(0x7f0000000100)={0x2, 0x0, @private=0xa010102, 0x3}, 0x10) (async) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)="de8138", 0x3) 15:29:39 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de81", 0x2) 15:29:39 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767", 0x10) write$qrtrtun(r0, &(0x7f0000000000)="de", 0x1) 15:29:39 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (fail_nth: 1) 15:29:39 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:39 executing program 4: ioctl$IOC_WATCH_QUEUE_SET_FILTER(0xffffffffffffffff, 0x5761, &(0x7f0000000080)={0x3, 0x0, [{0x0, 0xfb7, 0x8001, [0x1ff, 0x9, 0xe4b9, 0x1, 0x5, 0x0, 0xfff, 0x1]}, {0x101, 0x0, 0x401, [0x3, 0x0, 0x6, 0x7fff, 0x4, 0x1, 0x5, 0x6]}, {0x7fffffff, 0x800, 0x6, [0x60, 0xfffffffc, 0x10001, 0x2703, 0x6, 0xffff, 0x2, 0x9]}]}) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) ioctl$IOC_WATCH_QUEUE_SET_FILTER(0xffffffffffffffff, 0x5761, &(0x7f0000000080)={0x3, 0x0, [{0x0, 0xfb7, 0x8001, [0x1ff, 0x9, 0xe4b9, 0x1, 0x5, 0x0, 0xfff, 0x1]}, {0x101, 0x0, 0x401, [0x3, 0x0, 0x6, 0x7fff, 0x4, 0x1, 0x5, 0x6]}, {0x7fffffff, 0x800, 0x6, [0x60, 0xfffffffc, 0x10001, 0x2703, 0x6, 0xffff, 0x2, 0x9]}]}) (async) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) 15:29:39 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (fail_nth: 2) 15:29:39 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf48", 0x18) write$qrtrtun(r0, &(0x7f0000000000)="de", 0x1) 15:29:39 executing program 4: ioctl$IOC_WATCH_QUEUE_SET_FILTER(0xffffffffffffffff, 0x5761, &(0x7f0000000080)={0x3, 0x0, [{0x0, 0xfb7, 0x8001, [0x1ff, 0x9, 0xe4b9, 0x1, 0x5, 0x0, 0xfff, 0x1]}, {0x101, 0x0, 0x401, [0x3, 0x0, 0x6, 0x7fff, 0x4, 0x1, 0x5, 0x6]}, {0x7fffffff, 0x800, 0x6, [0x60, 0xfffffffc, 0x10001, 0x2703, 0x6, 0xffff, 0x2, 0x9]}]}) (async) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:39 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (fail_nth: 2) 15:29:39 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:39 executing program 2: r0 = socket$l2tp(0x2, 0x2, 0x73) sendto$l2tp(r0, &(0x7f0000000080)="00f9cb4cc33ab8428d3cd3f3c1f8fd2292b68ab71ba53e85058cbc2690402b37cd918d4166c6bda9c7c48b70bb79f98d4f95127be21ca22a2ae60371215ebbede5ed632ad676c825f95aa6ec18e9b87a8b9d3c1790afbcf150815905e2bd41d3", 0x60, 0x400c0d1, &(0x7f0000000100)={0x2, 0x0, @private=0xa010102, 0x3}, 0x10) (async) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)="de8138", 0x3) 15:29:39 executing program 2: sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0xc0, 0x0, 0x200, 0x70bd28, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_REKEY_DATA={0x5c, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="3ea74d06448cf1fdcc6fd537682510d0"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="f1c8500284c1b50131be0f28ff545c26"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "e5735f68301ab70b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="3c0da7b76601aa55e6442dd7d86bb985"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xffff}]}, @NL80211_ATTR_REKEY_DATA={0x30, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "2b1e190c9ec2a336"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "63c06f66f67430ae"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="933a668776b536fb0b54d9860c061c78"}]}, @NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="0f29f4147630d8902b11a7282d886dcf52b27d98dbbc320f"}]}]}, 0xc0}, 0x1, 0x0, 0x0, 0x10}, 0x40) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r0, 0x80585414, &(0x7f0000000200)) [ 3272.534203][T20638] FAULT_INJECTION: forcing a failure. [ 3272.534203][T20638] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 3272.547466][T20638] CPU: 1 PID: 20638 Comm: syz-executor.3 Not tainted 5.19.0-syzkaller-dirty #0 [ 3272.547488][T20638] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 [ 3272.547499][T20638] Call Trace: [ 3272.547505][T20638] [ 3272.547560][T20638] dump_stack_lvl+0xd6/0x122 [ 3272.547588][T20638] dump_stack+0x11/0x12 [ 3272.547606][T20638] should_fail+0x242/0x250 [ 3272.547626][T20638] should_fail_usercopy+0x16/0x20 [ 3272.547645][T20638] _copy_from_user+0x1a/0xc0 [ 3272.547687][T20638] vcs_write+0x38b/0xc20 [ 3272.547706][T20638] ? avc_policy_seqno+0x22/0x30 [ 3272.547722][T20638] ? selinux_file_permission+0x223/0x350 [ 3272.547741][T20638] ? fsnotify_perm+0x5a/0x370 [ 3272.547806][T20638] ? vcs_read+0xae0/0xae0 [ 3272.547824][T20638] vfs_write+0x26d/0x890 [ 3272.547841][T20638] ? __fget_files+0x1a7/0x1e0 [ 3272.547860][T20638] ksys_write+0xe8/0x1a0 [ 3272.547879][T20638] __x64_sys_write+0x3e/0x50 [ 3272.547974][T20638] do_syscall_64+0x2b/0x70 [ 3272.547995][T20638] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 3272.548017][T20638] RIP: 0033:0x7f6206c99209 [ 3272.548031][T20638] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 3272.548075][T20638] RSP: 002b:00007f620640f168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 3272.548094][T20638] RAX: ffffffffffffffda RBX: 00007f6206dabf60 RCX: 00007f6206c99209 [ 3272.548106][T20638] RDX: 0000000000000001 RSI: 0000000020000300 RDI: 0000000000000003 [ 3272.548119][T20638] RBP: 00007f620640f1d0 R08: 0000000000000000 R09: 0000000000000000 [ 3272.548130][T20638] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3272.548142][T20638] R13: 00007ffe4d052cef R14: 00007f620640f300 R15: 0000000000022000 [ 3272.548158][T20638] [ 3272.596252][T20655] FAULT_INJECTION: forcing a failure. [ 3272.596252][T20655] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 3272.596276][T20655] CPU: 0 PID: 20655 Comm: syz-executor.1 Not tainted 5.19.0-syzkaller-dirty #0 [ 3272.596298][T20655] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 [ 3272.596309][T20655] Call Trace: [ 3272.596315][T20655] [ 3272.596322][T20655] dump_stack_lvl+0xd6/0x122 [ 3272.596372][T20655] dump_stack+0x11/0x12 [ 3272.596393][T20655] should_fail+0x242/0x250 [ 3272.596432][T20655] should_fail_usercopy+0x16/0x20 [ 3272.596488][T20655] _copy_from_user+0x1a/0xc0 [ 3272.596505][T20655] kstrtouint_from_user+0x81/0xf0 [ 3272.596525][T20655] ? 0xffffffff81000000 [ 3272.596537][T20655] proc_fail_nth_write+0x4b/0x150 [ 3272.596557][T20655] ? proc_fail_nth_read+0x150/0x150 [ 3272.596587][T20655] vfs_write+0x26d/0x890 [ 3272.596604][T20655] ? __fget_files+0x1a7/0x1e0 [ 3272.596640][T20655] ksys_write+0xe8/0x1a0 [ 3272.596658][T20655] __x64_sys_write+0x3e/0x50 [ 3272.596697][T20655] do_syscall_64+0x2b/0x70 [ 3272.596718][T20655] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 3272.596741][T20655] RIP: 0033:0x7f3c6337ad1f [ 3272.596755][T20655] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 fd ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 cc fd ff ff 48 [ 3272.596774][T20655] RSP: 002b:00007f3c62b1d160 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 3272.596822][T20655] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f3c6337ad1f 15:29:39 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:39 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf48", 0x18) write$qrtrtun(r0, &(0x7f0000000000)="de", 0x1) 15:29:39 executing program 2: sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0xc0, 0x0, 0x200, 0x70bd28, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_REKEY_DATA={0x5c, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="3ea74d06448cf1fdcc6fd537682510d0"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="f1c8500284c1b50131be0f28ff545c26"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "e5735f68301ab70b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="3c0da7b76601aa55e6442dd7d86bb985"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xffff}]}, @NL80211_ATTR_REKEY_DATA={0x30, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "2b1e190c9ec2a336"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "63c06f66f67430ae"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="933a668776b536fb0b54d9860c061c78"}]}, @NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="0f29f4147630d8902b11a7282d886dcf52b27d98dbbc320f"}]}]}, 0xc0}, 0x1, 0x0, 0x0, 0x10}, 0x40) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r0, 0x80585414, &(0x7f0000000200)) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0xc0, 0x0, 0x200, 0x70bd28, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_REKEY_DATA={0x5c, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="3ea74d06448cf1fdcc6fd537682510d0"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="f1c8500284c1b50131be0f28ff545c26"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "e5735f68301ab70b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="3c0da7b76601aa55e6442dd7d86bb985"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xffff}]}, @NL80211_ATTR_REKEY_DATA={0x30, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "2b1e190c9ec2a336"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "63c06f66f67430ae"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="933a668776b536fb0b54d9860c061c78"}]}, @NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="0f29f4147630d8902b11a7282d886dcf52b27d98dbbc320f"}]}]}, 0xc0}, 0x1, 0x0, 0x0, 0x10}, 0x40) (async) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r0, 0x80585414, &(0x7f0000000200)) (async) 15:29:39 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (fail_nth: 3) 15:29:39 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de5038", 0x3) 15:29:39 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) io_uring_setup(0x4c15, &(0x7f0000000080)={0x0, 0xf9f, 0x2, 0x2, 0x18e, 0x0, r0}) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000140)='htcp\x00', 0x5) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:39 executing program 0: write$qrtrtun(0xffffffffffffffff, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)="de8138", 0xf85) [ 3272.877995][T20655] RDX: 0000000000000001 RSI: 00007f3c62b1d1e0 RDI: 0000000000000004 [ 3272.878005][T20655] RBP: 00007f3c62b1d1d0 R08: 0000000000000000 R09: 0000000000000000 [ 3272.878012][T20655] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 3272.878026][T20655] R13: 00007ffd6f6470ef R14: 00007f3c62b1d300 R15: 0000000000022000 [ 3272.878037][T20655] 15:29:39 executing program 0: write$qrtrtun(0xffffffffffffffff, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)="de8138", 0xf85) 15:29:39 executing program 0: write$qrtrtun(0xffffffffffffffff, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)="de8138", 0xf85) 15:29:39 executing program 0: r0 = syz_open_dev$vcsa(0x0, 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) [ 3272.941563][T20663] FAULT_INJECTION: forcing a failure. [ 3272.941563][T20663] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 3272.954643][T20663] CPU: 0 PID: 20663 Comm: syz-executor.3 Not tainted 5.19.0-syzkaller-dirty #0 [ 3272.954689][T20663] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 [ 3272.954698][T20663] Call Trace: [ 3272.954703][T20663] [ 3272.954709][T20663] dump_stack_lvl+0xd6/0x122 [ 3272.954733][T20663] dump_stack+0x11/0x12 15:29:39 executing program 0: r0 = syz_open_dev$vcsa(0x0, 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:39 executing program 0: r0 = syz_open_dev$vcsa(0x0, 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:39 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf48", 0x18) write$qrtrtun(r0, &(0x7f0000000000)="de", 0x1) 15:29:39 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) [ 3272.954750][T20663] should_fail+0x242/0x250 [ 3272.954826][T20663] should_fail_usercopy+0x16/0x20 [ 3272.954843][T20663] _copy_to_user+0x1a/0x90 [ 3272.954860][T20663] simple_read_from_buffer+0xab/0x120 [ 3272.954881][T20663] proc_fail_nth_read+0x10d/0x150 [ 3272.954900][T20663] ? proc_fault_inject_write+0x230/0x230 [ 3272.954975][T20663] vfs_read+0x1a1/0x6a0 [ 3273.023279][T20663] ? __fget_files+0x1a7/0x1e0 [ 3273.028031][T20663] ksys_read+0xe8/0x1a0 [ 3273.028053][T20663] __x64_sys_read+0x3e/0x50 [ 3273.028072][T20663] do_syscall_64+0x2b/0x70 [ 3273.028135][T20663] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 3273.028160][T20663] RIP: 0033:0x7f6206c4bdbc [ 3273.028172][T20663] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 [ 3273.028186][T20663] RSP: 002b:00007f620640f160 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 15:29:39 executing program 2: sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0xc0, 0x0, 0x200, 0x70bd28, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_REKEY_DATA={0x5c, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="3ea74d06448cf1fdcc6fd537682510d0"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="f1c8500284c1b50131be0f28ff545c26"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "e5735f68301ab70b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="3c0da7b76601aa55e6442dd7d86bb985"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xffff}]}, @NL80211_ATTR_REKEY_DATA={0x30, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "2b1e190c9ec2a336"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "63c06f66f67430ae"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="933a668776b536fb0b54d9860c061c78"}]}, @NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="0f29f4147630d8902b11a7282d886dcf52b27d98dbbc320f"}]}]}, 0xc0}, 0x1, 0x0, 0x0, 0x10}, 0x40) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r0, 0x80585414, &(0x7f0000000200)) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0xc0, 0x0, 0x200, 0x70bd28, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_REKEY_DATA={0x5c, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="3ea74d06448cf1fdcc6fd537682510d0"}, @NL80211_REKEY_DATA_AKM={0x8}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="f1c8500284c1b50131be0f28ff545c26"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "e5735f68301ab70b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="3c0da7b76601aa55e6442dd7d86bb985"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xffff}]}, @NL80211_ATTR_REKEY_DATA={0x30, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "2b1e190c9ec2a336"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "63c06f66f67430ae"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="933a668776b536fb0b54d9860c061c78"}]}, @NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="0f29f4147630d8902b11a7282d886dcf52b27d98dbbc320f"}]}]}, 0xc0}, 0x1, 0x0, 0x0, 0x10}, 0x40) (async) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r0, 0x80585414, &(0x7f0000000200)) (async) 15:29:39 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:39 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8119", 0x3) 15:29:40 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) io_uring_setup(0x4c15, &(0x7f0000000080)={0x0, 0xf9f, 0x2, 0x2, 0x18e, 0x0, r0}) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000140)='htcp\x00', 0x5) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) io_uring_setup(0x4c15, &(0x7f0000000080)={0x0, 0xf9f, 0x2, 0x2, 0x18e, 0x0, r0}) (async) openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0) (async) write$tcp_congestion(r1, &(0x7f0000000140)='htcp\x00', 0x5) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) 15:29:40 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9", 0x1c) write$qrtrtun(r0, &(0x7f0000000000)="de", 0x1) 15:29:40 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000080)="00000000000a0000000094ac2d4b916e76d5b53b8e0d3a43e5000000540a97de6240ccce2946f2cf18e6b8914ae2991529e014d94e0b2b670f03251b79214bcb1012c28179f62968dafab4408ceaa29fff3a86988de6004a13b3f41e505590b3fa75a38ff1e73d07b690dc4c0efbcb644c679353c80639051a24cb8adf6248ebd6666eda196cf780a3", 0x89) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000003c0), r1) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r2, &(0x7f0000000380)={&(0x7f0000000280), 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x3c, r3, 0x9, 0x0, 0x0, {}, [@NLBL_UNLABEL_A_SECCTX={0x28, 0x7, 'system_u:object_r:syslogd_exec_t:s0\x00'}]}, 0x3c}}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000300), r2) sendmsg$IEEE802154_ASSOCIATE_RESP(r4, &(0x7f00000004c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000480)={&(0x7f0000000500)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="08002bbd7000fddbdf251300000006000800a2aa00000500172dd008099cb10300030000000c0009000202aaaaaaaaaaaa0c0009000203aaaaaaaaaaaa050003000200000006000800a3aa00000c0009000000000000000000"], 0x58}, 0x1, 0x0, 0x0, 0x4000010}, 0x4000) sendmsg$NLBL_UNLABEL_C_STATICLIST(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000), 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="44da9800", @ANYRES16=r3, @ANYBLOB="00042cbd7000fedbdf250500000005000100010000002600070073797374656d5f753a6f626a6563745f723a756465765f72756c65735f743a7330000000"], 0x44}}, 0x14000000) 15:29:40 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xfa3) 15:29:40 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 2: pkey_free(0xffffffffffffffff) pkey_alloc(0x0, 0x2) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) [ 3273.028209][T20663] RAX: ffffffffffffffda RBX: 00007f6206dabf60 RCX: 00007f6206c4bdbc [ 3273.028221][T20663] RDX: 000000000000000f RSI: 00007f620640f1e0 RDI: 0000000000000004 [ 3273.028287][T20663] RBP: 00007f620640f1d0 R08: 0000000000000000 R09: 0000000000000000 [ 3273.028299][T20663] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3273.028311][T20663] R13: 00007ffe4d052cef R14: 00007f620640f300 R15: 0000000000022000 [ 3273.028394][T20663] 15:29:40 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9", 0x1c) write$qrtrtun(r0, &(0x7f0000000000)="de", 0x1) 15:29:40 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x7ffff000) 15:29:40 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000080)="00000000000a0000000094ac2d4b916e76d5b53b8e0d3a43e5000000540a97de6240ccce2946f2cf18e6b8914ae2991529e014d94e0b2b670f03251b79214bcb1012c28179f62968dafab4408ceaa29fff3a86988de6004a13b3f41e505590b3fa75a38ff1e73d07b690dc4c0efbcb644c679353c80639051a24cb8adf6248ebd6666eda196cf780a3", 0x89) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r3 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000003c0), r1) (rerun: 64) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r2, &(0x7f0000000380)={&(0x7f0000000280), 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x3c, r3, 0x9, 0x0, 0x0, {}, [@NLBL_UNLABEL_A_SECCTX={0x28, 0x7, 'system_u:object_r:syslogd_exec_t:s0\x00'}]}, 0x3c}}, 0x0) (async, rerun: 64) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000300), r2) sendmsg$IEEE802154_ASSOCIATE_RESP(r4, &(0x7f00000004c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000480)={&(0x7f0000000500)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="08002bbd7000fddbdf251300000006000800a2aa00000500172dd008099cb10300030000000c0009000202aaaaaaaaaaaa0c0009000203aaaaaaaaaaaa050003000200000006000800a3aa00000c0009000000000000000000"], 0x58}, 0x1, 0x0, 0x0, 0x4000010}, 0x4000) sendmsg$NLBL_UNLABEL_C_STATICLIST(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000), 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="44da9800", @ANYRES16=r3, @ANYBLOB="00042cbd7000fedbdf250500000005000100010000002600070073797374656d5f753a6f626a6563745f723a756465765f72756c65735f743a7330000000"], 0x44}}, 0x14000000) 15:29:40 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9", 0x1c) write$qrtrtun(r0, &(0x7f0000000000)="de", 0x1) 15:29:40 executing program 2: pkey_free(0xffffffffffffffff) pkey_alloc(0x0, 0x2) (async, rerun: 64) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (rerun: 64) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:40 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) io_uring_setup(0x4c15, &(0x7f0000000080)={0x0, 0xf9f, 0x2, 0x2, 0x18e, 0x0, r0}) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0) write$tcp_congestion(r1, &(0x7f0000000140)='htcp\x00', 0x5) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:40 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d96178", 0x1e) write$qrtrtun(r0, &(0x7f0000000000)="de", 0x1) 15:29:40 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x7ff, 0x8, 0xffffffff, 0xa, r0, 0x8, '\x00', 0x0, r1, 0x3, 0x4, 0x1}, 0x48) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0) 15:29:40 executing program 2: pkey_free(0xffffffffffffffff) pkey_alloc(0x0, 0x2) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) pkey_free(0xffffffffffffffff) (async) pkey_alloc(0x0, 0x2) (async) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) 15:29:40 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x7ffffffff000) 15:29:40 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x0) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d96178", 0x1e) write$qrtrtun(r0, &(0x7f0000000000)="de", 0x1) 15:29:40 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x7ff, 0x8, 0xffffffff, 0xa, r0, 0x8, '\x00', 0x0, r1, 0x3, 0x4, 0x1}, 0x48) (async) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0) 15:29:40 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000080)="00000000000a0000000094ac2d4b916e76d5b53b8e0d3a43e5000000540a97de6240ccce2946f2cf18e6b8914ae2991529e014d94e0b2b670f03251b79214bcb1012c28179f62968dafab4408ceaa29fff3a86988de6004a13b3f41e505590b3fa75a38ff1e73d07b690dc4c0efbcb644c679353c80639051a24cb8adf6248ebd6666eda196cf780a3", 0x89) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000003c0), r1) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r2, &(0x7f0000000380)={&(0x7f0000000280), 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x3c, r3, 0x9, 0x0, 0x0, {}, [@NLBL_UNLABEL_A_SECCTX={0x28, 0x7, 'system_u:object_r:syslogd_exec_t:s0\x00'}]}, 0x3c}}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000300), r2) sendmsg$IEEE802154_ASSOCIATE_RESP(r4, &(0x7f00000004c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000480)={&(0x7f0000000500)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="08002bbd7000fddbdf251300000006000800a2aa00000500172dd008099cb10300030000000c0009000202aaaaaaaaaaaa0c0009000203aaaaaaaaaaaa050003000200000006000800a3aa00000c0009000000000000000000"], 0x58}, 0x1, 0x0, 0x0, 0x4000010}, 0x4000) sendmsg$NLBL_UNLABEL_C_STATICLIST(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000), 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="44da9800", @ANYRES16=r3, @ANYBLOB="00042cbd7000fedbdf250500000005000100010000002600070073797374656d5f753a6f626a6563745f723a756465765f72756c65735f743a7330000000"], 0x44}}, 0x14000000) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000080)="00000000000a0000000094ac2d4b916e76d5b53b8e0d3a43e5000000540a97de6240ccce2946f2cf18e6b8914ae2991529e014d94e0b2b670f03251b79214bcb1012c28179f62968dafab4408ceaa29fff3a86988de6004a13b3f41e505590b3fa75a38ff1e73d07b690dc4c0efbcb644c679353c80639051a24cb8adf6248ebd6666eda196cf780a3", 0x89) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000003c0), r1) (async) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r2, &(0x7f0000000380)={&(0x7f0000000280), 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x3c, r3, 0x9, 0x0, 0x0, {}, [@NLBL_UNLABEL_A_SECCTX={0x28, 0x7, 'system_u:object_r:syslogd_exec_t:s0\x00'}]}, 0x3c}}, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000300), r2) (async) sendmsg$IEEE802154_ASSOCIATE_RESP(r4, &(0x7f00000004c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000480)={&(0x7f0000000500)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="08002bbd7000fddbdf251300000006000800a2aa00000500172dd008099cb10300030000000c0009000202aaaaaaaaaaaa0c0009000203aaaaaaaaaaaa050003000200000006000800a3aa00000c0009000000000000000000"], 0x58}, 0x1, 0x0, 0x0, 0x4000010}, 0x4000) (async) sendmsg$NLBL_UNLABEL_C_STATICLIST(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000), 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="44da9800", @ANYRES16=r3, @ANYBLOB="00042cbd7000fedbdf250500000005000100010000002600070073797374656d5f753a6f626a6563745f723a756465765f72756c65735f743a7330000000"], 0x44}}, 0x14000000) (async) 15:29:40 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x0) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) write$qrtrtun(r1, &(0x7f0000000080)="c1a29550", 0x4) 15:29:40 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d96178", 0x1e) write$qrtrtun(r0, &(0x7f0000000000)="de", 0x1) 15:29:40 executing program 1: setsockopt$MRT_ADD_VIF(0xffffffffffffffff, 0x0, 0xca, &(0x7f0000000080)={0x0, 0x1, 0x4, 0x4, @vifc_lcl_addr=@remote, @loopback}, 0x10) ioctl$SIOCGETMIFCNT_IN6(0xffffffffffffffff, 0x89e0, &(0x7f0000000380)={0xffffffffffffffff}) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x2, 0x0) socketpair(0x21, 0x4, 0x7, &(0x7f00000002c0)={0xffffffffffffffff}) ioctl$SIOCGETSGCNT_IN6(r2, 0x89e1, &(0x7f0000000340)={@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x3b}}, @remote}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x74, 0x0, &(0x7f00000001c0)=[@request_death={0x400c630e, 0x1}, @reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000100)=ANY=[@ANYBLOB="0e005a4c0000000000000000000000852a62770b01000005ee2cf7000000000000000000000000852a62730b1100"/72], &(0x7f0000000180)={0x0, 0x18, 0x30}}}, @dead_binder_done, @decrefs={0x40046307, 0x3}, @register_looper], 0x2c, 0x0, &(0x7f0000000240)="10b7b05f025ae43309bf6771ac42ca63476188bd03fac894343905119e8f65714fc013c496c33bd93196d158"}) 15:29:40 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)="de", 0x1) 15:29:40 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async, rerun: 32) write$qrtrtun(r1, &(0x7f0000000080)="c1a29550", 0x4) (rerun: 32) 15:29:40 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x7ff, 0x8, 0xffffffff, 0xa, r0, 0x8, '\x00', 0x0, r1, 0x3, 0x4, 0x1}, 0x48) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x7ff, 0x8, 0xffffffff, 0xa, r0, 0x8, '\x00', 0x0, r1, 0x3, 0x4, 0x1}, 0x48) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) (async) ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0) (async) 15:29:40 executing program 1: setsockopt$MRT_ADD_VIF(0xffffffffffffffff, 0x0, 0xca, &(0x7f0000000080)={0x0, 0x1, 0x4, 0x4, @vifc_lcl_addr=@remote, @loopback}, 0x10) (async) ioctl$SIOCGETMIFCNT_IN6(0xffffffffffffffff, 0x89e0, &(0x7f0000000380)={0xffffffffffffffff}) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x2, 0x0) (async) socketpair(0x21, 0x4, 0x7, &(0x7f00000002c0)={0xffffffffffffffff}) ioctl$SIOCGETSGCNT_IN6(r2, 0x89e1, &(0x7f0000000340)={@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x3b}}, @remote}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x74, 0x0, &(0x7f00000001c0)=[@request_death={0x400c630e, 0x1}, @reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000100)=ANY=[@ANYBLOB="0e005a4c0000000000000000000000852a62770b01000005ee2cf7000000000000000000000000852a62730b1100"/72], &(0x7f0000000180)={0x0, 0x18, 0x30}}}, @dead_binder_done, @decrefs={0x40046307, 0x3}, @register_looper], 0x2c, 0x0, &(0x7f0000000240)="10b7b05f025ae43309bf6771ac42ca63476188bd03fac894343905119e8f65714fc013c496c33bd93196d158"}) 15:29:40 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)="de", 0x1) 15:29:40 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x0) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000140), 0xffffb, 0x301400) fcntl$getownex(r0, 0x10, &(0x7f0000000000)) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) read$qrtrtun(r0, &(0x7f0000000080)=""/133, 0x85) 15:29:40 executing program 1: setsockopt$MRT_ADD_VIF(0xffffffffffffffff, 0x0, 0xca, &(0x7f0000000080)={0x0, 0x1, 0x4, 0x4, @vifc_lcl_addr=@remote, @loopback}, 0x10) ioctl$SIOCGETMIFCNT_IN6(0xffffffffffffffff, 0x89e0, &(0x7f0000000380)={0xffffffffffffffff}) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x2, 0x0) socketpair(0x21, 0x4, 0x7, &(0x7f00000002c0)={0xffffffffffffffff}) ioctl$SIOCGETSGCNT_IN6(r2, 0x89e1, &(0x7f0000000340)={@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x3b}}, @remote}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x74, 0x0, &(0x7f00000001c0)=[@request_death={0x400c630e, 0x1}, @reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000100)=ANY=[@ANYBLOB="0e005a4c0000000000000000000000852a62770b01000005ee2cf7000000000000000000000000852a62730b1100"/72], &(0x7f0000000180)={0x0, 0x18, 0x30}}}, @dead_binder_done, @decrefs={0x40046307, 0x3}, @register_looper], 0x2c, 0x0, &(0x7f0000000240)="10b7b05f025ae43309bf6771ac42ca63476188bd03fac894343905119e8f65714fc013c496c33bd93196d158"}) setsockopt$MRT_ADD_VIF(0xffffffffffffffff, 0x0, 0xca, &(0x7f0000000080)={0x0, 0x1, 0x4, 0x4, @vifc_lcl_addr=@remote, @loopback}, 0x10) (async) ioctl$SIOCGETMIFCNT_IN6(0xffffffffffffffff, 0x89e0, &(0x7f0000000380)={0xffffffffffffffff}) (async) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x2, 0x0) (async) socketpair(0x21, 0x4, 0x7, &(0x7f00000002c0)) (async) ioctl$SIOCGETSGCNT_IN6(r2, 0x89e1, &(0x7f0000000340)={@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x3b}}, @remote}) (async) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x74, 0x0, &(0x7f00000001c0)=[@request_death={0x400c630e, 0x1}, @reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000100)=ANY=[@ANYBLOB="0e005a4c0000000000000000000000852a62770b01000005ee2cf7000000000000000000000000852a62730b1100"/72], &(0x7f0000000180)={0x0, 0x18, 0x30}}}, @dead_binder_done, @decrefs={0x40046307, 0x3}, @register_looper], 0x2c, 0x0, &(0x7f0000000240)="10b7b05f025ae43309bf6771ac42ca63476188bd03fac894343905119e8f65714fc013c496c33bd93196d158"}) (async) 15:29:40 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) write$qrtrtun(r1, &(0x7f0000000080)="c1a29550", 0x4) 15:29:40 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xd9, 0x129841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) read$qrtrtun(r0, &(0x7f0000000340)=""/4096, 0x1000) setsockopt$MRT_FLUSH(r0, 0x0, 0xd4, &(0x7f0000000080)=0x7, 0x4) 15:29:40 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) ioctl$SIOCGETSGCNT_IN6(r2, 0x89e1, &(0x7f0000000180)={@remote, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r3, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), r3) r4 = getpid() kcmp$KCMP_EPOLL_TFD(0x0, r4, 0x7, 0xffffffffffffffff, 0x0) r5 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000001c0)={r2, 0x0, 0x25, 0xc}, 0x10) kcmp$KCMP_EPOLL_TFD(r4, 0x0, 0x7, r5, &(0x7f0000000200)={r2, r1, 0x40}) sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000000140)={&(0x7f0000000080), 0xc, &(0x7f0000000100)={&(0x7f0000000440)=ANY=[@ANYBLOB="2400fe0000000000000000e96b91c4d079a7c0f3dd56abac3e65f5fb2b1c63c442ae68a76632670be408a48c666c4ae6fa650124c8cba2ff265ebb7273df0a8aa9c8f51735bb816ae7a72de3d440734b62d9e028151e64d013b20b0a81cee52f0fe8e21175c61803b859697ead11dba606878985c0014000398294ae82348d2d0066f6fbb7244714e915e48290bb905a3152dd8e1a16896ec6a7c8e3d91c7dffec563d62d50b00008d3b53e083ce5b872eb1fded4c52bb81448e786e1f4ae015daa397d42086a0e98b7d4a62877ba42d03bf8e7ff4a16dd369c3b7877bf20e0000000000000000020000000000000000000000cfd6c6e9a57c8801c13aa94226d1f8334a", @ANYRES16=0x0, @ANYBLOB="100c29bd7000ffdbdf250700000005000600ff00000008000c0002000000"], 0x24}, 0x1, 0x0, 0x0, 0x40804}, 0x0) 15:29:40 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000140), 0xffffb, 0x301400) fcntl$getownex(r0, 0x10, &(0x7f0000000000)) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) read$qrtrtun(r0, &(0x7f0000000080)=""/133, 0x85) syz_open_dev$vcsa(&(0x7f0000000140), 0xffffb, 0x301400) (async) fcntl$getownex(r0, 0x10, &(0x7f0000000000)) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) read$qrtrtun(r0, &(0x7f0000000080)=""/133, 0x85) (async) 15:29:40 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)="de", 0x1) 15:29:40 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(r1, 0x40046210, &(0x7f00000000c0)) r2 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_MCAST_REPLICAST(r2, 0x10f, 0x86) accept4$tipc(r2, 0x0, &(0x7f0000000140), 0x800) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) r3 = openat$cgroup(r0, &(0x7f0000000080)='syz1\x00', 0x200002, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000100)={r3, 0x1b, 0x0, 0x3, &(0x7f00000000c0)}, 0x20) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:40 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async, rerun: 64) r1 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) (async, rerun: 64) ioctl$SIOCGETSGCNT_IN6(r2, 0x89e1, &(0x7f0000000180)={@remote, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}) (rerun: 64) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r3, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), r3) (async) r4 = getpid() kcmp$KCMP_EPOLL_TFD(0x0, r4, 0x7, 0xffffffffffffffff, 0x0) r5 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000001c0)={r2, 0x0, 0x25, 0xc}, 0x10) kcmp$KCMP_EPOLL_TFD(r4, 0x0, 0x7, r5, &(0x7f0000000200)={r2, r1, 0x40}) (async, rerun: 64) sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000000140)={&(0x7f0000000080), 0xc, &(0x7f0000000100)={&(0x7f0000000440)=ANY=[@ANYBLOB="2400fe0000000000000000e96b91c4d079a7c0f3dd56abac3e65f5fb2b1c63c442ae68a76632670be408a48c666c4ae6fa650124c8cba2ff265ebb7273df0a8aa9c8f51735bb816ae7a72de3d440734b62d9e028151e64d013b20b0a81cee52f0fe8e21175c61803b859697ead11dba606878985c0014000398294ae82348d2d0066f6fbb7244714e915e48290bb905a3152dd8e1a16896ec6a7c8e3d91c7dffec563d62d50b00008d3b53e083ce5b872eb1fded4c52bb81448e786e1f4ae015daa397d42086a0e98b7d4a62877ba42d03bf8e7ff4a16dd369c3b7877bf20e0000000000000000020000000000000000000000cfd6c6e9a57c8801c13aa94226d1f8334a", @ANYRES16=0x0, @ANYBLOB="100c29bd7000ffdbdf250700000005000600ff00000008000c0002000000"], 0x24}, 0x1, 0x0, 0x0, 0x40804}, 0x0) (rerun: 64) 15:29:40 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xd9, 0x129841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) read$qrtrtun(r0, &(0x7f0000000340)=""/4096, 0x1000) setsockopt$MRT_FLUSH(r0, 0x0, 0xd4, &(0x7f0000000080)=0x7, 0x4) syz_open_dev$vcsa(&(0x7f0000000040), 0xd9, 0x129841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) read$qrtrtun(r0, &(0x7f0000000340)=""/4096, 0x1000) (async) setsockopt$MRT_FLUSH(r0, 0x0, 0xd4, &(0x7f0000000080)=0x7, 0x4) (async) 15:29:40 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, 0x0, 0x0) 15:29:40 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000140), 0xffffb, 0x301400) fcntl$getownex(r0, 0x10, &(0x7f0000000000)) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) read$qrtrtun(r0, &(0x7f0000000080)=""/133, 0x85) 15:29:40 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(r1, 0x40046210, &(0x7f00000000c0)) (async) r2 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_MCAST_REPLICAST(r2, 0x10f, 0x86) accept4$tipc(r2, 0x0, &(0x7f0000000140), 0x800) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) r3 = openat$cgroup(r0, &(0x7f0000000080)='syz1\x00', 0x200002, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000100)={r3, 0x1b, 0x0, 0x3, &(0x7f00000000c0)}, 0x20) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:40 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, 0x0, 0x0) 15:29:40 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xd9, 0x129841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) read$qrtrtun(r0, &(0x7f0000000340)=""/4096, 0x1000) setsockopt$MRT_FLUSH(r0, 0x0, 0xd4, &(0x7f0000000080)=0x7, 0x4) syz_open_dev$vcsa(&(0x7f0000000040), 0xd9, 0x129841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) read$qrtrtun(r0, &(0x7f0000000340)=""/4096, 0x1000) (async) setsockopt$MRT_FLUSH(r0, 0x0, 0xd4, &(0x7f0000000080)=0x7, 0x4) (async) 15:29:40 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0x2, 0x109041) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:40 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) (async) ioctl$SIOCGETSGCNT_IN6(r2, 0x89e1, &(0x7f0000000180)={@remote, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}) (async) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r3, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), r3) r4 = getpid() kcmp$KCMP_EPOLL_TFD(0x0, r4, 0x7, 0xffffffffffffffff, 0x0) (async) r5 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000001c0)={r2, 0x0, 0x25, 0xc}, 0x10) kcmp$KCMP_EPOLL_TFD(r4, 0x0, 0x7, r5, &(0x7f0000000200)={r2, r1, 0x40}) sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000000140)={&(0x7f0000000080), 0xc, &(0x7f0000000100)={&(0x7f0000000440)=ANY=[@ANYBLOB="2400fe0000000000000000e96b91c4d079a7c0f3dd56abac3e65f5fb2b1c63c442ae68a76632670be408a48c666c4ae6fa650124c8cba2ff265ebb7273df0a8aa9c8f51735bb816ae7a72de3d440734b62d9e028151e64d013b20b0a81cee52f0fe8e21175c61803b859697ead11dba606878985c0014000398294ae82348d2d0066f6fbb7244714e915e48290bb905a3152dd8e1a16896ec6a7c8e3d91c7dffec563d62d50b00008d3b53e083ce5b872eb1fded4c52bb81448e786e1f4ae015daa397d42086a0e98b7d4a62877ba42d03bf8e7ff4a16dd369c3b7877bf20e0000000000000000020000000000000000000000cfd6c6e9a57c8801c13aa94226d1f8334a", @ANYRES16=0x0, @ANYBLOB="100c29bd7000ffdbdf250700000005000600ff00000008000c0002000000"], 0x24}, 0x1, 0x0, 0x0, 0x40804}, 0x0) 15:29:40 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(r1, 0x40046210, &(0x7f00000000c0)) r2 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_MCAST_REPLICAST(r2, 0x10f, 0x86) accept4$tipc(r2, 0x0, &(0x7f0000000140), 0x800) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) r3 = openat$cgroup(r0, &(0x7f0000000080)='syz1\x00', 0x200002, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000100)={r3, 0x1b, 0x0, 0x3, &(0x7f00000000c0)}, 0x20) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(r1, 0x40046210, &(0x7f00000000c0)) (async) socket$tipc(0x1e, 0x5, 0x0) (async) setsockopt$TIPC_MCAST_REPLICAST(r2, 0x10f, 0x86) (async) accept4$tipc(r2, 0x0, &(0x7f0000000140), 0x800) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) openat$cgroup(r0, &(0x7f0000000080)='syz1\x00', 0x200002, 0x0) (async) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000100)={r3, 0x1b, 0x0, 0x3, &(0x7f00000000c0)}, 0x20) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) 15:29:40 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, 0x0, 0x0) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, 0x0, 0x0) 15:29:40 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r1, 0x233}, 0x1c}}, 0x0) sendmsg$TIPC_CMD_SHOW_STATS(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r1, 0x800, 0x70bd29, 0x25dfdbfe, {}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0xc008084}, 0x4) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:40 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0x2, 0x109041) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:40 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000), 0x0) 15:29:40 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, 0x0, 0x0) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 4: sendmsg$TIPC_CMD_GET_NETID(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x1c, 0x0, 0x502, 0x70bd28, 0x25dfdbfc}, 0x1c}}, 0x40080) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x6ce, 0xa841) sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB='$\x00u&', @ANYRES16=0x0, @ANYBLOB="04002abd7000ffdbdf2504000000080009000100000008000c0003000000"], 0x24}, 0x1, 0x0, 0x0, 0x4000040}, 0x800) socketpair(0x18, 0x80000, 0xffff7d65, &(0x7f0000000380)={0xffffffffffffffff}) setsockopt$TIPC_GROUP_LEAVE(r1, 0x10f, 0x88) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r2, 0x233, 0x70bd27}, 0x1c}}, 0x840) sendmsg$TIPC_CMD_GET_NETID(r0, &(0x7f0000000240)={&(0x7f0000000180), 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r2, 0x4, 0x70bd25, 0x25dfdbff, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4004}, 0x10) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:40 executing program 2: pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) openat$cgroup_freezer_state(r0, &(0x7f00000000c0), 0x2, 0x0) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r1, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r1, &(0x7f0000000000)="de8138", 0x3) 15:29:40 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r1, 0x233}, 0x1c}}, 0x0) (async) sendmsg$TIPC_CMD_SHOW_STATS(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r1, 0x800, 0x70bd29, 0x25dfdbfe, {}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0xc008084}, 0x4) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:40 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0x2, 0x109041) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) syz_open_dev$vcsa(&(0x7f0000000000), 0x2, 0x109041) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) 15:29:40 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, 0x0, 0x0) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 4: sendmsg$TIPC_CMD_GET_NETID(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x1c, 0x0, 0x502, 0x70bd28, 0x25dfdbfc}, 0x1c}}, 0x40080) (async) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x6ce, 0xa841) sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB='$\x00u&', @ANYRES16=0x0, @ANYBLOB="04002abd7000ffdbdf2504000000080009000100000008000c0003000000"], 0x24}, 0x1, 0x0, 0x0, 0x4000040}, 0x800) (async) socketpair(0x18, 0x80000, 0xffff7d65, &(0x7f0000000380)={0xffffffffffffffff}) setsockopt$TIPC_GROUP_LEAVE(r1, 0x10f, 0x88) (async) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r2, 0x233, 0x70bd27}, 0x1c}}, 0x840) sendmsg$TIPC_CMD_GET_NETID(r0, &(0x7f0000000240)={&(0x7f0000000180), 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r2, 0x4, 0x70bd25, 0x25dfdbff, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4004}, 0x10) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:40 executing program 2: pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) openat$cgroup_freezer_state(r0, &(0x7f00000000c0), 0x2, 0x0) (async) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r1, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r1, &(0x7f0000000000)="de8138", 0x3) 15:29:40 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) (async, rerun: 32) r2 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) sendmsg$TIPC_CMD_SHOW_STATS(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r1, 0x233}, 0x1c}}, 0x0) (async, rerun: 64) sendmsg$TIPC_CMD_SHOW_STATS(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r1, 0x800, 0x70bd29, 0x25dfdbfe, {}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0xc008084}, 0x4) (async, rerun: 64) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async, rerun: 32) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (rerun: 32) 15:29:40 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000), 0x0) 15:29:40 executing program 3: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz0\x00', 0x200002, 0x0) openat$cgroup_int(r0, &(0x7f0000000200)='cpuset.mems\x00', 0x2, 0x0) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r1, &(0x7f0000000300)="9f", 0x1) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000180)={0x73622a85, 0x0, 0x3}) accept4$tipc(r1, 0x0, &(0x7f0000000000), 0x80800) read$qrtrtun(r1, &(0x7f0000000080)=""/197, 0xc5) 15:29:40 executing program 4: sendmsg$TIPC_CMD_GET_NETID(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x1c, 0x0, 0x502, 0x70bd28, 0x25dfdbfc}, 0x1c}}, 0x40080) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x6ce, 0xa841) sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB='$\x00u&', @ANYRES16=0x0, @ANYBLOB="04002abd7000ffdbdf2504000000080009000100000008000c0003000000"], 0x24}, 0x1, 0x0, 0x0, 0x4000040}, 0x800) socketpair(0x18, 0x80000, 0xffff7d65, &(0x7f0000000380)={0xffffffffffffffff}) setsockopt$TIPC_GROUP_LEAVE(r1, 0x10f, 0x88) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r2, 0x233, 0x70bd27}, 0x1c}}, 0x840) sendmsg$TIPC_CMD_GET_NETID(r0, &(0x7f0000000240)={&(0x7f0000000180), 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r2, 0x4, 0x70bd25, 0x25dfdbff, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4004}, 0x10) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) sendmsg$TIPC_CMD_GET_NETID(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x1c, 0x0, 0x502, 0x70bd28, 0x25dfdbfc}, 0x1c}}, 0x40080) (async) syz_open_dev$vcsa(&(0x7f0000000040), 0x6ce, 0xa841) (async) sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB='$\x00u&', @ANYRES16=0x0, @ANYBLOB="04002abd7000ffdbdf2504000000080009000100000008000c0003000000"], 0x24}, 0x1, 0x0, 0x0, 0x4000040}, 0x800) (async) socketpair(0x18, 0x80000, 0xffff7d65, &(0x7f0000000380)) (async) setsockopt$TIPC_GROUP_LEAVE(r1, 0x10f, 0x88) (async) syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$TIPC_CMD_SHOW_STATS(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r2, 0x233, 0x70bd27}, 0x1c}}, 0x840) (async) sendmsg$TIPC_CMD_GET_NETID(r0, &(0x7f0000000240)={&(0x7f0000000180), 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r2, 0x4, 0x70bd25, 0x25dfdbff, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4004}, 0x10) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) 15:29:40 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300), 0x0) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 2: pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) openat$cgroup_freezer_state(r0, &(0x7f00000000c0), 0x2, 0x0) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r1, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r1, &(0x7f0000000000)="de8138", 0x3) pipe2$watch_queue(&(0x7f0000000080), 0x80) (async) openat$cgroup_freezer_state(r0, &(0x7f00000000c0), 0x2, 0x0) (async) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r1, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r1, &(0x7f0000000000)="de8138", 0x3) (async) 15:29:40 executing program 3: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz0\x00', 0x200002, 0x0) openat$cgroup_int(r0, &(0x7f0000000200)='cpuset.mems\x00', 0x2, 0x0) (async) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r1, &(0x7f0000000300)="9f", 0x1) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000180)={0x73622a85, 0x0, 0x3}) (async) accept4$tipc(r1, 0x0, &(0x7f0000000000), 0x80800) (async) read$qrtrtun(r1, &(0x7f0000000080)=""/197, 0xc5) 15:29:40 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000), 0x0) 15:29:40 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300), 0x0) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b672400767a0c4f3380803bf481e5702d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:40 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) r1 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x200000a, 0x20010, r0, 0x8000000) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) syz_io_uring_submit(r1, 0x0, &(0x7f0000000100)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)={r2, r3+10000000}, 0x1, 0x1}, 0x9f5e) 15:29:40 executing program 3: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz0\x00', 0x200002, 0x0) openat$cgroup_int(r0, &(0x7f0000000200)='cpuset.mems\x00', 0x2, 0x0) (async) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r1, &(0x7f0000000300)="9f", 0x1) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000180)={0x73622a85, 0x0, 0x3}) accept4$tipc(r1, 0x0, &(0x7f0000000000), 0x80800) read$qrtrtun(r1, &(0x7f0000000080)=""/197, 0xc5) 15:29:40 executing program 1: sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x34, 0x0, 0x200, 0x70bd2c, 0x25dfdbfb, {}, [@L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @dev={0xfe, 0x80, '\x00', 0x3d}}]}, 0x34}, 0x1, 0x0, 0x0, 0x840}, 0x4000) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup(r0, &(0x7f0000000200)='syz1\x00', 0x200002, 0x0) fcntl$getownex(r1, 0x10, &(0x7f00000002c0)) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="010000000000000000008200000008000300", @ANYRES32=0x0, @ANYBLOB="a6bc4c4d2cea7c667ff80532d6cbc52b69171824c94e1e8543db32aa267b79ff72e904a28534d4a61b88894c2d5b093e83baf0945aa8b49a6989f6e86d7481f1ea57002253f7d8f9c1a89cb53dee4ebfaefd1c5d16395f50c1128d26b08693f63de41f2c933e4262dc43996aa2d08c333ebadf480d40981e5ea67d26bd78c8ab27fce6b07ca96f8fa14cf06870ad865f3c57261919808b17bedaf5d70d389bbcb285b280df4a99f8e9807873b1ec6bbe085273d1a0f24159c5756c2cfd9c2ffc285684d6d6"], 0x1c}}, 0x0) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r4, 0x10000000) epoll_pwait(r4, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x8, 0x4, &(0x7f00000005c0)={[0x6]}, 0x8) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB="14000000", @ANYRES16=r3, @ANYBLOB="010069bd7000df2592365d00"], 0x14}, 0x1, 0x0, 0x0, 0x2001c000}, 0x20040000) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) syz_open_dev$vcsa(&(0x7f00000000c0), 0x8, 0x10100) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r0, 0x5760, 0x5) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) fcntl$getownex(r0, 0x10, &(0x7f0000000080)) 15:29:40 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b672400767a0c4f3380803bf481e5702d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:40 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de5038", 0x3) 15:29:40 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000000100)={0x80000001}) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) write$qrtrtun(r2, &(0x7f0000000080)="e51d982b04c32975c5adb301a58961f31a86816b264b63c2266f28d0d608f8f4019c092b8a85cec152b092aacaf47c84033acc032c12d8f3a4bd2bdfada90f455f57eaf9fe84765bb020ddba87d9b0c5b5a3ae18ee61110f1847966cc981f91e", 0x60) 15:29:40 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async, rerun: 32) r1 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x200000a, 0x20010, r0, 0x8000000) (async, rerun: 32) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) syz_io_uring_submit(r1, 0x0, &(0x7f0000000100)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)={r2, r3+10000000}, 0x1, 0x1}, 0x9f5e) 15:29:40 executing program 1: sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x34, 0x0, 0x200, 0x70bd2c, 0x25dfdbfb, {}, [@L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @dev={0xfe, 0x80, '\x00', 0x3d}}]}, 0x34}, 0x1, 0x0, 0x0, 0x840}, 0x4000) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup(r0, &(0x7f0000000200)='syz1\x00', 0x200002, 0x0) fcntl$getownex(r1, 0x10, &(0x7f00000002c0)) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="010000000000000000008200000008000300", @ANYRES32=0x0, @ANYBLOB="a6bc4c4d2cea7c667ff80532d6cbc52b69171824c94e1e8543db32aa267b79ff72e904a28534d4a61b88894c2d5b093e83baf0945aa8b49a6989f6e86d7481f1ea57002253f7d8f9c1a89cb53dee4ebfaefd1c5d16395f50c1128d26b08693f63de41f2c933e4262dc43996aa2d08c333ebadf480d40981e5ea67d26bd78c8ab27fce6b07ca96f8fa14cf06870ad865f3c57261919808b17bedaf5d70d389bbcb285b280df4a99f8e9807873b1ec6bbe085273d1a0f24159c5756c2cfd9c2ffc285684d6d6"], 0x1c}}, 0x0) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r4, 0x10000000) epoll_pwait(r4, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x8, 0x4, &(0x7f00000005c0)={[0x6]}, 0x8) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB="14000000", @ANYRES16=r3, @ANYBLOB="010069bd7000df2592365d00"], 0x14}, 0x1, 0x0, 0x0, 0x2001c000}, 0x20040000) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) syz_open_dev$vcsa(&(0x7f00000000c0), 0x8, 0x10100) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r0, 0x5760, 0x5) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) fcntl$getownex(r0, 0x10, &(0x7f0000000080)) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x34, 0x0, 0x200, 0x70bd2c, 0x25dfdbfb, {}, [@L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @dev={0xfe, 0x80, '\x00', 0x3d}}]}, 0x34}, 0x1, 0x0, 0x0, 0x840}, 0x4000) (async) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) openat$cgroup(r0, &(0x7f0000000200)='syz1\x00', 0x200002, 0x0) (async) fcntl$getownex(r1, 0x10, &(0x7f00000002c0)) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) (async) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="010000000000000000008200000008000300", @ANYRES32=0x0, @ANYBLOB="a6bc4c4d2cea7c667ff80532d6cbc52b69171824c94e1e8543db32aa267b79ff72e904a28534d4a61b88894c2d5b093e83baf0945aa8b49a6989f6e86d7481f1ea57002253f7d8f9c1a89cb53dee4ebfaefd1c5d16395f50c1128d26b08693f63de41f2c933e4262dc43996aa2d08c333ebadf480d40981e5ea67d26bd78c8ab27fce6b07ca96f8fa14cf06870ad865f3c57261919808b17bedaf5d70d389bbcb285b280df4a99f8e9807873b1ec6bbe085273d1a0f24159c5756c2cfd9c2ffc285684d6d6"], 0x1c}}, 0x0) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r4, 0x10000000) (async) epoll_pwait(r4, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x8, 0x4, &(0x7f00000005c0)={[0x6]}, 0x8) (async) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB="14000000", @ANYRES16=r3, @ANYBLOB="010069bd7000df2592365d00"], 0x14}, 0x1, 0x0, 0x0, 0x2001c000}, 0x20040000) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) syz_open_dev$vcsa(&(0x7f00000000c0), 0x8, 0x10100) (async) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r0, 0x5760, 0x5) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) fcntl$getownex(r0, 0x10, &(0x7f0000000080)) (async) 15:29:40 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300), 0x0) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b672400767a0c4f3380803bf481e5702d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b672400767a0c4f3380803bf481e5702d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) 15:29:40 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async, rerun: 64) r1 = epoll_create1(0x0) (rerun: 64) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000000100)={0x80000001}) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) write$qrtrtun(r2, &(0x7f0000000080)="e51d982b04c32975c5adb301a58961f31a86816b264b63c2266f28d0d608f8f4019c092b8a85cec152b092aacaf47c84033acc032c12d8f3a4bd2bdfada90f455f57eaf9fe84765bb020ddba87d9b0c5b5a3ae18ee61110f1847966cc981f91e", 0x60) 15:29:40 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) r1 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x200000a, 0x20010, r0, 0x8000000) (async) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) syz_io_uring_submit(r1, 0x0, &(0x7f0000000100)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)={r2, r3+10000000}, 0x1, 0x1}, 0x9f5e) 15:29:40 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767", 0x10) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x10000) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, r0, &(0x7f00000000c0)) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) bind$tipc(r0, &(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x1, {0x42, 0x0, 0xfffffffd}}, 0x10) 15:29:40 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000000100)={0x80000001}) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) write$qrtrtun(r2, &(0x7f0000000080)="e51d982b04c32975c5adb301a58961f31a86816b264b63c2266f28d0d608f8f4019c092b8a85cec152b092aacaf47c84033acc032c12d8f3a4bd2bdfada90f455f57eaf9fe84765bb020ddba87d9b0c5b5a3ae18ee61110f1847966cc981f91e", 0x60) 15:29:40 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 1: sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x34, 0x0, 0x200, 0x70bd2c, 0x25dfdbfb, {}, [@L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @dev={0xfe, 0x80, '\x00', 0x3d}}]}, 0x34}, 0x1, 0x0, 0x0, 0x840}, 0x4000) (async) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup(r0, &(0x7f0000000200)='syz1\x00', 0x200002, 0x0) fcntl$getownex(r1, 0x10, &(0x7f00000002c0)) (async, rerun: 32) r2 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="010000000000000000008200000008000300", @ANYRES32=0x0, @ANYBLOB="a6bc4c4d2cea7c667ff80532d6cbc52b69171824c94e1e8543db32aa267b79ff72e904a28534d4a61b88894c2d5b093e83baf0945aa8b49a6989f6e86d7481f1ea57002253f7d8f9c1a89cb53dee4ebfaefd1c5d16395f50c1128d26b08693f63de41f2c933e4262dc43996aa2d08c333ebadf480d40981e5ea67d26bd78c8ab27fce6b07ca96f8fa14cf06870ad865f3c57261919808b17bedaf5d70d389bbcb285b280df4a99f8e9807873b1ec6bbe085273d1a0f24159c5756c2cfd9c2ffc285684d6d6"], 0x1c}}, 0x0) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r4, 0x10000000) (async) epoll_pwait(r4, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x8, 0x4, &(0x7f00000005c0)={[0x6]}, 0x8) (async, rerun: 32) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB="14000000", @ANYRES16=r3, @ANYBLOB="010069bd7000df2592365d00"], 0x14}, 0x1, 0x0, 0x0, 0x2001c000}, 0x20040000) (rerun: 32) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) syz_open_dev$vcsa(&(0x7f00000000c0), 0x8, 0x10100) (async, rerun: 32) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r0, 0x5760, 0x5) (rerun: 32) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) fcntl$getownex(r0, 0x10, &(0x7f0000000080)) 15:29:40 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NODE_ADDR(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, 0x0, 0x400, 0x70bd2b, 0x25dfdbfe, {{}, {}, {0x8, 0x11, 0x6}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x50}, 0x40088c1) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:40 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767", 0x10) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x10000) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, r0, &(0x7f00000000c0)) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) bind$tipc(r0, &(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x1, {0x42, 0x0, 0xfffffffd}}, 0x10) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x10000) (async) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, r0, &(0x7f00000000c0)) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) bind$tipc(r0, &(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x1, {0x42, 0x0, 0xfffffffd}}, 0x10) (async) 15:29:40 executing program 5: write$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) r2 = openat$cgroup_int(r0, &(0x7f00000000c0)='cpu.weight.nice\x00', 0x2, 0x0) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r2) getsockname$l2tp(r1, &(0x7f0000000000)={0x2, 0x0, @initdev}, &(0x7f0000000080)=0x10) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:40 executing program 5: write$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767", 0x10) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NODE_ADDR(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, 0x0, 0x400, 0x70bd2b, 0x25dfdbfe, {{}, {}, {0x8, 0x11, 0x6}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x50}, 0x40088c1) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:40 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x10000) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, r0, &(0x7f00000000c0)) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) bind$tipc(r0, &(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x1, {0x42, 0x0, 0xfffffffd}}, 0x10) 15:29:40 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) r2 = openat$cgroup_int(r0, &(0x7f00000000c0)='cpu.weight.nice\x00', 0x2, 0x0) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r2) (async) getsockname$l2tp(r1, &(0x7f0000000000)={0x2, 0x0, @initdev}, &(0x7f0000000080)=0x10) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:40 executing program 5: write$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) pipe2$watch_queue(&(0x7f0000000000), 0x80) write$qrtrtun(r1, &(0x7f00000000c0)="83f29123aa520987cb95abc4caf94cd50a78cd751728f23588b171faf324ed5687acf25ad20e79fdf7a4ac8d7ddb775270159c8667c01a5a5a52903905263ceae4f273ee59eea648beac1eb633c3ee382362cd41", 0x54) write$qrtrtun(r0, &(0x7f0000000080)="de8138", 0x3) 15:29:40 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NODE_ADDR(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, 0x0, 0x400, 0x70bd2b, 0x25dfdbfe, {{}, {}, {0x8, 0x11, 0x6}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x50}, 0x40088c1) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:40 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf48", 0x18) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) write$qrtrtun(r1, &(0x7f0000000080)="94d70c74237977c3d1147692c6478bae9edde221caf9cc", 0x17) 15:29:40 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) pipe2$watch_queue(&(0x7f0000000000), 0x80) write$qrtrtun(r1, &(0x7f00000000c0)="83f29123aa520987cb95abc4caf94cd50a78cd751728f23588b171faf324ed5687acf25ad20e79fdf7a4ac8d7ddb775270159c8667c01a5a5a52903905263ceae4f273ee59eea648beac1eb633c3ee382362cd41", 0x54) write$qrtrtun(r0, &(0x7f0000000080)="de8138", 0x3) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) pipe2$watch_queue(&(0x7f0000000000), 0x80) (async) write$qrtrtun(r1, &(0x7f00000000c0)="83f29123aa520987cb95abc4caf94cd50a78cd751728f23588b171faf324ed5687acf25ad20e79fdf7a4ac8d7ddb775270159c8667c01a5a5a52903905263ceae4f273ee59eea648beac1eb633c3ee382362cd41", 0x54) (async) write$qrtrtun(r0, &(0x7f0000000080)="de8138", 0x3) (async) 15:29:40 executing program 5: r0 = syz_open_dev$vcsa(0x0, 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) r2 = openat$cgroup_int(r0, &(0x7f00000000c0)='cpu.weight.nice\x00', 0x2, 0x0) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r2) getsockname$l2tp(r1, &(0x7f0000000000)={0x2, 0x0, @initdev}, &(0x7f0000000080)=0x10) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) openat$cgroup_int(r0, &(0x7f00000000c0)='cpu.weight.nice\x00', 0x2, 0x0) (async) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r2) (async) getsockname$l2tp(r1, &(0x7f0000000000)={0x2, 0x0, @initdev}, &(0x7f0000000080)=0x10) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) 15:29:40 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf48", 0x18) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 5: r0 = syz_open_dev$vcsa(0x0, 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf48", 0x18) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) write$qrtrtun(r1, &(0x7f0000000080)="94d70c74237977c3d1147692c6478bae9edde221caf9cc", 0x17) 15:29:40 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) pipe2$watch_queue(&(0x7f0000000000), 0x80) write$qrtrtun(r1, &(0x7f00000000c0)="83f29123aa520987cb95abc4caf94cd50a78cd751728f23588b171faf324ed5687acf25ad20e79fdf7a4ac8d7ddb775270159c8667c01a5a5a52903905263ceae4f273ee59eea648beac1eb633c3ee382362cd41", 0x54) write$qrtrtun(r0, &(0x7f0000000080)="de8138", 0x3) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) pipe2$watch_queue(&(0x7f0000000000), 0x80) (async) write$qrtrtun(r1, &(0x7f00000000c0)="83f29123aa520987cb95abc4caf94cd50a78cd751728f23588b171faf324ed5687acf25ad20e79fdf7a4ac8d7ddb775270159c8667c01a5a5a52903905263ceae4f273ee59eea648beac1eb633c3ee382362cd41", 0x54) (async) write$qrtrtun(r0, &(0x7f0000000080)="de8138", 0x3) (async) 15:29:40 executing program 5: r0 = syz_open_dev$vcsa(0x0, 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 3: pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) fcntl$getownex(r0, 0x10, &(0x7f0000000080)) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r1, 0x54a3) r2 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r2, &(0x7f0000000300)="9f", 0x1) 15:29:40 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffffffffffffff, 0x5aac1) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r1, 0x233}, 0x1c}}, 0x0) sendmsg$TIPC_CMD_GET_BEARER_NAMES(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x80108004}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x1c, r1, 0x1, 0x70bd2b, 0x25dfdbff, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x4081) r3 = syz_open_dev$vcsa(&(0x7f0000000080), 0xffffffff, 0xa0200) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000240)={'tunl0\x00', &(0x7f0000000100)={'sit0\x00', 0x0, 0x1, 0x20, 0x3, 0x1, {{0x42, 0x4, 0x0, 0x2a, 0x108, 0x66, 0x0, 0x1, 0x0, 0x0, @local, @multicast2, {[@timestamp_prespec={0x44, 0x24, 0xb6, 0x3, 0x8, [{@private=0xa010101, 0x8000}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0xffffff69}, {@multicast2, 0x200}, {@multicast1, 0x3}]}, @generic={0x44, 0xb, "29a6184bb66e02c0f5"}, @timestamp_addr={0x44, 0x3c, 0x7d, 0x1, 0x0, [{@initdev={0xac, 0x1e, 0x1, 0x0}}, {@multicast2, 0x6}, {@empty, 0x2}, {@local}, {@multicast1}, {@broadcast, 0x400}, {@remote, 0x40}]}, @cipso={0x86, 0xd, 0x1, [{0x7, 0x7, "73d59b0d66"}]}, @timestamp={0x44, 0x8, 0x18, 0x0, 0x6, [0x9]}, @timestamp_prespec={0x44, 0x14, 0xe4, 0x3, 0x6, [{@loopback, 0x20eda1ff}, {@local, 0x3}]}, @lsrr={0x83, 0xf, 0xe2, [@empty, @loopback, @multicast2]}, @cipso={0x86, 0x4f, 0x0, [{0x6, 0x10, "70641b49e171ad99dbec7305d2aa"}, {0x1, 0xe, "34bd27869a49df048d25fcd5"}, {0x1, 0x10, "2317da26d562cd284d7b928a0cba"}, {0x5, 0xe, "bf4c2e77e732722dd75c1769"}, {0x5, 0xd, "9d2f6a9913011578bf9876"}]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000340)={'syztnl1\x00', &(0x7f0000000280)={'syztnl2\x00', 0x0, 0x7, 0x8000, 0xfca0a70, 0x6, {{0x14, 0x4, 0x1, 0x9, 0x50, 0x66, 0x0, 0x8, 0x2f, 0x0, @broadcast, @empty, {[@cipso={0x86, 0x3c, 0x3, [{0x6, 0xb, "939eeb6302ba371e46"}, {0x6, 0x3, "a2"}, {0x2, 0x4, "de99"}, {0x5, 0x8, "05810710d63a"}, {0x0, 0xc, "16141b0864707565ab02"}, {0x6, 0x2}, {0x7, 0xe, "3b7fcc714f997ebaaf291e43"}]}]}}}}}) sendmsg$nl_xfrm(r3, &(0x7f0000000580)={&(0x7f00000000c0), 0xc, &(0x7f0000000540)={&(0x7f0000000380)=@acquire={0x1a4, 0x17, 0x8, 0x70bd29, 0x25dfdbfc, {{@in6=@loopback, 0x4d3, 0x3c}, @in6=@dev={0xfe, 0x80, '\x00', 0x1a}, {@in=@local, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x4e22, 0x7fff, 0x4e21, 0x1f, 0xa, 0x80, 0x180, 0x1}, {{@in6=@loopback, @in6=@dev={0xfe, 0x80, '\x00', 0x1d}, 0x4e23, 0x8819, 0x4e23, 0x2, 0x2, 0xa0, 0xa0, 0x2f, r4, 0xffffffffffffffff}, {0x5a, 0x6, 0x2, 0x615, 0x2, 0x988, 0x2, 0x1}, {0x4, 0x1ee, 0x10000, 0xc4d5}, 0x8623, 0xbfa, 0x1, 0x1, 0x2, 0x2}, 0x6, 0x80, 0x200, 0x70bd29}, [@address_filter={0x28, 0x1a, {@in6=@ipv4={'\x00', '\xff\xff', @multicast1}, @in6=@empty, 0xa, 0x3, 0x7}}, @XFRMA_IF_ID={0x8, 0x1f, r5}, @offload={0xc, 0x1c, {0x0, 0x1}}, @XFRMA_SET_MARK={0x8, 0x1d, 0xb516}, @replay_val={0x10, 0xa, {0x70bd28, 0x70bd28, 0x5}}, @replay_esn_val={0x20, 0x17, {0x1, 0x70bd2c, 0x70bd29, 0x70bd26, 0x70bd29, 0xce2, [0x8]}}, @etimer_thresh={0x8, 0xc, 0x80000000}]}, 0x1a4}, 0x1, 0x0, 0x0, 0x44810}, 0x4000800) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:40 executing program 3: pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) fcntl$getownex(r0, 0x10, &(0x7f0000000080)) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r1, 0x54a3) (async) r2 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r2, &(0x7f0000000300)="9f", 0x1) 15:29:40 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffffffffffffff, 0x5aac1) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r1, 0x233}, 0x1c}}, 0x0) sendmsg$TIPC_CMD_GET_BEARER_NAMES(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x80108004}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x1c, r1, 0x1, 0x70bd2b, 0x25dfdbff, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x4081) (async) r3 = syz_open_dev$vcsa(&(0x7f0000000080), 0xffffffff, 0xa0200) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000240)={'tunl0\x00', &(0x7f0000000100)={'sit0\x00', 0x0, 0x1, 0x20, 0x3, 0x1, {{0x42, 0x4, 0x0, 0x2a, 0x108, 0x66, 0x0, 0x1, 0x0, 0x0, @local, @multicast2, {[@timestamp_prespec={0x44, 0x24, 0xb6, 0x3, 0x8, [{@private=0xa010101, 0x8000}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0xffffff69}, {@multicast2, 0x200}, {@multicast1, 0x3}]}, @generic={0x44, 0xb, "29a6184bb66e02c0f5"}, @timestamp_addr={0x44, 0x3c, 0x7d, 0x1, 0x0, [{@initdev={0xac, 0x1e, 0x1, 0x0}}, {@multicast2, 0x6}, {@empty, 0x2}, {@local}, {@multicast1}, {@broadcast, 0x400}, {@remote, 0x40}]}, @cipso={0x86, 0xd, 0x1, [{0x7, 0x7, "73d59b0d66"}]}, @timestamp={0x44, 0x8, 0x18, 0x0, 0x6, [0x9]}, @timestamp_prespec={0x44, 0x14, 0xe4, 0x3, 0x6, [{@loopback, 0x20eda1ff}, {@local, 0x3}]}, @lsrr={0x83, 0xf, 0xe2, [@empty, @loopback, @multicast2]}, @cipso={0x86, 0x4f, 0x0, [{0x6, 0x10, "70641b49e171ad99dbec7305d2aa"}, {0x1, 0xe, "34bd27869a49df048d25fcd5"}, {0x1, 0x10, "2317da26d562cd284d7b928a0cba"}, {0x5, 0xe, "bf4c2e77e732722dd75c1769"}, {0x5, 0xd, "9d2f6a9913011578bf9876"}]}]}}}}}) (async, rerun: 64) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000340)={'syztnl1\x00', &(0x7f0000000280)={'syztnl2\x00', 0x0, 0x7, 0x8000, 0xfca0a70, 0x6, {{0x14, 0x4, 0x1, 0x9, 0x50, 0x66, 0x0, 0x8, 0x2f, 0x0, @broadcast, @empty, {[@cipso={0x86, 0x3c, 0x3, [{0x6, 0xb, "939eeb6302ba371e46"}, {0x6, 0x3, "a2"}, {0x2, 0x4, "de99"}, {0x5, 0x8, "05810710d63a"}, {0x0, 0xc, "16141b0864707565ab02"}, {0x6, 0x2}, {0x7, 0xe, "3b7fcc714f997ebaaf291e43"}]}]}}}}}) (rerun: 64) sendmsg$nl_xfrm(r3, &(0x7f0000000580)={&(0x7f00000000c0), 0xc, &(0x7f0000000540)={&(0x7f0000000380)=@acquire={0x1a4, 0x17, 0x8, 0x70bd29, 0x25dfdbfc, {{@in6=@loopback, 0x4d3, 0x3c}, @in6=@dev={0xfe, 0x80, '\x00', 0x1a}, {@in=@local, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x4e22, 0x7fff, 0x4e21, 0x1f, 0xa, 0x80, 0x180, 0x1}, {{@in6=@loopback, @in6=@dev={0xfe, 0x80, '\x00', 0x1d}, 0x4e23, 0x8819, 0x4e23, 0x2, 0x2, 0xa0, 0xa0, 0x2f, r4, 0xffffffffffffffff}, {0x5a, 0x6, 0x2, 0x615, 0x2, 0x988, 0x2, 0x1}, {0x4, 0x1ee, 0x10000, 0xc4d5}, 0x8623, 0xbfa, 0x1, 0x1, 0x2, 0x2}, 0x6, 0x80, 0x200, 0x70bd29}, [@address_filter={0x28, 0x1a, {@in6=@ipv4={'\x00', '\xff\xff', @multicast1}, @in6=@empty, 0xa, 0x3, 0x7}}, @XFRMA_IF_ID={0x8, 0x1f, r5}, @offload={0xc, 0x1c, {0x0, 0x1}}, @XFRMA_SET_MARK={0x8, 0x1d, 0xb516}, @replay_val={0x10, 0xa, {0x70bd28, 0x70bd28, 0x5}}, @replay_esn_val={0x20, 0x17, {0x1, 0x70bd2c, 0x70bd29, 0x70bd26, 0x70bd29, 0xce2, [0x8]}}, @etimer_thresh={0x8, 0xc, 0x80000000}]}, 0x1a4}, 0x1, 0x0, 0x0, 0x44810}, 0x4000800) (async, rerun: 64) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (rerun: 64) 15:29:40 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) write$qrtrtun(r1, &(0x7f0000000080)="94d70c74237977c3d1147692c6478bae9edde221caf9cc", 0x17) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) write$qrtrtun(r1, &(0x7f0000000080)="94d70c74237977c3d1147692c6478bae9edde221caf9cc", 0x17) (async) 15:29:40 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f0000000080)={{0x9}, 'port1\x00', 0x30, 0x99fb33c0cd37ac8b, 0x9, 0x400, 0x6, 0x5a, 0xfffffffb, 0x0, 0x2, 0x75}) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) openat$cgroup_int(r1, &(0x7f0000000140)='memory.oom.group\x00', 0x2, 0x0) ioctl$BINDER_FREEZE(r1, 0x400c620e, &(0x7f00000001c0)={0xffffffffffffffff, 0x1, 0x80000003}) openat$cgroup_pressure(r1, &(0x7f0000000180)='memory.pressure\x00', 0x2, 0x0) 15:29:40 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9", 0x1c) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 3: pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) fcntl$getownex(r0, 0x10, &(0x7f0000000080)) (async) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r1, 0x54a3) (async) r2 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r2, &(0x7f0000000300)="9f", 0x1) 15:29:40 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f0000000080)={{0x9}, 'port1\x00', 0x30, 0x99fb33c0cd37ac8b, 0x9, 0x400, 0x6, 0x5a, 0xfffffffb, 0x0, 0x2, 0x75}) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) openat$cgroup_int(r1, &(0x7f0000000140)='memory.oom.group\x00', 0x2, 0x0) (async) ioctl$BINDER_FREEZE(r1, 0x400c620e, &(0x7f00000001c0)={0xffffffffffffffff, 0x1, 0x80000003}) (async) openat$cgroup_pressure(r1, &(0x7f0000000180)='memory.pressure\x00', 0x2, 0x0) 15:29:40 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r2, &(0x7f0000000440)={&(0x7f0000000240), 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x14, r1, 0x1}, 0x14}}, 0x0) 15:29:40 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffffffffffffff, 0x5aac1) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r1, 0x233}, 0x1c}}, 0x0) sendmsg$TIPC_CMD_GET_BEARER_NAMES(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x80108004}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x1c, r1, 0x1, 0x70bd2b, 0x25dfdbff, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x4081) r3 = syz_open_dev$vcsa(&(0x7f0000000080), 0xffffffff, 0xa0200) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000240)={'tunl0\x00', &(0x7f0000000100)={'sit0\x00', 0x0, 0x1, 0x20, 0x3, 0x1, {{0x42, 0x4, 0x0, 0x2a, 0x108, 0x66, 0x0, 0x1, 0x0, 0x0, @local, @multicast2, {[@timestamp_prespec={0x44, 0x24, 0xb6, 0x3, 0x8, [{@private=0xa010101, 0x8000}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0xffffff69}, {@multicast2, 0x200}, {@multicast1, 0x3}]}, @generic={0x44, 0xb, "29a6184bb66e02c0f5"}, @timestamp_addr={0x44, 0x3c, 0x7d, 0x1, 0x0, [{@initdev={0xac, 0x1e, 0x1, 0x0}}, {@multicast2, 0x6}, {@empty, 0x2}, {@local}, {@multicast1}, {@broadcast, 0x400}, {@remote, 0x40}]}, @cipso={0x86, 0xd, 0x1, [{0x7, 0x7, "73d59b0d66"}]}, @timestamp={0x44, 0x8, 0x18, 0x0, 0x6, [0x9]}, @timestamp_prespec={0x44, 0x14, 0xe4, 0x3, 0x6, [{@loopback, 0x20eda1ff}, {@local, 0x3}]}, @lsrr={0x83, 0xf, 0xe2, [@empty, @loopback, @multicast2]}, @cipso={0x86, 0x4f, 0x0, [{0x6, 0x10, "70641b49e171ad99dbec7305d2aa"}, {0x1, 0xe, "34bd27869a49df048d25fcd5"}, {0x1, 0x10, "2317da26d562cd284d7b928a0cba"}, {0x5, 0xe, "bf4c2e77e732722dd75c1769"}, {0x5, 0xd, "9d2f6a9913011578bf9876"}]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000340)={'syztnl1\x00', &(0x7f0000000280)={'syztnl2\x00', 0x0, 0x7, 0x8000, 0xfca0a70, 0x6, {{0x14, 0x4, 0x1, 0x9, 0x50, 0x66, 0x0, 0x8, 0x2f, 0x0, @broadcast, @empty, {[@cipso={0x86, 0x3c, 0x3, [{0x6, 0xb, "939eeb6302ba371e46"}, {0x6, 0x3, "a2"}, {0x2, 0x4, "de99"}, {0x5, 0x8, "05810710d63a"}, {0x0, 0xc, "16141b0864707565ab02"}, {0x6, 0x2}, {0x7, 0xe, "3b7fcc714f997ebaaf291e43"}]}]}}}}}) sendmsg$nl_xfrm(r3, &(0x7f0000000580)={&(0x7f00000000c0), 0xc, &(0x7f0000000540)={&(0x7f0000000380)=@acquire={0x1a4, 0x17, 0x8, 0x70bd29, 0x25dfdbfc, {{@in6=@loopback, 0x4d3, 0x3c}, @in6=@dev={0xfe, 0x80, '\x00', 0x1a}, {@in=@local, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x4e22, 0x7fff, 0x4e21, 0x1f, 0xa, 0x80, 0x180, 0x1}, {{@in6=@loopback, @in6=@dev={0xfe, 0x80, '\x00', 0x1d}, 0x4e23, 0x8819, 0x4e23, 0x2, 0x2, 0xa0, 0xa0, 0x2f, r4, 0xffffffffffffffff}, {0x5a, 0x6, 0x2, 0x615, 0x2, 0x988, 0x2, 0x1}, {0x4, 0x1ee, 0x10000, 0xc4d5}, 0x8623, 0xbfa, 0x1, 0x1, 0x2, 0x2}, 0x6, 0x80, 0x200, 0x70bd29}, [@address_filter={0x28, 0x1a, {@in6=@ipv4={'\x00', '\xff\xff', @multicast1}, @in6=@empty, 0xa, 0x3, 0x7}}, @XFRMA_IF_ID={0x8, 0x1f, r5}, @offload={0xc, 0x1c, {0x0, 0x1}}, @XFRMA_SET_MARK={0x8, 0x1d, 0xb516}, @replay_val={0x10, 0xa, {0x70bd28, 0x70bd28, 0x5}}, @replay_esn_val={0x20, 0x17, {0x1, 0x70bd2c, 0x70bd29, 0x70bd26, 0x70bd29, 0xce2, [0x8]}}, @etimer_thresh={0x8, 0xc, 0x80000000}]}, 0x1a4}, 0x1, 0x0, 0x0, 0x44810}, 0x4000800) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffffffffffffff, 0x5aac1) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$TIPC_CMD_SHOW_STATS(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r1, 0x233}, 0x1c}}, 0x0) (async) sendmsg$TIPC_CMD_GET_BEARER_NAMES(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x80108004}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x1c, r1, 0x1, 0x70bd2b, 0x25dfdbff, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x4081) (async) syz_open_dev$vcsa(&(0x7f0000000080), 0xffffffff, 0xa0200) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000240)={'tunl0\x00', &(0x7f0000000100)={'sit0\x00', 0x0, 0x1, 0x20, 0x3, 0x1, {{0x42, 0x4, 0x0, 0x2a, 0x108, 0x66, 0x0, 0x1, 0x0, 0x0, @local, @multicast2, {[@timestamp_prespec={0x44, 0x24, 0xb6, 0x3, 0x8, [{@private=0xa010101, 0x8000}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0xffffff69}, {@multicast2, 0x200}, {@multicast1, 0x3}]}, @generic={0x44, 0xb, "29a6184bb66e02c0f5"}, @timestamp_addr={0x44, 0x3c, 0x7d, 0x1, 0x0, [{@initdev={0xac, 0x1e, 0x1, 0x0}}, {@multicast2, 0x6}, {@empty, 0x2}, {@local}, {@multicast1}, {@broadcast, 0x400}, {@remote, 0x40}]}, @cipso={0x86, 0xd, 0x1, [{0x7, 0x7, "73d59b0d66"}]}, @timestamp={0x44, 0x8, 0x18, 0x0, 0x6, [0x9]}, @timestamp_prespec={0x44, 0x14, 0xe4, 0x3, 0x6, [{@loopback, 0x20eda1ff}, {@local, 0x3}]}, @lsrr={0x83, 0xf, 0xe2, [@empty, @loopback, @multicast2]}, @cipso={0x86, 0x4f, 0x0, [{0x6, 0x10, "70641b49e171ad99dbec7305d2aa"}, {0x1, 0xe, "34bd27869a49df048d25fcd5"}, {0x1, 0x10, "2317da26d562cd284d7b928a0cba"}, {0x5, 0xe, "bf4c2e77e732722dd75c1769"}, {0x5, 0xd, "9d2f6a9913011578bf9876"}]}]}}}}}) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000340)={'syztnl1\x00', &(0x7f0000000280)={'syztnl2\x00', 0x0, 0x7, 0x8000, 0xfca0a70, 0x6, {{0x14, 0x4, 0x1, 0x9, 0x50, 0x66, 0x0, 0x8, 0x2f, 0x0, @broadcast, @empty, {[@cipso={0x86, 0x3c, 0x3, [{0x6, 0xb, "939eeb6302ba371e46"}, {0x6, 0x3, "a2"}, {0x2, 0x4, "de99"}, {0x5, 0x8, "05810710d63a"}, {0x0, 0xc, "16141b0864707565ab02"}, {0x6, 0x2}, {0x7, 0xe, "3b7fcc714f997ebaaf291e43"}]}]}}}}}) (async) sendmsg$nl_xfrm(r3, &(0x7f0000000580)={&(0x7f00000000c0), 0xc, &(0x7f0000000540)={&(0x7f0000000380)=@acquire={0x1a4, 0x17, 0x8, 0x70bd29, 0x25dfdbfc, {{@in6=@loopback, 0x4d3, 0x3c}, @in6=@dev={0xfe, 0x80, '\x00', 0x1a}, {@in=@local, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x4e22, 0x7fff, 0x4e21, 0x1f, 0xa, 0x80, 0x180, 0x1}, {{@in6=@loopback, @in6=@dev={0xfe, 0x80, '\x00', 0x1d}, 0x4e23, 0x8819, 0x4e23, 0x2, 0x2, 0xa0, 0xa0, 0x2f, r4, 0xffffffffffffffff}, {0x5a, 0x6, 0x2, 0x615, 0x2, 0x988, 0x2, 0x1}, {0x4, 0x1ee, 0x10000, 0xc4d5}, 0x8623, 0xbfa, 0x1, 0x1, 0x2, 0x2}, 0x6, 0x80, 0x200, 0x70bd29}, [@address_filter={0x28, 0x1a, {@in6=@ipv4={'\x00', '\xff\xff', @multicast1}, @in6=@empty, 0xa, 0x3, 0x7}}, @XFRMA_IF_ID={0x8, 0x1f, r5}, @offload={0xc, 0x1c, {0x0, 0x1}}, @XFRMA_SET_MARK={0x8, 0x1d, 0xb516}, @replay_val={0x10, 0xa, {0x70bd28, 0x70bd28, 0x5}}, @replay_esn_val={0x20, 0x17, {0x1, 0x70bd2c, 0x70bd29, 0x70bd26, 0x70bd29, 0xce2, [0x8]}}, @etimer_thresh={0x8, 0xc, 0x80000000}]}, 0x1a4}, 0x1, 0x0, 0x0, 0x44810}, 0x4000800) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) 15:29:40 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9", 0x1c) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) r1 = syz_open_dev$vcsa(&(0x7f0000000000), 0x43, 0x40000) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) 15:29:40 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async, rerun: 64) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (rerun: 64) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f0000000080)={{0x9}, 'port1\x00', 0x30, 0x99fb33c0cd37ac8b, 0x9, 0x400, 0x6, 0x5a, 0xfffffffb, 0x0, 0x2, 0x75}) (async) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async, rerun: 64) openat$cgroup_int(r1, &(0x7f0000000140)='memory.oom.group\x00', 0x2, 0x0) (async, rerun: 64) ioctl$BINDER_FREEZE(r1, 0x400c620e, &(0x7f00000001c0)={0xffffffffffffffff, 0x1, 0x80000003}) (async) openat$cgroup_pressure(r1, &(0x7f0000000180)='memory.pressure\x00', 0x2, 0x0) 15:29:40 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r2, &(0x7f0000000440)={&(0x7f0000000240), 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x14, r1, 0x1}, 0x14}}, 0x0) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$L2TP_CMD_SESSION_CREATE(r2, &(0x7f0000000440)={&(0x7f0000000240), 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x14, r1, 0x1}, 0x14}}, 0x0) (async) 15:29:40 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9", 0x1c) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000180)="9b4afef285abdee2412783b6723f0767349ba0c4f338481e5782d961784000", 0x32) read$qrtrtun(r0, &(0x7f00000001c0)=""/12, 0xc) r1 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000240), 0x505082) syz_genetlink_get_family_id$tipc(&(0x7f0000000300), r0) sendmsg$TIPC_CMD_SET_LINK_TOL(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000380)={&(0x7f0000000400)=ANY=[], 0x34}, 0x1, 0x0, 0x0, 0x40000}, 0xc000) syz_open_dev$vcsa(&(0x7f0000000000), 0x4, 0x8440) write$qrtrtun(r1, &(0x7f0000000280)="5762effdf475688a6ec88b699537995397133ca4ad3946db47e6b65b2d06c5ba7d03c10927471c5856745ee769b547", 0x2f) read$qrtrtun(r0, &(0x7f0000000200)=""/26, 0x1a) write$qrtrtun(r0, &(0x7f0000000080)="da70a0ba9bf06e5bbfa41528872a259063be6b868de5d932e9e99630da39aec1616e85bbaad2bc5279cdf10519d9285bfc24b7c2ca963461a847dbf507dc883ec7eb939594ef09534a58fe658fac6a33c67fb5c6120e3730c5bf6dc7e4fa86abda5d1ff5f371523afb425370269fca8a357c98ad4631f82dd9c55bc7fd574f0acf5b2159ba5060360449a0179caa2127329388e9304f118dcde26f72d086dfbb12ec299da5e6abfa838ae62a2b4e4fd48f163f14ab0554167b4fe3310d47d45464caf559f47cc56ae27ec7525484b53399a58f913db69a71fbd5f827c8f537", 0xdf) 15:29:40 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d96178", 0x1e) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async, rerun: 64) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) (async, rerun: 64) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r2, &(0x7f0000000440)={&(0x7f0000000240), 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x14, r1, 0x1}, 0x14}}, 0x0) 15:29:40 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async, rerun: 64) r1 = syz_open_dev$vcsa(&(0x7f0000000000), 0x43, 0x40000) (rerun: 64) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) 15:29:40 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) r1 = bpf$OBJ_GET_PROG(0x7, &(0x7f00000000c0)={&(0x7f0000000080)='./file0\x00', 0x0, 0x8}, 0x10) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000100)={r1, 0x0, 0x25, 0x2}, 0x10) write$qrtrtun(r0, &(0x7f0000000000)="4397b4001e4b395eaf69b87f3cb592bead0000", 0x13) 15:29:40 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d96178", 0x1e) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x0) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) r1 = syz_open_dev$vcsa(&(0x7f0000000000), 0x43, 0x40000) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) 15:29:40 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000180)="9b4afef285abdee2412783b6723f0767349ba0c4f338481e5782d961784000", 0x32) (async) read$qrtrtun(r0, &(0x7f00000001c0)=""/12, 0xc) r1 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000240), 0x505082) (async) syz_genetlink_get_family_id$tipc(&(0x7f0000000300), r0) sendmsg$TIPC_CMD_SET_LINK_TOL(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000380)={&(0x7f0000000400)=ANY=[], 0x34}, 0x1, 0x0, 0x0, 0x40000}, 0xc000) (async) syz_open_dev$vcsa(&(0x7f0000000000), 0x4, 0x8440) write$qrtrtun(r1, &(0x7f0000000280)="5762effdf475688a6ec88b699537995397133ca4ad3946db47e6b65b2d06c5ba7d03c10927471c5856745ee769b547", 0x2f) (async) read$qrtrtun(r0, &(0x7f0000000200)=""/26, 0x1a) (async) write$qrtrtun(r0, &(0x7f0000000080)="da70a0ba9bf06e5bbfa41528872a259063be6b868de5d932e9e99630da39aec1616e85bbaad2bc5279cdf10519d9285bfc24b7c2ca963461a847dbf507dc883ec7eb939594ef09534a58fe658fac6a33c67fb5c6120e3730c5bf6dc7e4fa86abda5d1ff5f371523afb425370269fca8a357c98ad4631f82dd9c55bc7fd574f0acf5b2159ba5060360449a0179caa2127329388e9304f118dcde26f72d086dfbb12ec299da5e6abfa838ae62a2b4e4fd48f163f14ab0554167b4fe3310d47d45464caf559f47cc56ae27ec7525484b53399a58f913db69a71fbd5f827c8f537", 0xdf) 15:29:40 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d96178", 0x1e) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) r1 = bpf$OBJ_GET_PROG(0x7, &(0x7f00000000c0)={&(0x7f0000000080)='./file0\x00', 0x0, 0x8}, 0x10) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000100)={r1, 0x0, 0x25, 0x2}, 0x10) (async) write$qrtrtun(r0, &(0x7f0000000000)="4397b4001e4b395eaf69b87f3cb592bead0000", 0x13) 15:29:40 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r0) sendmsg$TIPC_CMD_SET_LINK_TOL(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x68, r1, 0x10, 0x70bd2d, 0x25dfdbff, {{}, {}, {0x4c, 0x18, {0x6, @link='syz0\x00'}}}, ["", "", "", "", "", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x40800}, 0x8000) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) setsockopt$MRT_DEL_VIF(r0, 0x0, 0xcb, &(0x7f0000000000)={0x1, 0x0, 0x1f, 0x3, @vifc_lcl_ifindex, @local}, 0x10) 15:29:40 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x0) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000180)="9b4afef285abdee2412783b6723f0767349ba0c4f338481e5782d961784000", 0x32) (async) read$qrtrtun(r0, &(0x7f00000001c0)=""/12, 0xc) r1 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000240), 0x505082) syz_genetlink_get_family_id$tipc(&(0x7f0000000300), r0) sendmsg$TIPC_CMD_SET_LINK_TOL(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000380)={&(0x7f0000000400)=ANY=[], 0x34}, 0x1, 0x0, 0x0, 0x40000}, 0xc000) (async, rerun: 64) syz_open_dev$vcsa(&(0x7f0000000000), 0x4, 0x8440) (async, rerun: 64) write$qrtrtun(r1, &(0x7f0000000280)="5762effdf475688a6ec88b699537995397133ca4ad3946db47e6b65b2d06c5ba7d03c10927471c5856745ee769b547", 0x2f) (async) read$qrtrtun(r0, &(0x7f0000000200)=""/26, 0x1a) write$qrtrtun(r0, &(0x7f0000000080)="da70a0ba9bf06e5bbfa41528872a259063be6b868de5d932e9e99630da39aec1616e85bbaad2bc5279cdf10519d9285bfc24b7c2ca963461a847dbf507dc883ec7eb939594ef09534a58fe658fac6a33c67fb5c6120e3730c5bf6dc7e4fa86abda5d1ff5f371523afb425370269fca8a357c98ad4631f82dd9c55bc7fd574f0acf5b2159ba5060360449a0179caa2127329388e9304f118dcde26f72d086dfbb12ec299da5e6abfa838ae62a2b4e4fd48f163f14ab0554167b4fe3310d47d45464caf559f47cc56ae27ec7525484b53399a58f913db69a71fbd5f827c8f537", 0xdf) 15:29:40 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x4d) 15:29:40 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x0) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r0) sendmsg$TIPC_CMD_SET_LINK_TOL(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x68, r1, 0x10, 0x70bd2d, 0x25dfdbff, {{}, {}, {0x4c, 0x18, {0x6, @link='syz0\x00'}}}, ["", "", "", "", "", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x40800}, 0x8000) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) setsockopt$MRT_DEL_VIF(r0, 0x0, 0xcb, &(0x7f0000000000)={0x1, 0x0, 0x1f, 0x3, @vifc_lcl_ifindex, @local}, 0x10) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r0) (async) sendmsg$TIPC_CMD_SET_LINK_TOL(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x68, r1, 0x10, 0x70bd2d, 0x25dfdbff, {{}, {}, {0x4c, 0x18, {0x6, @link='syz0\x00'}}}, ["", "", "", "", "", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x40800}, 0x8000) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) setsockopt$MRT_DEL_VIF(r0, 0x0, 0xcb, &(0x7f0000000000)={0x1, 0x0, 0x1f, 0x3, @vifc_lcl_ifindex, @local}, 0x10) (async) 15:29:40 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) r1 = bpf$OBJ_GET_PROG(0x7, &(0x7f00000000c0)={&(0x7f0000000080)='./file0\x00', 0x0, 0x8}, 0x10) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000100)={r1, 0x0, 0x25, 0x2}, 0x10) (async) write$qrtrtun(r0, &(0x7f0000000000)="4397b4001e4b395eaf69b87f3cb592bead0000", 0x13) 15:29:40 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) r2 = openat$cgroup(r0, &(0x7f00000002c0)='syz1\x00', 0x200002, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000014c0)={0x94, 0x0, &(0x7f0000000400)=[@dead_binder_done, @transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x1, &(0x7f0000000080)=""/193, 0xc1, 0x0, 0xe}, @fda={0x66646185, 0x7, 0x0, 0x33}, @ptr={0x70742a85, 0x0, &(0x7f0000000180)=""/68, 0x44, 0x8000000000000000, 0x26}}, &(0x7f0000000280)={0x0, 0x28, 0x48}}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000340)={@fd={0x66642a85, 0x0, r2}, @flat=@weak_handle={0x77682a85, 0x1, 0x3}, @fda={0x66646185, 0x9, 0x1, 0x35}}, &(0x7f00000003c0)={0x0, 0x18, 0x30}}}], 0x1000, 0x0, &(0x7f00000004c0)="55ef2537db424d5ecbe3a7a97545266a12c1bec32fcaf00b9b1470b87f6a3b51b0b5f6da0822f31dd33ef4be119b5b52a7ed20c8596fd4d5d839ca5594cb16bc82f0788d15b3a2c9e3ecf3a92a21fd4370d51aef71bfab66503dc5b9cab11a36a640803b86d94c13844ae7ab647d734f8e406b6bec4f7fd24cfdbb27dfb668ef025c15f9fa8347dc1c4ef59a49050599917cc023c6660ffa9d479df385ca141e9320a23efacb0fe929b5176aaa00cc2de5a9edc7a2bd230f580c8a9de2b5bead6132aab479db455e69e8c2feb6d8b82fde9c8b6874314c6e6204058cb8b306198015183a94d11dc28699d99e95e5f28f72bd1cad9543166b648a0347db1c1f3a5f5b6515ad63403759ffaa9635f5aa2da2f2b98ac7797fec0a21291a268de6cbbb59dd2ef2bbd2c02ffc2cb0fd6b2598597748b86922ac9b6f755c6cf274bdb3cc7bd5bab73ae215c3db7909dcc4fd81ce338e0ad856b6691aa8b35858e180b88502882f69ab868e537ed91b1a94ac988c1003c73896084003430c0ca9f71242f2bea8fa7272ee9da4139524d39d6e206ea71f735325c33a581fa4d48f3261f7ecf4a5753afe3d1c2396f7c9631a53a5e9db7de3171555554279c05540764cdb29e3c00c57acc64fa0111f5588f18141124961ec49f5b5e9442b2a4ebb9aeb927b39ba67e02de1173da1f2f04b1d4c71b25169a515ba66b5bae573de1812be6d7c507b03cbeca73f7fabfe258cd2c5960a3042025afd8c267c0c1129f93e9dd1fed2b14c068900082f819b96011c771e6f9ad4dbdf7729dfd0c0ec03e8b8d79c4813409e67ef5bf9567c1af9f37eac0660e54adc71aad19838395cfb3b6e2f5271f46b6a4c26b4814cc151299d7f4c937a43c6b7f95ab722a2c437598555e55c4e83ea0ce92cb3dc7ff7011da80549b9301287026a4747c7d76e6929efea59f010e7353527f5efa7264bc9cef68c76d1cd06e41634e6648d59e84fc17b7e50fae5691603bc6328da9f292425d2b4c5db1b944ead5cd77f124d5c39fe0cf1e1849e28425b7091d1d23739c57354c0337c0e3b5c81cef0277e5eda9478ba603ce0915490637024a38f6ad14f1ddee540a4166a181dc1effbff4b0a48e1db4a8027c8b5e4bbde9f5cf60e3e0bc701b16d7c6e8a3a267d53f8620c340e534a0735f73387d568acfc39b079aa5e81e8db48495a65c0d6e27e5bbf8359c4f61512b90c61c6faf73fb1e12b97e2cf92f1e69cd2442a7e33e4cc12bfa376db78b6834b07ed5871b873cb1ae61ecf7435c4abee3fd4963b542f95c72351db63f49266b8163505cd3e3c4c5c0ba3507845edec6c27239ff10d8bdd5e094fdaa422b07645fbd356354dc1bb74b80c330369552716dd0ae9314f99c5a32b1dab36cd1ce4f6b899c48fc1204b742326e2800c9b7a12502bbe9b968033cb2af2dc0e54a6b5b81f70b4b1977f0b0c4a1455a3f8930d0525bb0e37a779c67ae5082a2690942bc06a87d7776fca883e9b116b5fd1d25c8c937029a12eb09488a021388cc661ec44e9b528f11b535f6a3503ff2459709779e8499d2cea2212b1f395ec887794a748c59ad5698bc289bedb6b827f50c9dba8c43ca3c855f4ccd85d38a90cc8d08fb89ba4f67684bce4d542413e0ddd942ea1bba1c23351309cabeba70bd25cee9b4837521435a3438a8e1d9f6cd456723f6c19fb7fe13ee80ee59544ff4cb4b41d3fdd1b8f0a3e33405fabcba10341a1fc0ac03f9a0d2ea878de177c448c89be3b846461f5f51a7b4da122231ec8ded2659e27cb20c6f90868124b928f0c70f7f56b233760f3c28b70daf276bcaa04e11c86862555cae67de499663364171e77e407ea8fd212f40ba1a0190e2c4ff9445a06dcfed685d346499b8cf74a6a6cc2b4e02bbbb38411bf8266c0dae7ace1879569532511a9bf0b7bdec90f9878deb9ac770a3cd9009d0fc5a11cc5e50a665cd54c5f2fb2f32b7abd890ae5b3635a9b49027179215ea6f551c2e69b43700d7a3e0b2625de1cf4d7b546e2764f9257e5ca26d542762ae04d694d2595068cbb3736e5a29c13eb17229e4a12776463ea692b4bcedff67621f0c9397d7714913d9a50f0840899c2ee0a46ff0221a719bac5ed03f718b15381fac35ffde7f0795135ad7b58fb9d4924af4370f3fe86125a448b7bd42c995f02466573b59c0bd4fa5d631c8fc2286e7fa0ea7a2acc1ade5b7b27175adc5ba38ca2f29ca69a37cd6c468ec212d4c022acb9aecdbec444fa6bdd3b12a0a08e98a61ebb6cc16e785706e6d5040ce9564905458bac599ce93c52963fb4da07d6a829cb18c5f21fb3910cecbfd2331974817a6389aba946eb759e921d3fd436a622bdb3b9599a75458535b728dc729a1a4f0f3b7ef2e41f2809d2fabf27c04e17fa6f5342ea49e19aa902ee5eb26f726f614df2ff5de2111e7d216380fc8077069eada0e079b594f6b52cc512ef8871a84b6bedc826712683dc62cc52ec947a7e1e7ed2e08840402e85ade866a8a5b94c02831ea6ae0708b94d67ed7de4cd6d30408caf3e611060d3dd8599b1a577530ed747112bfab8b5e8bf89179c40381ecd67a1bfff9546cbcf5b805785e757f5ea894b04800a19ea27c08ca7caf32307c9da9df95bd1f1dc8d23cdd17c62dec06788a00e3107ff507be84efb52f83c6cdd19d476207d231547ee1d6f1dc5da2fd2bd260d657ff95736d208f0f4aa61052b698c1c04a2b9d696e4baf998fa3eaabc7a69064e4651e5e0b148ea975398251f2c0f91a13ecccbcb09906763124dd1f8d605ea310bfae25a7962af6669ef48730d7013941b22c71c84daf6afdf2c326a31196a2aea5f69f8515075c78369a9d04f40bcb0afc2b4969157a0d87811739673f53418c2fe8fd2866b770e3cea1ce42c50ec6bcb440d9575859ed31f80e15848622bf950d875c3bd46b1e57f846dca2fc8114aa872cc462659da072049d2e0bb71e7be02b7eee489216d5b7d0008486b830e647ef10a6478f6392323eec050ee8ae16a4fd078efe868594c508f771f6ace0682e6a30a257545b218e1bb65da5cb9bef04a4a3df4a269458777a235d25e5f18aa0b193024a31896b2067e2228d7233beac267fed002c2f50c389acc42629825730fb4c93ce6981deea33dee6f25729a3efbdbb6071ea0d01c3e1a247a21a21db0242bae7366662281998264caee70fabe3e620e3dbb16f7368316d25528e4d3c4c460a4ee2d0878523a1e84f9df8abeaf94ceebbe698c16c898c7286d06c7381e62a39938d575c92a7daf5a7d311f4f4a4edd628ab6d8059a5397868005e943a4aee5cf2af08258a16df02db9361d9138bccef6a9a9f2abc69c9ac8f15f8d5270fe43e6739272871500364d0bcb892abc6b86ab57cc66731ef1911f01dc9dc9427bb0a355758219fec4a49d4f677bf9013a9b8cc9ae8ce2f351ff88cc7c1bb95437161a9974faef2dde6c8cbe1d63e023c3f640f1b14be289d60e47fdc6d17f0ddb9ff4229ed33e58eaf90255e370c92c72602fb28be1ea152a101a07439b9218611123a4258ebd96f66dece1a02f079da97b62807b565bcce39faecd560a759c7815f8f2f7b4aff1742ed24dbf2e321915a940563618a0ccea603db008712cfd7b609af44fd1f029156abfff73f1f9441945fe139b85db3319c62367ee45b46a6d16f9e765ad88e5c78602b79a70132d0318dd217a664adc0a16c17cf9f3ce40fa7065880149ca24d710313be793a6146f8e166dde0980c4001d1b7a5bb8f5f500781c20dd6a39929ed2e967630897191bf174609c26679882316ecd1878c5a27407e2b2238894023c23e0433e64dabb0c25faa4bae2556c2de7b4f7422bc85e14cd5ab9e7eb6e0678975e3687a73ccfdd538fdc8af7208fe862196c23eaf3b0d07d86a5f83dfacbd18feb77c1028cdd639f05c50d6a1534382b3f4b41b9d912b6daa005981209614a05c786f091f4370477e6fbb5edc0e88c417135e6e4a242cedfe627ee54064409d9cf6322a2b027d83167b8951fed2e4439e4e1a291a11e6fc7b8647abe0675b57d9011d8e804f3cd7b53b4fe5de30bfb99db2a9c6d35d88ea8060b29f3b885fa8e0fa106b8a2620fe62fce15181263ec007e37031fb209b808c7ebe2a833fe735b9b4d99aa0243d26303d3f9e3058c292552ef51a6ac46ffea1b64e3f5c7d489b0eaa5eba9b081706ab18ca5cf4e319d04153fd190d4d9fff2988c1642f856a37bf280816ce833e5c02526205a095f9798983bd450e9b87f80a9045ea3f5e43386b280e71deb2d4c5d463431da314bcb595b68937b56c3f37d387ac0fd97f3a1c4ea5daf22dc9d09f7cb52507b9ce06f92028d586f9ed0d7f89984cef446abe18e9654a6af1115a2fe927109d96a315423e113feb5bb1138fcd68d4652b6e49b311b8410a92e4b99d14734bbd58aea15644ae71b4e857c08c56e4b69ad4e5839cee69b59cf874b81cffe3d23c9c0a3e6373f171232b61ec2a9db7ea0054227cdabfff128fc63cb4eb61c6370bedb4dc597c28a924e156f59cb4a688081c8cc132cddec6064d4b05edd0b96ca2dd1d2eb4a2ce498b9eaabf2d6f3b2d56ff32641ce40fcd378a44368156077969706f973bef54d387662e9ac01e0029159eda8318100fc436b6a04a9f4e0452bc63c7816a254caf9adc05f352f0f69bdc6dd6d6fab9d99cc6d3763e9ee22f25d1569c5db56bc2d887780f16a64b1b33ebf811577cec88a35943f7b2367d5247bef832e0dfafbb93f9960e29229a38aaf03a53bc1409aa2158b921eb03ec1e3f85c86ee10db7c5c3deabce5263ad7df47c537d5efdcea3b78108689f4eec124392995db99aa04cd7ffb11562b68f6ed922a0dc97cb69a61bac35a8f502a62709e8d348661b18da183ca1ad292071a9621773491ca56a89b729741e2ebad8048c6648dc466ef567a5a963c625965e8358a83b3cb60fbec339d3a1cf99121a508cae7d3df27bf05431b85825d4c2f01431fca967a540f0c8ff83ab9344cb0d4dae697e617ce847151a3f0b16aefc559c33af39ac52800473f74aa2f30cae6bbb4380cf77b7284eb6f2aa0473656817a3934556c0d40cdd63d9a71ab65b1908ad10e471e18ad0f099ddb1e4dbefccc6b33c871d4b7b5bf7be3d72ac7ad3fd95ed565e04f71941da82d1e6c4f869be9b882e08f5028b3fa382b7e1a87c5dcf28c275be3a5a767f26a43ab17e05d828d7290187fd4776a2fffaa7c9011b454bdd900c7fc5c62ed5dc9991775d5928b26b7a8c25571d0b77c369e4bb115b4a4da3bd66cac6149f5153dc4e9f81349a859f8e9f514bcc7934d8aaf49e1e1be3158a30cff4a2699039f13ff665359dea36ca0450e0d0fa08b26b12e3f7f51d11369937202fb175b1117999edd0daa13009619555cae64f943ac71d2b677a11047fb5b24f10cc5861055e5e0f95e562107be9891242c33394ab281bee7cee4af4bb6f910d13b4edfcb361a0eb4fc5a576792921c2afbf05099ad0c4d084623f6b3dd1297f904e9ea5a098a7590978afcdc4e431b9b434ebe1c31b7749b55cf3874bedb15974a552b7e6f28c1a3ff0bf2298ea5cbe7dcf91d75307d9fd7ea9304c457b1ee7f9caee27166e93f44dd72a4ddf84889036d371ea38800df25a99385d04d09af05494381ab34d9738907973cee7bba829ba3815126e051b5d56f820738697d31138bf05572971a09ab5a380d26284635370d13a2509e01cdc2c1e3a90905dd3fd34293705219c834f85a52e4d82effb5e9368ce2b2bab20c351ff095c080dedfb9e973cae89a"}) 15:29:40 executing program 5: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r0) sendmsg$TIPC_CMD_SET_LINK_TOL(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x68, r1, 0x10, 0x70bd2d, 0x25dfdbff, {{}, {}, {0x4c, 0x18, {0x6, @link='syz0\x00'}}}, ["", "", "", "", "", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x40800}, 0x8000) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async, rerun: 32) setsockopt$MRT_DEL_VIF(r0, 0x0, 0xcb, &(0x7f0000000000)={0x1, 0x0, 0x1f, 0x3, @vifc_lcl_ifindex, @local}, 0x10) (rerun: 32) 15:29:40 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) r2 = openat$cgroup(r0, &(0x7f00000002c0)='syz1\x00', 0x200002, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000014c0)={0x94, 0x0, &(0x7f0000000400)=[@dead_binder_done, @transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x1, &(0x7f0000000080)=""/193, 0xc1, 0x0, 0xe}, @fda={0x66646185, 0x7, 0x0, 0x33}, @ptr={0x70742a85, 0x0, &(0x7f0000000180)=""/68, 0x44, 0x8000000000000000, 0x26}}, &(0x7f0000000280)={0x0, 0x28, 0x48}}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000340)={@fd={0x66642a85, 0x0, r2}, @flat=@weak_handle={0x77682a85, 0x1, 0x3}, @fda={0x66646185, 0x9, 0x1, 0x35}}, &(0x7f00000003c0)={0x0, 0x18, 0x30}}}], 0x1000, 0x0, &(0x7f00000004c0)="55ef2537db424d5ecbe3a7a97545266a12c1bec32fcaf00b9b1470b87f6a3b51b0b5f6da0822f31dd33ef4be119b5b52a7ed20c8596fd4d5d839ca5594cb16bc82f0788d15b3a2c9e3ecf3a92a21fd4370d51aef71bfab66503dc5b9cab11a36a640803b86d94c13844ae7ab647d734f8e406b6bec4f7fd24cfdbb27dfb668ef025c15f9fa8347dc1c4ef59a49050599917cc023c6660ffa9d479df385ca141e9320a23efacb0fe929b5176aaa00cc2de5a9edc7a2bd230f580c8a9de2b5bead6132aab479db455e69e8c2feb6d8b82fde9c8b6874314c6e6204058cb8b306198015183a94d11dc28699d99e95e5f28f72bd1cad9543166b648a0347db1c1f3a5f5b6515ad63403759ffaa9635f5aa2da2f2b98ac7797fec0a21291a268de6cbbb59dd2ef2bbd2c02ffc2cb0fd6b2598597748b86922ac9b6f755c6cf274bdb3cc7bd5bab73ae215c3db7909dcc4fd81ce338e0ad856b6691aa8b35858e180b88502882f69ab868e537ed91b1a94ac988c1003c73896084003430c0ca9f71242f2bea8fa7272ee9da4139524d39d6e206ea71f735325c33a581fa4d48f3261f7ecf4a5753afe3d1c2396f7c9631a53a5e9db7de3171555554279c05540764cdb29e3c00c57acc64fa0111f5588f18141124961ec49f5b5e9442b2a4ebb9aeb927b39ba67e02de1173da1f2f04b1d4c71b25169a515ba66b5bae573de1812be6d7c507b03cbeca73f7fabfe258cd2c5960a3042025afd8c267c0c1129f93e9dd1fed2b14c068900082f819b96011c771e6f9ad4dbdf7729dfd0c0ec03e8b8d79c4813409e67ef5bf9567c1af9f37eac0660e54adc71aad19838395cfb3b6e2f5271f46b6a4c26b4814cc151299d7f4c937a43c6b7f95ab722a2c437598555e55c4e83ea0ce92cb3dc7ff7011da80549b9301287026a4747c7d76e6929efea59f010e7353527f5efa7264bc9cef68c76d1cd06e41634e6648d59e84fc17b7e50fae5691603bc6328da9f292425d2b4c5db1b944ead5cd77f124d5c39fe0cf1e1849e28425b7091d1d23739c57354c0337c0e3b5c81cef0277e5eda9478ba603ce0915490637024a38f6ad14f1ddee540a4166a181dc1effbff4b0a48e1db4a8027c8b5e4bbde9f5cf60e3e0bc701b16d7c6e8a3a267d53f8620c340e534a0735f73387d568acfc39b079aa5e81e8db48495a65c0d6e27e5bbf8359c4f61512b90c61c6faf73fb1e12b97e2cf92f1e69cd2442a7e33e4cc12bfa376db78b6834b07ed5871b873cb1ae61ecf7435c4abee3fd4963b542f95c72351db63f49266b8163505cd3e3c4c5c0ba3507845edec6c27239ff10d8bdd5e094fdaa422b07645fbd356354dc1bb74b80c330369552716dd0ae9314f99c5a32b1dab36cd1ce4f6b899c48fc1204b742326e2800c9b7a12502bbe9b968033cb2af2dc0e54a6b5b81f70b4b1977f0b0c4a1455a3f8930d0525bb0e37a779c67ae5082a2690942bc06a87d7776fca883e9b116b5fd1d25c8c937029a12eb09488a021388cc661ec44e9b528f11b535f6a3503ff2459709779e8499d2cea2212b1f395ec887794a748c59ad5698bc289bedb6b827f50c9dba8c43ca3c855f4ccd85d38a90cc8d08fb89ba4f67684bce4d542413e0ddd942ea1bba1c23351309cabeba70bd25cee9b4837521435a3438a8e1d9f6cd456723f6c19fb7fe13ee80ee59544ff4cb4b41d3fdd1b8f0a3e33405fabcba10341a1fc0ac03f9a0d2ea878de177c448c89be3b846461f5f51a7b4da122231ec8ded2659e27cb20c6f90868124b928f0c70f7f56b233760f3c28b70daf276bcaa04e11c86862555cae67de499663364171e77e407ea8fd212f40ba1a0190e2c4ff9445a06dcfed685d346499b8cf74a6a6cc2b4e02bbbb38411bf8266c0dae7ace1879569532511a9bf0b7bdec90f9878deb9ac770a3cd9009d0fc5a11cc5e50a665cd54c5f2fb2f32b7abd890ae5b3635a9b49027179215ea6f551c2e69b43700d7a3e0b2625de1cf4d7b546e2764f9257e5ca26d542762ae04d694d2595068cbb3736e5a29c13eb17229e4a12776463ea692b4bcedff67621f0c9397d7714913d9a50f0840899c2ee0a46ff0221a719bac5ed03f718b15381fac35ffde7f0795135ad7b58fb9d4924af4370f3fe86125a448b7bd42c995f02466573b59c0bd4fa5d631c8fc2286e7fa0ea7a2acc1ade5b7b27175adc5ba38ca2f29ca69a37cd6c468ec212d4c022acb9aecdbec444fa6bdd3b12a0a08e98a61ebb6cc16e785706e6d5040ce9564905458bac599ce93c52963fb4da07d6a829cb18c5f21fb3910cecbfd2331974817a6389aba946eb759e921d3fd436a622bdb3b9599a75458535b728dc729a1a4f0f3b7ef2e41f2809d2fabf27c04e17fa6f5342ea49e19aa902ee5eb26f726f614df2ff5de2111e7d216380fc8077069eada0e079b594f6b52cc512ef8871a84b6bedc826712683dc62cc52ec947a7e1e7ed2e08840402e85ade866a8a5b94c02831ea6ae0708b94d67ed7de4cd6d30408caf3e611060d3dd8599b1a577530ed747112bfab8b5e8bf89179c40381ecd67a1bfff9546cbcf5b805785e757f5ea894b04800a19ea27c08ca7caf32307c9da9df95bd1f1dc8d23cdd17c62dec06788a00e3107ff507be84efb52f83c6cdd19d476207d231547ee1d6f1dc5da2fd2bd260d657ff95736d208f0f4aa61052b698c1c04a2b9d696e4baf998fa3eaabc7a69064e4651e5e0b148ea975398251f2c0f91a13ecccbcb09906763124dd1f8d605ea310bfae25a7962af6669ef48730d7013941b22c71c84daf6afdf2c326a31196a2aea5f69f8515075c78369a9d04f40bcb0afc2b4969157a0d87811739673f53418c2fe8fd2866b770e3cea1ce42c50ec6bcb440d9575859ed31f80e15848622bf950d875c3bd46b1e57f846dca2fc8114aa872cc462659da072049d2e0bb71e7be02b7eee489216d5b7d0008486b830e647ef10a6478f6392323eec050ee8ae16a4fd078efe868594c508f771f6ace0682e6a30a257545b218e1bb65da5cb9bef04a4a3df4a269458777a235d25e5f18aa0b193024a31896b2067e2228d7233beac267fed002c2f50c389acc42629825730fb4c93ce6981deea33dee6f25729a3efbdbb6071ea0d01c3e1a247a21a21db0242bae7366662281998264caee70fabe3e620e3dbb16f7368316d25528e4d3c4c460a4ee2d0878523a1e84f9df8abeaf94ceebbe698c16c898c7286d06c7381e62a39938d575c92a7daf5a7d311f4f4a4edd628ab6d8059a5397868005e943a4aee5cf2af08258a16df02db9361d9138bccef6a9a9f2abc69c9ac8f15f8d5270fe43e6739272871500364d0bcb892abc6b86ab57cc66731ef1911f01dc9dc9427bb0a355758219fec4a49d4f677bf9013a9b8cc9ae8ce2f351ff88cc7c1bb95437161a9974faef2dde6c8cbe1d63e023c3f640f1b14be289d60e47fdc6d17f0ddb9ff4229ed33e58eaf90255e370c92c72602fb28be1ea152a101a07439b9218611123a4258ebd96f66dece1a02f079da97b62807b565bcce39faecd560a759c7815f8f2f7b4aff1742ed24dbf2e321915a940563618a0ccea603db008712cfd7b609af44fd1f029156abfff73f1f9441945fe139b85db3319c62367ee45b46a6d16f9e765ad88e5c78602b79a70132d0318dd217a664adc0a16c17cf9f3ce40fa7065880149ca24d710313be793a6146f8e166dde0980c4001d1b7a5bb8f5f500781c20dd6a39929ed2e967630897191bf174609c26679882316ecd1878c5a27407e2b2238894023c23e0433e64dabb0c25faa4bae2556c2de7b4f7422bc85e14cd5ab9e7eb6e0678975e3687a73ccfdd538fdc8af7208fe862196c23eaf3b0d07d86a5f83dfacbd18feb77c1028cdd639f05c50d6a1534382b3f4b41b9d912b6daa005981209614a05c786f091f4370477e6fbb5edc0e88c417135e6e4a242cedfe627ee54064409d9cf6322a2b027d83167b8951fed2e4439e4e1a291a11e6fc7b8647abe0675b57d9011d8e804f3cd7b53b4fe5de30bfb99db2a9c6d35d88ea8060b29f3b885fa8e0fa106b8a2620fe62fce15181263ec007e37031fb209b808c7ebe2a833fe735b9b4d99aa0243d26303d3f9e3058c292552ef51a6ac46ffea1b64e3f5c7d489b0eaa5eba9b081706ab18ca5cf4e319d04153fd190d4d9fff2988c1642f856a37bf280816ce833e5c02526205a095f9798983bd450e9b87f80a9045ea3f5e43386b280e71deb2d4c5d463431da314bcb595b68937b56c3f37d387ac0fd97f3a1c4ea5daf22dc9d09f7cb52507b9ce06f92028d586f9ed0d7f89984cef446abe18e9654a6af1115a2fe927109d96a315423e113feb5bb1138fcd68d4652b6e49b311b8410a92e4b99d14734bbd58aea15644ae71b4e857c08c56e4b69ad4e5839cee69b59cf874b81cffe3d23c9c0a3e6373f171232b61ec2a9db7ea0054227cdabfff128fc63cb4eb61c6370bedb4dc597c28a924e156f59cb4a688081c8cc132cddec6064d4b05edd0b96ca2dd1d2eb4a2ce498b9eaabf2d6f3b2d56ff32641ce40fcd378a44368156077969706f973bef54d387662e9ac01e0029159eda8318100fc436b6a04a9f4e0452bc63c7816a254caf9adc05f352f0f69bdc6dd6d6fab9d99cc6d3763e9ee22f25d1569c5db56bc2d887780f16a64b1b33ebf811577cec88a35943f7b2367d5247bef832e0dfafbb93f9960e29229a38aaf03a53bc1409aa2158b921eb03ec1e3f85c86ee10db7c5c3deabce5263ad7df47c537d5efdcea3b78108689f4eec124392995db99aa04cd7ffb11562b68f6ed922a0dc97cb69a61bac35a8f502a62709e8d348661b18da183ca1ad292071a9621773491ca56a89b729741e2ebad8048c6648dc466ef567a5a963c625965e8358a83b3cb60fbec339d3a1cf99121a508cae7d3df27bf05431b85825d4c2f01431fca967a540f0c8ff83ab9344cb0d4dae697e617ce847151a3f0b16aefc559c33af39ac52800473f74aa2f30cae6bbb4380cf77b7284eb6f2aa0473656817a3934556c0d40cdd63d9a71ab65b1908ad10e471e18ad0f099ddb1e4dbefccc6b33c871d4b7b5bf7be3d72ac7ad3fd95ed565e04f71941da82d1e6c4f869be9b882e08f5028b3fa382b7e1a87c5dcf28c275be3a5a767f26a43ab17e05d828d7290187fd4776a2fffaa7c9011b454bdd900c7fc5c62ed5dc9991775d5928b26b7a8c25571d0b77c369e4bb115b4a4da3bd66cac6149f5153dc4e9f81349a859f8e9f514bcc7934d8aaf49e1e1be3158a30cff4a2699039f13ff665359dea36ca0450e0d0fa08b26b12e3f7f51d11369937202fb175b1117999edd0daa13009619555cae64f943ac71d2b677a11047fb5b24f10cc5861055e5e0f95e562107be9891242c33394ab281bee7cee4af4bb6f910d13b4edfcb361a0eb4fc5a576792921c2afbf05099ad0c4d084623f6b3dd1297f904e9ea5a098a7590978afcdc4e431b9b434ebe1c31b7749b55cf3874bedb15974a552b7e6f28c1a3ff0bf2298ea5cbe7dcf91d75307d9fd7ea9304c457b1ee7f9caee27166e93f44dd72a4ddf84889036d371ea38800df25a99385d04d09af05494381ab34d9738907973cee7bba829ba3815126e051b5d56f820738697d31138bf05572971a09ab5a380d26284635370d13a2509e01cdc2c1e3a90905dd3fd34293705219c834f85a52e4d82effb5e9368ce2b2bab20c351ff095c080dedfb9e973cae89a"}) 15:29:40 executing program 5: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) r2 = openat$cgroup(r0, &(0x7f00000002c0)='syz1\x00', 0x200002, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000014c0)={0x94, 0x0, &(0x7f0000000400)=[@dead_binder_done, @transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x1, &(0x7f0000000080)=""/193, 0xc1, 0x0, 0xe}, @fda={0x66646185, 0x7, 0x0, 0x33}, @ptr={0x70742a85, 0x0, &(0x7f0000000180)=""/68, 0x44, 0x8000000000000000, 0x26}}, &(0x7f0000000280)={0x0, 0x28, 0x48}}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000340)={@fd={0x66642a85, 0x0, r2}, @flat=@weak_handle={0x77682a85, 0x1, 0x3}, @fda={0x66646185, 0x9, 0x1, 0x35}}, &(0x7f00000003c0)={0x0, 0x18, 0x30}}}], 0x1000, 0x0, &(0x7f00000004c0)="55ef2537db424d5ecbe3a7a97545266a12c1bec32fcaf00b9b1470b87f6a3b51b0b5f6da0822f31dd33ef4be119b5b52a7ed20c8596fd4d5d839ca5594cb16bc82f0788d15b3a2c9e3ecf3a92a21fd4370d51aef71bfab66503dc5b9cab11a36a640803b86d94c13844ae7ab647d734f8e406b6bec4f7fd24cfdbb27dfb668ef025c15f9fa8347dc1c4ef59a49050599917cc023c6660ffa9d479df385ca141e9320a23efacb0fe929b5176aaa00cc2de5a9edc7a2bd230f580c8a9de2b5bead6132aab479db455e69e8c2feb6d8b82fde9c8b6874314c6e6204058cb8b306198015183a94d11dc28699d99e95e5f28f72bd1cad9543166b648a0347db1c1f3a5f5b6515ad63403759ffaa9635f5aa2da2f2b98ac7797fec0a21291a268de6cbbb59dd2ef2bbd2c02ffc2cb0fd6b2598597748b86922ac9b6f755c6cf274bdb3cc7bd5bab73ae215c3db7909dcc4fd81ce338e0ad856b6691aa8b35858e180b88502882f69ab868e537ed91b1a94ac988c1003c73896084003430c0ca9f71242f2bea8fa7272ee9da4139524d39d6e206ea71f735325c33a581fa4d48f3261f7ecf4a5753afe3d1c2396f7c9631a53a5e9db7de3171555554279c05540764cdb29e3c00c57acc64fa0111f5588f18141124961ec49f5b5e9442b2a4ebb9aeb927b39ba67e02de1173da1f2f04b1d4c71b25169a515ba66b5bae573de1812be6d7c507b03cbeca73f7fabfe258cd2c5960a3042025afd8c267c0c1129f93e9dd1fed2b14c068900082f819b96011c771e6f9ad4dbdf7729dfd0c0ec03e8b8d79c4813409e67ef5bf9567c1af9f37eac0660e54adc71aad19838395cfb3b6e2f5271f46b6a4c26b4814cc151299d7f4c937a43c6b7f95ab722a2c437598555e55c4e83ea0ce92cb3dc7ff7011da80549b9301287026a4747c7d76e6929efea59f010e7353527f5efa7264bc9cef68c76d1cd06e41634e6648d59e84fc17b7e50fae5691603bc6328da9f292425d2b4c5db1b944ead5cd77f124d5c39fe0cf1e1849e28425b7091d1d23739c57354c0337c0e3b5c81cef0277e5eda9478ba603ce0915490637024a38f6ad14f1ddee540a4166a181dc1effbff4b0a48e1db4a8027c8b5e4bbde9f5cf60e3e0bc701b16d7c6e8a3a267d53f8620c340e534a0735f73387d568acfc39b079aa5e81e8db48495a65c0d6e27e5bbf8359c4f61512b90c61c6faf73fb1e12b97e2cf92f1e69cd2442a7e33e4cc12bfa376db78b6834b07ed5871b873cb1ae61ecf7435c4abee3fd4963b542f95c72351db63f49266b8163505cd3e3c4c5c0ba3507845edec6c27239ff10d8bdd5e094fdaa422b07645fbd356354dc1bb74b80c330369552716dd0ae9314f99c5a32b1dab36cd1ce4f6b899c48fc1204b742326e2800c9b7a12502bbe9b968033cb2af2dc0e54a6b5b81f70b4b1977f0b0c4a1455a3f8930d0525bb0e37a779c67ae5082a2690942bc06a87d7776fca883e9b116b5fd1d25c8c937029a12eb09488a021388cc661ec44e9b528f11b535f6a3503ff2459709779e8499d2cea2212b1f395ec887794a748c59ad5698bc289bedb6b827f50c9dba8c43ca3c855f4ccd85d38a90cc8d08fb89ba4f67684bce4d542413e0ddd942ea1bba1c23351309cabeba70bd25cee9b4837521435a3438a8e1d9f6cd456723f6c19fb7fe13ee80ee59544ff4cb4b41d3fdd1b8f0a3e33405fabcba10341a1fc0ac03f9a0d2ea878de177c448c89be3b846461f5f51a7b4da122231ec8ded2659e27cb20c6f90868124b928f0c70f7f56b233760f3c28b70daf276bcaa04e11c86862555cae67de499663364171e77e407ea8fd212f40ba1a0190e2c4ff9445a06dcfed685d346499b8cf74a6a6cc2b4e02bbbb38411bf8266c0dae7ace1879569532511a9bf0b7bdec90f9878deb9ac770a3cd9009d0fc5a11cc5e50a665cd54c5f2fb2f32b7abd890ae5b3635a9b49027179215ea6f551c2e69b43700d7a3e0b2625de1cf4d7b546e2764f9257e5ca26d542762ae04d694d2595068cbb3736e5a29c13eb17229e4a12776463ea692b4bcedff67621f0c9397d7714913d9a50f0840899c2ee0a46ff0221a719bac5ed03f718b15381fac35ffde7f0795135ad7b58fb9d4924af4370f3fe86125a448b7bd42c995f02466573b59c0bd4fa5d631c8fc2286e7fa0ea7a2acc1ade5b7b27175adc5ba38ca2f29ca69a37cd6c468ec212d4c022acb9aecdbec444fa6bdd3b12a0a08e98a61ebb6cc16e785706e6d5040ce9564905458bac599ce93c52963fb4da07d6a829cb18c5f21fb3910cecbfd2331974817a6389aba946eb759e921d3fd436a622bdb3b9599a75458535b728dc729a1a4f0f3b7ef2e41f2809d2fabf27c04e17fa6f5342ea49e19aa902ee5eb26f726f614df2ff5de2111e7d216380fc8077069eada0e079b594f6b52cc512ef8871a84b6bedc826712683dc62cc52ec947a7e1e7ed2e08840402e85ade866a8a5b94c02831ea6ae0708b94d67ed7de4cd6d30408caf3e611060d3dd8599b1a577530ed747112bfab8b5e8bf89179c40381ecd67a1bfff9546cbcf5b805785e757f5ea894b04800a19ea27c08ca7caf32307c9da9df95bd1f1dc8d23cdd17c62dec06788a00e3107ff507be84efb52f83c6cdd19d476207d231547ee1d6f1dc5da2fd2bd260d657ff95736d208f0f4aa61052b698c1c04a2b9d696e4baf998fa3eaabc7a69064e4651e5e0b148ea975398251f2c0f91a13ecccbcb09906763124dd1f8d605ea310bfae25a7962af6669ef48730d7013941b22c71c84daf6afdf2c326a31196a2aea5f69f8515075c78369a9d04f40bcb0afc2b4969157a0d87811739673f53418c2fe8fd2866b770e3cea1ce42c50ec6bcb440d9575859ed31f80e15848622bf950d875c3bd46b1e57f846dca2fc8114aa872cc462659da072049d2e0bb71e7be02b7eee489216d5b7d0008486b830e647ef10a6478f6392323eec050ee8ae16a4fd078efe868594c508f771f6ace0682e6a30a257545b218e1bb65da5cb9bef04a4a3df4a269458777a235d25e5f18aa0b193024a31896b2067e2228d7233beac267fed002c2f50c389acc42629825730fb4c93ce6981deea33dee6f25729a3efbdbb6071ea0d01c3e1a247a21a21db0242bae7366662281998264caee70fabe3e620e3dbb16f7368316d25528e4d3c4c460a4ee2d0878523a1e84f9df8abeaf94ceebbe698c16c898c7286d06c7381e62a39938d575c92a7daf5a7d311f4f4a4edd628ab6d8059a5397868005e943a4aee5cf2af08258a16df02db9361d9138bccef6a9a9f2abc69c9ac8f15f8d5270fe43e6739272871500364d0bcb892abc6b86ab57cc66731ef1911f01dc9dc9427bb0a355758219fec4a49d4f677bf9013a9b8cc9ae8ce2f351ff88cc7c1bb95437161a9974faef2dde6c8cbe1d63e023c3f640f1b14be289d60e47fdc6d17f0ddb9ff4229ed33e58eaf90255e370c92c72602fb28be1ea152a101a07439b9218611123a4258ebd96f66dece1a02f079da97b62807b565bcce39faecd560a759c7815f8f2f7b4aff1742ed24dbf2e321915a940563618a0ccea603db008712cfd7b609af44fd1f029156abfff73f1f9441945fe139b85db3319c62367ee45b46a6d16f9e765ad88e5c78602b79a70132d0318dd217a664adc0a16c17cf9f3ce40fa7065880149ca24d710313be793a6146f8e166dde0980c4001d1b7a5bb8f5f500781c20dd6a39929ed2e967630897191bf174609c26679882316ecd1878c5a27407e2b2238894023c23e0433e64dabb0c25faa4bae2556c2de7b4f7422bc85e14cd5ab9e7eb6e0678975e3687a73ccfdd538fdc8af7208fe862196c23eaf3b0d07d86a5f83dfacbd18feb77c1028cdd639f05c50d6a1534382b3f4b41b9d912b6daa005981209614a05c786f091f4370477e6fbb5edc0e88c417135e6e4a242cedfe627ee54064409d9cf6322a2b027d83167b8951fed2e4439e4e1a291a11e6fc7b8647abe0675b57d9011d8e804f3cd7b53b4fe5de30bfb99db2a9c6d35d88ea8060b29f3b885fa8e0fa106b8a2620fe62fce15181263ec007e37031fb209b808c7ebe2a833fe735b9b4d99aa0243d26303d3f9e3058c292552ef51a6ac46ffea1b64e3f5c7d489b0eaa5eba9b081706ab18ca5cf4e319d04153fd190d4d9fff2988c1642f856a37bf280816ce833e5c02526205a095f9798983bd450e9b87f80a9045ea3f5e43386b280e71deb2d4c5d463431da314bcb595b68937b56c3f37d387ac0fd97f3a1c4ea5daf22dc9d09f7cb52507b9ce06f92028d586f9ed0d7f89984cef446abe18e9654a6af1115a2fe927109d96a315423e113feb5bb1138fcd68d4652b6e49b311b8410a92e4b99d14734bbd58aea15644ae71b4e857c08c56e4b69ad4e5839cee69b59cf874b81cffe3d23c9c0a3e6373f171232b61ec2a9db7ea0054227cdabfff128fc63cb4eb61c6370bedb4dc597c28a924e156f59cb4a688081c8cc132cddec6064d4b05edd0b96ca2dd1d2eb4a2ce498b9eaabf2d6f3b2d56ff32641ce40fcd378a44368156077969706f973bef54d387662e9ac01e0029159eda8318100fc436b6a04a9f4e0452bc63c7816a254caf9adc05f352f0f69bdc6dd6d6fab9d99cc6d3763e9ee22f25d1569c5db56bc2d887780f16a64b1b33ebf811577cec88a35943f7b2367d5247bef832e0dfafbb93f9960e29229a38aaf03a53bc1409aa2158b921eb03ec1e3f85c86ee10db7c5c3deabce5263ad7df47c537d5efdcea3b78108689f4eec124392995db99aa04cd7ffb11562b68f6ed922a0dc97cb69a61bac35a8f502a62709e8d348661b18da183ca1ad292071a9621773491ca56a89b729741e2ebad8048c6648dc466ef567a5a963c625965e8358a83b3cb60fbec339d3a1cf99121a508cae7d3df27bf05431b85825d4c2f01431fca967a540f0c8ff83ab9344cb0d4dae697e617ce847151a3f0b16aefc559c33af39ac52800473f74aa2f30cae6bbb4380cf77b7284eb6f2aa0473656817a3934556c0d40cdd63d9a71ab65b1908ad10e471e18ad0f099ddb1e4dbefccc6b33c871d4b7b5bf7be3d72ac7ad3fd95ed565e04f71941da82d1e6c4f869be9b882e08f5028b3fa382b7e1a87c5dcf28c275be3a5a767f26a43ab17e05d828d7290187fd4776a2fffaa7c9011b454bdd900c7fc5c62ed5dc9991775d5928b26b7a8c25571d0b77c369e4bb115b4a4da3bd66cac6149f5153dc4e9f81349a859f8e9f514bcc7934d8aaf49e1e1be3158a30cff4a2699039f13ff665359dea36ca0450e0d0fa08b26b12e3f7f51d11369937202fb175b1117999edd0daa13009619555cae64f943ac71d2b677a11047fb5b24f10cc5861055e5e0f95e562107be9891242c33394ab281bee7cee4af4bb6f910d13b4edfcb361a0eb4fc5a576792921c2afbf05099ad0c4d084623f6b3dd1297f904e9ea5a098a7590978afcdc4e431b9b434ebe1c31b7749b55cf3874bedb15974a552b7e6f28c1a3ff0bf2298ea5cbe7dcf91d75307d9fd7ea9304c457b1ee7f9caee27166e93f44dd72a4ddf84889036d371ea38800df25a99385d04d09af05494381ab34d9738907973cee7bba829ba3815126e051b5d56f820738697d31138bf05572971a09ab5a380d26284635370d13a2509e01cdc2c1e3a90905dd3fd34293705219c834f85a52e4d82effb5e9368ce2b2bab20c351ff095c080dedfb9e973cae89a"}) 15:29:40 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x4d) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x4d) (async) 15:29:40 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.net/syz0\x00', 0x200002, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x90, 0x0, &(0x7f0000000340)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000100)={@flat=@weak_binder={0x77622a85, 0x101, 0x2}, @fd={0x66642a85, 0x0, r1}, @ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/61, 0x3d, 0x0, 0x4}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x40}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f00000001c0)={@flat=@weak_binder={0x77622a85, 0xa, 0x3}, @flat=@weak_binder={0x77622a85, 0x1, 0x7ff}, @flat=@binder={0x73622a85, 0x100, 0x3}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}}], 0x45, 0x0, &(0x7f0000000280)="ccca5fd12bfca8fb22e650ba684baa3f1fc9ab13d91eff6a8ead9c3e68d734d34b4a70e7ca79c4353805fdad1bc9d187be5ec90b6ad4684de1bf4fa05bc9e77fe9d9b5dbef"}) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000440)={r0, r2, 0x3}, 0x10) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) setsockopt$TIPC_MCAST_BROADCAST(r0, 0x10f, 0x85) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:40 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 3: setsockopt$MRT_PIM(0xffffffffffffffff, 0x0, 0xcf, &(0x7f0000000000)=0x4, 0x4) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:40 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x4d) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x4d) (async) 15:29:40 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.net/syz0\x00', 0x200002, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x90, 0x0, &(0x7f0000000340)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000100)={@flat=@weak_binder={0x77622a85, 0x101, 0x2}, @fd={0x66642a85, 0x0, r1}, @ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/61, 0x3d, 0x0, 0x4}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x40}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f00000001c0)={@flat=@weak_binder={0x77622a85, 0xa, 0x3}, @flat=@weak_binder={0x77622a85, 0x1, 0x7ff}, @flat=@binder={0x73622a85, 0x100, 0x3}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}}], 0x45, 0x0, &(0x7f0000000280)="ccca5fd12bfca8fb22e650ba684baa3f1fc9ab13d91eff6a8ead9c3e68d734d34b4a70e7ca79c4353805fdad1bc9d187be5ec90b6ad4684de1bf4fa05bc9e77fe9d9b5dbef"}) (async) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000440)={r0, r2, 0x3}, 0x10) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) setsockopt$TIPC_MCAST_BROADCAST(r0, 0x10f, 0x85) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:40 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) write$qrtrtun(r2, &(0x7f0000000000)="de81388fb504240c3b76712928dfc2b9c71ec2f5d2e3d9376efc4b52aa5310eac5e6cc77d4856fc8556e90ba109625", 0x2f) 15:29:40 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, 0x0, 0x0) 15:29:40 executing program 5: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)="de8138", 0xf85) 15:29:40 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) write$qrtrtun(r2, &(0x7f0000000000)="de81388fb504240c3b76712928dfc2b9c71ec2f5d2e3d9376efc4b52aa5310eac5e6cc77d4856fc8556e90ba109625", 0x2f) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) (async) write$qrtrtun(r2, &(0x7f0000000000)="de81388fb504240c3b76712928dfc2b9c71ec2f5d2e3d9376efc4b52aa5310eac5e6cc77d4856fc8556e90ba109625", 0x2f) (async) 15:29:40 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.net/syz0\x00', 0x200002, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x90, 0x0, &(0x7f0000000340)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000100)={@flat=@weak_binder={0x77622a85, 0x101, 0x2}, @fd={0x66642a85, 0x0, r1}, @ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/61, 0x3d, 0x0, 0x4}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x40}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f00000001c0)={@flat=@weak_binder={0x77622a85, 0xa, 0x3}, @flat=@weak_binder={0x77622a85, 0x1, 0x7ff}, @flat=@binder={0x73622a85, 0x100, 0x3}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}}], 0x45, 0x0, &(0x7f0000000280)="ccca5fd12bfca8fb22e650ba684baa3f1fc9ab13d91eff6a8ead9c3e68d734d34b4a70e7ca79c4353805fdad1bc9d187be5ec90b6ad4684de1bf4fa05bc9e77fe9d9b5dbef"}) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000440)={r0, r2, 0x3}, 0x10) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) setsockopt$TIPC_MCAST_BROADCAST(r0, 0x10f, 0x85) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:40 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, 0x0, 0x0) 15:29:40 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000080)="9e8ab4cbbb6232f3a10bf6b99f7b97f1250ab6f5245f8104881d2cb71ebcd43a460d66c847483a5ca0db984ad630b8ffac1f209df0b4388322bd20f3057716623526166f6c0e3a6308ceadb70ea4208136bd515edd04d167f1d24948ec86d4527a19c179d5e478873fa8198822850c3205f9872be678075a10f838f3a384cd0f6cd70753f3dc1b4e250f96ad95d0e90171eb1114806866181d15ea927cc43acbeafb41abc7889bf9bd3f573ef1c71a287cf8f5d50f584cf434b5a50be21476d5c1d0752e42f8371f50a74e95c4692ae68e49197aa32b87e95b05ad0ae44555479238c41f80f10800e38771623e11f0ab5a8fd5370a5f56362fbdaf", 0xfb) 15:29:40 executing program 3: setsockopt$MRT_PIM(0xffffffffffffffff, 0x0, 0xcf, &(0x7f0000000000)=0x4, 0x4) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:40 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, 0x0, 0x0) 15:29:40 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200040}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x34, 0x0, 0x10, 0x70bd2b, 0x25dfdbff, {{}, {}, {0x18, 0x17, {0x0, 0x4, @l2={'ib', 0x3a, 'geneve1\x00'}}}}, [""]}, 0x34}, 0x1, 0x0, 0x0, 0x840}, 0x4040000) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, 0x0, 0x800, 0x70bd2a, 0x25dfdbff, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x8091}, 0x22004040) 15:29:41 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000080)="9e8ab4cbbb6232f3a10bf6b99f7b97f1250ab6f5245f8104881d2cb71ebcd43a460d66c847483a5ca0db984ad630b8ffac1f209df0b4388322bd20f3057716623526166f6c0e3a6308ceadb70ea4208136bd515edd04d167f1d24948ec86d4527a19c179d5e478873fa8198822850c3205f9872be678075a10f838f3a384cd0f6cd70753f3dc1b4e250f96ad95d0e90171eb1114806866181d15ea927cc43acbeafb41abc7889bf9bd3f573ef1c71a287cf8f5d50f584cf434b5a50be21476d5c1d0752e42f8371f50a74e95c4692ae68e49197aa32b87e95b05ad0ae44555479238c41f80f10800e38771623e11f0ab5a8fd5370a5f56362fbdaf", 0xfb) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000080)="9e8ab4cbbb6232f3a10bf6b99f7b97f1250ab6f5245f8104881d2cb71ebcd43a460d66c847483a5ca0db984ad630b8ffac1f209df0b4388322bd20f3057716623526166f6c0e3a6308ceadb70ea4208136bd515edd04d167f1d24948ec86d4527a19c179d5e478873fa8198822850c3205f9872be678075a10f838f3a384cd0f6cd70753f3dc1b4e250f96ad95d0e90171eb1114806866181d15ea927cc43acbeafb41abc7889bf9bd3f573ef1c71a287cf8f5d50f584cf434b5a50be21476d5c1d0752e42f8371f50a74e95c4692ae68e49197aa32b87e95b05ad0ae44555479238c41f80f10800e38771623e11f0ab5a8fd5370a5f56362fbdaf", 0xfb) (async) 15:29:41 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, 0x0, 0x0) 15:29:41 executing program 3: setsockopt$MRT_PIM(0xffffffffffffffff, 0x0, 0xcf, &(0x7f0000000000)=0x4, 0x4) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) setsockopt$MRT_PIM(0xffffffffffffffff, 0x0, 0xcf, &(0x7f0000000000)=0x4, 0x4) (async) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) 15:29:41 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) write$qrtrtun(r2, &(0x7f0000000000)="de81388fb504240c3b76712928dfc2b9c71ec2f5d2e3d9376efc4b52aa5310eac5e6cc77d4856fc8556e90ba109625", 0x2f) 15:29:41 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200040}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x34, 0x0, 0x10, 0x70bd2b, 0x25dfdbff, {{}, {}, {0x18, 0x17, {0x0, 0x4, @l2={'ib', 0x3a, 'geneve1\x00'}}}}, [""]}, 0x34}, 0x1, 0x0, 0x0, 0x840}, 0x4040000) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, 0x0, 0x800, 0x70bd2a, 0x25dfdbff, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x8091}, 0x22004040) 15:29:41 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, 0x0, 0x0) 15:29:41 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x10000000) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/binder-control\x00', 0x800, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f00000000c0), 0x1a5002) sendmsg$nl_xfrm(r1, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="3c000000110000042cbd7000fbdbdf25fc010000000000000000000000000001000004d602002b0008000b00e00000000c0015005d07350007000000ca0b03d2522208ec1d54b5e36d9e2bfb38c757bd0126eb7f6d2bb5be1a4e4c142ceb88eb4d3450bbeae7fd1a6794e8fa51eb73378b8e4525b1cd43d275ce785ecb2c8b76f36e00344fad95f2dd35490d39bce9675dec8711e59330b1245d762cd0a735dcc38f86b196a62ad7a30a98f6b238cf6f75282c40ae2519c0e8ae9b2242b77ccae0e40b19fdab61b7c8f839447396ad358f116000e24a4b8659f2641e122898668f2a7a76617d1064e69aaadd7c155cda15d594c92710c71eb21b26028df0b4a3"], 0x3c}, 0x1, 0x0, 0x0, 0x200000d5}, 0x20048000) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000080)="3abb3471d662c89f", 0x8) socket$xdp(0x2c, 0x3, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), r2) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="000125bd7000febedf25040000000800000000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 15:29:41 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000), 0x0) 15:29:41 executing program 2: sendmsg$L2TP_CMD_NOOP(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080), 0xc, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="02002cbd7000ffdbdf250000000015892341195c5306001d00020000000000010007000004050012001f0000000600010000000000080011000100000006"], 0x44}, 0x1, 0x0, 0x0, 0x8880}, 0x40000) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="e76b57", 0xb) 15:29:41 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200040}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x34, 0x0, 0x10, 0x70bd2b, 0x25dfdbff, {{}, {}, {0x18, 0x17, {0x0, 0x4, @l2={'ib', 0x3a, 'geneve1\x00'}}}}, [""]}, 0x34}, 0x1, 0x0, 0x0, 0x840}, 0x4040000) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, 0x0, 0x800, 0x70bd2a, 0x25dfdbff, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x8091}, 0x22004040) 15:29:41 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, 0x0, 0x0) 15:29:41 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000), 0x0) 15:29:41 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000080)="9e8ab4cbbb6232f3a10bf6b99f7b97f1250ab6f5245f8104881d2cb71ebcd43a460d66c847483a5ca0db984ad630b8ffac1f209df0b4388322bd20f3057716623526166f6c0e3a6308ceadb70ea4208136bd515edd04d167f1d24948ec86d4527a19c179d5e478873fa8198822850c3205f9872be678075a10f838f3a384cd0f6cd70753f3dc1b4e250f96ad95d0e90171eb1114806866181d15ea927cc43acbeafb41abc7889bf9bd3f573ef1c71a287cf8f5d50f584cf434b5a50be21476d5c1d0752e42f8371f50a74e95c4692ae68e49197aa32b87e95b05ad0ae44555479238c41f80f10800e38771623e11f0ab5a8fd5370a5f56362fbdaf", 0xfb) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000080)="9e8ab4cbbb6232f3a10bf6b99f7b97f1250ab6f5245f8104881d2cb71ebcd43a460d66c847483a5ca0db984ad630b8ffac1f209df0b4388322bd20f3057716623526166f6c0e3a6308ceadb70ea4208136bd515edd04d167f1d24948ec86d4527a19c179d5e478873fa8198822850c3205f9872be678075a10f838f3a384cd0f6cd70753f3dc1b4e250f96ad95d0e90171eb1114806866181d15ea927cc43acbeafb41abc7889bf9bd3f573ef1c71a287cf8f5d50f584cf434b5a50be21476d5c1d0752e42f8371f50a74e95c4692ae68e49197aa32b87e95b05ad0ae44555479238c41f80f10800e38771623e11f0ab5a8fd5370a5f56362fbdaf", 0xfb) (async) 15:29:41 executing program 2: sendmsg$L2TP_CMD_NOOP(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080), 0xc, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="02002cbd7000ffdbdf250000000015892341195c5306001d00020000000000010007000004050012001f0000000600010000000000080011000100000006"], 0x44}, 0x1, 0x0, 0x0, 0x8880}, 0x40000) (async) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="e76b57", 0xb) 15:29:41 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup/syz1\x00', 0x200002, 0x0) write$qrtrtun(r0, &(0x7f0000000000)="0485df", 0x3) 15:29:41 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000), 0x0) 15:29:41 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x10000000) (async) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) (async) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/binder-control\x00', 0x800, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) openat$qrtrtun(0xffffffffffffff9c, &(0x7f00000000c0), 0x1a5002) (async) sendmsg$nl_xfrm(r1, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="3c000000110000042cbd7000fbdbdf25fc010000000000000000000000000001000004d602002b0008000b00e00000000c0015005d07350007000000ca0b03d2522208ec1d54b5e36d9e2bfb38c757bd0126eb7f6d2bb5be1a4e4c142ceb88eb4d3450bbeae7fd1a6794e8fa51eb73378b8e4525b1cd43d275ce785ecb2c8b76f36e00344fad95f2dd35490d39bce9675dec8711e59330b1245d762cd0a735dcc38f86b196a62ad7a30a98f6b238cf6f75282c40ae2519c0e8ae9b2242b77ccae0e40b19fdab61b7c8f839447396ad358f116000e24a4b8659f2641e122898668f2a7a76617d1064e69aaadd7c155cda15d594c92710c71eb21b26028df0b4a3"], 0x3c}, 0x1, 0x0, 0x0, 0x200000d5}, 0x20048000) (async, rerun: 64) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000080)="3abb3471d662c89f", 0x8) (rerun: 64) socket$xdp(0x2c, 0x3, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async, rerun: 64) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), r2) (rerun: 64) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="000125bd7000febedf25040000000800000000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 15:29:41 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xfffff, 0xe001) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r1, 0x40505412, &(0x7f00000000c0)={0x6, 0xffff, 0x1, 0x0, 0x12}) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:41 executing program 2: sendmsg$L2TP_CMD_NOOP(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080), 0xc, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="02002cbd7000ffdbdf250000000015892341195c5306001d00020000000000010007000004050012001f0000000600010000000000080011000100000006"], 0x44}, 0x1, 0x0, 0x0, 0x8880}, 0x40000) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="e76b57", 0xb) sendmsg$L2TP_CMD_NOOP(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080), 0xc, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="02002cbd7000ffdbdf250000000015892341195c5306001d00020000000000010007000004050012001f0000000600010000000000080011000100000006"], 0x44}, 0x1, 0x0, 0x0, 0x8880}, 0x40000) (async) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="e76b57", 0xb) (async) 15:29:41 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup/syz1\x00', 0x200002, 0x0) (async) write$qrtrtun(r0, &(0x7f0000000000)="0485df", 0x3) 15:29:41 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000), 0x0) 15:29:41 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x10000000) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/binder-control\x00', 0x800, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f00000000c0), 0x1a5002) sendmsg$nl_xfrm(r1, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="3c000000110000042cbd7000fbdbdf25fc010000000000000000000000000001000004d602002b0008000b00e00000000c0015005d07350007000000ca0b03d2522208ec1d54b5e36d9e2bfb38c757bd0126eb7f6d2bb5be1a4e4c142ceb88eb4d3450bbeae7fd1a6794e8fa51eb73378b8e4525b1cd43d275ce785ecb2c8b76f36e00344fad95f2dd35490d39bce9675dec8711e59330b1245d762cd0a735dcc38f86b196a62ad7a30a98f6b238cf6f75282c40ae2519c0e8ae9b2242b77ccae0e40b19fdab61b7c8f839447396ad358f116000e24a4b8659f2641e122898668f2a7a76617d1064e69aaadd7c155cda15d594c92710c71eb21b26028df0b4a3"], 0x3c}, 0x1, 0x0, 0x0, 0x200000d5}, 0x20048000) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000080)="3abb3471d662c89f", 0x8) socket$xdp(0x2c, 0x3, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), r2) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="000125bd7000febedf25040000000800000000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x10000000) (async) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) (async) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/binder-control\x00', 0x800, 0x0) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) openat$qrtrtun(0xffffffffffffff9c, &(0x7f00000000c0), 0x1a5002) (async) sendmsg$nl_xfrm(r1, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="3c000000110000042cbd7000fbdbdf25fc010000000000000000000000000001000004d602002b0008000b00e00000000c0015005d07350007000000ca0b03d2522208ec1d54b5e36d9e2bfb38c757bd0126eb7f6d2bb5be1a4e4c142ceb88eb4d3450bbeae7fd1a6794e8fa51eb73378b8e4525b1cd43d275ce785ecb2c8b76f36e00344fad95f2dd35490d39bce9675dec8711e59330b1245d762cd0a735dcc38f86b196a62ad7a30a98f6b238cf6f75282c40ae2519c0e8ae9b2242b77ccae0e40b19fdab61b7c8f839447396ad358f116000e24a4b8659f2641e122898668f2a7a76617d1064e69aaadd7c155cda15d594c92710c71eb21b26028df0b4a3"], 0x3c}, 0x1, 0x0, 0x0, 0x200000d5}, 0x20048000) (async) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000080)="3abb3471d662c89f", 0x8) (async) socket$xdp(0x2c, 0x3, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), r2) (async) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="000125bd7000febedf25040000000800000000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) (async) 15:29:41 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000), 0x0) 15:29:41 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de81", 0x2) 15:29:41 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup/syz1\x00', 0x200002, 0x0) (async, rerun: 32) write$qrtrtun(r0, &(0x7f0000000000)="0485df", 0x3) (rerun: 32) 15:29:41 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de81", 0x2) 15:29:41 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0xffffc, 0x500) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:41 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xfffff, 0xe001) (async) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r1, 0x40505412, &(0x7f00000000c0)={0x6, 0xffff, 0x1, 0x0, 0x12}) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:41 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de81", 0x2) 15:29:41 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000), 0x0) 15:29:41 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) 15:29:41 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_ro(r0, &(0x7f00000001c0)='rdma.current\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000000200)={0x10}) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000300)="9f", 0x1) epoll_wait(r0, &(0x7f0000000100)=[{}, {}, {}, {}, {}, {}], 0x6, 0x0) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000000)) r2 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000080)={&(0x7f0000000180)='./file0\x00'}, 0x10) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000000c0)={r2, 0x0, 0x25, 0x8}, 0x10) 15:29:41 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xfffff, 0xe001) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r1, 0x40505412, &(0x7f00000000c0)={0x6, 0xffff, 0x1, 0x0, 0x12}) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) syz_open_dev$vcsa(&(0x7f0000000040), 0xfffff, 0xe001) (async) pipe2$watch_queue(&(0x7f0000000080), 0x80) (async) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r1, 0x40505412, &(0x7f00000000c0)={0x6, 0xffff, 0x1, 0x0, 0x12}) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) 15:29:41 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de81", 0x2) 15:29:41 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0xffffc, 0x500) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) syz_open_dev$vcsa(&(0x7f0000000080), 0xffffc, 0x500) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) 15:29:41 executing program 0: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)="de8138", 0xf85) 15:29:41 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) (async) 15:29:41 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_ro(r0, &(0x7f00000001c0)='rdma.current\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000000200)={0x10}) (async) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000300)="9f", 0x1) (async) epoll_wait(r0, &(0x7f0000000100)=[{}, {}, {}, {}, {}, {}], 0x6, 0x0) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000000)) r2 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000080)={&(0x7f0000000180)='./file0\x00'}, 0x10) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000000c0)={r2, 0x0, 0x25, 0x8}, 0x10) 15:29:41 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d96178", 0x1e) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:41 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de81", 0x2) 15:29:41 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000180), 0xffffc, 0xa841) syz_open_dev$vcsa(&(0x7f0000000080), 0x8, 0x20) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f00000000c0)={{0x3f, 0xc1}, 'port1\x00', 0x8, 0x0, 0xffffffff, 0x7fffffff, 0x2, 0x80000000, 0x8, 0x0, 0x1, 0x7}) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba3d462e54", 0x15) 15:29:41 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async, rerun: 64) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async, rerun: 64) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) 15:29:41 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0xffffc, 0x500) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) syz_open_dev$vcsa(&(0x7f0000000080), 0xffffc, 0x500) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) 15:29:41 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_ro(r0, &(0x7f00000001c0)='rdma.current\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000000200)={0x10}) (async) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000300)="9f", 0x1) (async) epoll_wait(r0, &(0x7f0000000100)=[{}, {}, {}, {}, {}, {}], 0x6, 0x0) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000000)) (async) r2 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000080)={&(0x7f0000000180)='./file0\x00'}, 0x10) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000000c0)={r2, 0x0, 0x25, 0x8}, 0x10) 15:29:41 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de81", 0x2) 15:29:41 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) read$qrtrtun(r0, &(0x7f0000000080)=""/173, 0xad) 15:29:41 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000180), 0xffffc, 0xa841) syz_open_dev$vcsa(&(0x7f0000000080), 0x8, 0x20) (async) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f00000000c0)={{0x3f, 0xc1}, 'port1\x00', 0x8, 0x0, 0xffffffff, 0x7fffffff, 0x2, 0x80000000, 0x8, 0x0, 0x1, 0x7}) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba3d462e54", 0x15) 15:29:41 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d96178", 0x1e) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:41 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r2) 15:29:41 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0xb8, 0x0, &(0x7f0000000340)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000140)={@ptr={0x70742a85, 0x1, &(0x7f0000000080)=""/177, 0xb1, 0x1, 0xa}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000000)={0x0, 0x28, 0x40}}}, @release={0x40046306, 0x3}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000200)={@flat=@handle={0x73682a85, 0x1, 0x3}, @fda={0x66646185, 0x8, 0x0, 0xe}, @fd={0x66642a85, 0x0, r2}}, &(0x7f0000000280)={0x0, 0x18, 0x38}}}, @request_death={0x400c630e, 0x2}, @acquire, @increfs={0x40046304, 0x2}], 0x67, 0x0, &(0x7f0000000400)="28a20b538a5cc811c1aa09f0f6f413d18f4a47e1cb86ecfb425ba38c97c0dadb02bd6678eb0b510a2ab3408673a390c97a4e76381290b5a6aef1a7a83ab131eb835da544ca37e44cc59e6ec686f36fe2e60bb495701ae23eccbfa6599c95bd304a16207624ebac"}) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:41 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (fail_nth: 1) 15:29:41 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000180), 0xffffc, 0xa841) (async) syz_open_dev$vcsa(&(0x7f0000000080), 0x8, 0x20) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f00000000c0)={{0x3f, 0xc1}, 'port1\x00', 0x8, 0x0, 0xffffffff, 0x7fffffff, 0x2, 0x80000000, 0x8, 0x0, 0x1, 0x7}) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba3d462e54", 0x15) 15:29:41 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) read$qrtrtun(r0, &(0x7f0000000080)=""/173, 0xad) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) read$qrtrtun(r0, &(0x7f0000000080)=""/173, 0xad) (async) 15:29:41 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (fail_nth: 2) 15:29:41 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r2) 15:29:41 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d96178", 0x1e) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:41 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0xb8, 0x0, &(0x7f0000000340)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000140)={@ptr={0x70742a85, 0x1, &(0x7f0000000080)=""/177, 0xb1, 0x1, 0xa}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000000)={0x0, 0x28, 0x40}}}, @release={0x40046306, 0x3}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000200)={@flat=@handle={0x73682a85, 0x1, 0x3}, @fda={0x66646185, 0x8, 0x0, 0xe}, @fd={0x66642a85, 0x0, r2}}, &(0x7f0000000280)={0x0, 0x18, 0x38}}}, @request_death={0x400c630e, 0x2}, @acquire, @increfs={0x40046304, 0x2}], 0x67, 0x0, &(0x7f0000000400)="28a20b538a5cc811c1aa09f0f6f413d18f4a47e1cb86ecfb425ba38c97c0dadb02bd6678eb0b510a2ab3408673a390c97a4e76381290b5a6aef1a7a83ab131eb835da544ca37e44cc59e6ec686f36fe2e60bb495701ae23eccbfa6599c95bd304a16207624ebac"}) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:41 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) read$qrtrtun(r0, &(0x7f0000000080)=""/173, 0xad) [ 3274.453417][T21434] FAULT_INJECTION: forcing a failure. [ 3274.453417][T21434] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 3274.466748][T21434] CPU: 0 PID: 21434 Comm: syz-executor.5 Not tainted 5.19.0-syzkaller-dirty #0 [ 3274.466771][T21434] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 [ 3274.466782][T21434] Call Trace: [ 3274.466788][T21434] [ 3274.466794][T21434] dump_stack_lvl+0xd6/0x122 [ 3274.466818][T21434] dump_stack+0x11/0x12 [ 3274.466853][T21434] should_fail+0x242/0x250 [ 3274.466873][T21434] should_fail_usercopy+0x16/0x20 [ 3274.466889][T21434] _copy_from_user+0x1a/0xc0 [ 3274.466907][T21434] vcs_write+0x38b/0xc20 [ 3274.466927][T21434] ? avc_policy_seqno+0x22/0x30 [ 3274.466943][T21434] ? selinux_file_permission+0x223/0x350 [ 3274.467029][T21434] ? fsnotify_perm+0x5a/0x370 [ 3274.467126][T21434] ? vcs_read+0xae0/0xae0 [ 3274.467187][T21434] vfs_write+0x26d/0x890 [ 3274.467206][T21434] ? __fget_files+0x1a7/0x1e0 15:29:41 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0x410081) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:41 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000080)="0070188269010000000000000080000000d1", 0x12) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:41 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r2) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r2) (async) 15:29:41 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0x410081) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0x410081) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) [ 3274.467225][T21434] ksys_write+0xe8/0x1a0 [ 3274.554488][T21434] __x64_sys_write+0x3e/0x50 [ 3274.554584][T21434] do_syscall_64+0x2b/0x70 [ 3274.554607][T21434] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 3274.554631][T21434] RIP: 0033:0x7f438e8be209 [ 3274.554648][T21434] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 3274.554677][T21434] RSP: 002b:00007f438e034168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 15:29:41 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0x410081) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:41 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0xb8, 0x0, &(0x7f0000000340)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000140)={@ptr={0x70742a85, 0x1, &(0x7f0000000080)=""/177, 0xb1, 0x1, 0xa}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000000)={0x0, 0x28, 0x40}}}, @release={0x40046306, 0x3}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000200)={@flat=@handle={0x73682a85, 0x1, 0x3}, @fda={0x66646185, 0x8, 0x0, 0xe}, @fd={0x66642a85, 0x0, r2}}, &(0x7f0000000280)={0x0, 0x18, 0x38}}}, @request_death={0x400c630e, 0x2}, @acquire, @increfs={0x40046304, 0x2}], 0x67, 0x0, &(0x7f0000000400)="28a20b538a5cc811c1aa09f0f6f413d18f4a47e1cb86ecfb425ba38c97c0dadb02bd6678eb0b510a2ab3408673a390c97a4e76381290b5a6aef1a7a83ab131eb835da544ca37e44cc59e6ec686f36fe2e60bb495701ae23eccbfa6599c95bd304a16207624ebac"}) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) (async) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0xb8, 0x0, &(0x7f0000000340)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000140)={@ptr={0x70742a85, 0x1, &(0x7f0000000080)=""/177, 0xb1, 0x1, 0xa}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000000)={0x0, 0x28, 0x40}}}, @release={0x40046306, 0x3}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000200)={@flat=@handle={0x73682a85, 0x1, 0x3}, @fda={0x66646185, 0x8, 0x0, 0xe}, @fd={0x66642a85, 0x0, r2}}, &(0x7f0000000280)={0x0, 0x18, 0x38}}}, @request_death={0x400c630e, 0x2}, @acquire, @increfs={0x40046304, 0x2}], 0x67, 0x0, &(0x7f0000000400)="28a20b538a5cc811c1aa09f0f6f413d18f4a47e1cb86ecfb425ba38c97c0dadb02bd6678eb0b510a2ab3408673a390c97a4e76381290b5a6aef1a7a83ab131eb835da544ca37e44cc59e6ec686f36fe2e60bb495701ae23eccbfa6599c95bd304a16207624ebac"}) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) 15:29:41 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x100000001, 0x0) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_MCAST_REPLICAST(r1, 0x10f, 0x86) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x11000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000680)=ANY=[@ANYBLOB="480000001e1af82f3394921dd76333d17bb54759748c67c743992a996b341d5cc98fe1ac1e39536e0942b9b779d4136bf96659ef44c35f3830ea643519917a1a8b19b9aa339fa126e9d12bcb70d77fa860782cdd93c41a4b37", @ANYRES16=0x0, @ANYBLOB="020028bd7000fedbdf2504000000050012000800000005000d0001000000050005000000000014002000fc02b46ea1e69fa0036eb02b0c9cba0000000000", @ANYRES32, @ANYBLOB], 0x48}, 0x1, 0x0, 0x0, 0x40000}, 0x4000000) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) recvmsg$can_raw(r2, &(0x7f0000000280)={&(0x7f0000000100)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000180)=""/49, 0x31}, {&(0x7f00000001c0)=""/28, 0x1c}], 0x2, &(0x7f0000000240)=""/18, 0x12}, 0x2001) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000440), 0xffffffffffffffff) socketpair(0x1e, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$TIPC_MCAST_REPLICAST(r4, 0x10f, 0x86) sendmsg$L2TP_CMD_NOOP(r0, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x2c, r3, 0x20, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000010}, 0x80) r5 = syz_open_dev$vcsa(&(0x7f0000000580), 0x3, 0xc0) bind$tipc(r5, &(0x7f00000005c0)=@nameseq={0x1e, 0x1, 0x3, {0x0, 0x3, 0x4}}, 0x10) getsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000080), &(0x7f00000000c0)=0x4) pipe2$watch_queue(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) inotify_add_watch(r6, &(0x7f0000000640)='./file0\x00', 0x2000220) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:41 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (fail_nth: 3) 15:29:41 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x28, 0x0, 0x400, 0x70bd25, 0x25dfdbff, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'veth0_to_bridge\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x200040c0}, 0x4000) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:41 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (fail_nth: 1) 15:29:41 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000080)="0070188269010000000000000080000000d1", 0x12) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:41 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="9f", 0x1) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) request_key(&(0x7f0000000240)='.dead\x00', &(0x7f0000000180)={'syz', 0x0}, &(0x7f0000000280)='/dev/vcsa#\x00\x80l[G&x\x1a \x9a\xaf\x0e~;A\xaf\x0e\xcd\x8c\x87FX\xf7p\xcb\xe5\x1b\xb3\x18{\xdf\x86\x93H\x06n\xd6M\xe8tz\xeeA\xd3dQ\x9cyVj\x94\xe4\xa7h\xa3F\xa5u[s\xa9\xe4q\x19\xea\xe9\x9fUs\xf8\xbe\x13\x18\x90\f\xd0\xd0\xe8\xf173\xe2\xb1s.5F\v\xb9r\x84\xea}\xea~f\xfd\x80\xa8p~\x05<\x9b\xef\x01x\x98\x03\xf5\xa34ALY\xc7\xda\x94/\xda#\f\x8a\x06\xc6\xae\xd5\x8e|\xac\x8e1\xe9T\x1b\xe7\x8d\xfd\xa9\x82R\x9e\xe5\xbc\xb1\xd2\x9b4>Ob\x1fA#\x93r', 0xfffffffffffffff8) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000100)={r1, 0x20, 0x0, 0x8001, &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x7}, 0x20) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000200)={r0, r1, 0x10}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) openat$cgroup_pressure(r2, &(0x7f00000003c0)='cpu.pressure\x00', 0x2, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r3, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) sendmsg$TIPC_CMD_SET_NETID(r3, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000340)={&(0x7f00000001c0)={0x24, 0x0, 0x0, 0x70bd2d, 0x25dfdbff, {{}, {}, {0x8, 0x2, 0x6}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4000050}, 0x41) 15:29:41 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x100000001, 0x0) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_MCAST_REPLICAST(r1, 0x10f, 0x86) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x11000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000680)=ANY=[@ANYBLOB="480000001e1af82f3394921dd76333d17bb54759748c67c743992a996b341d5cc98fe1ac1e39536e0942b9b779d4136bf96659ef44c35f3830ea643519917a1a8b19b9aa339fa126e9d12bcb70d77fa860782cdd93c41a4b37", @ANYRES16=0x0, @ANYBLOB="020028bd7000fedbdf2504000000050012000800000005000d0001000000050005000000000014002000fc02b46ea1e69fa0036eb02b0c9cba0000000000", @ANYRES32, @ANYBLOB], 0x48}, 0x1, 0x0, 0x0, 0x40000}, 0x4000000) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) recvmsg$can_raw(r2, &(0x7f0000000280)={&(0x7f0000000100)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000180)=""/49, 0x31}, {&(0x7f00000001c0)=""/28, 0x1c}], 0x2, &(0x7f0000000240)=""/18, 0x12}, 0x2001) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000440), 0xffffffffffffffff) socketpair(0x1e, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$TIPC_MCAST_REPLICAST(r4, 0x10f, 0x86) sendmsg$L2TP_CMD_NOOP(r0, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x2c, r3, 0x20, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000010}, 0x80) r5 = syz_open_dev$vcsa(&(0x7f0000000580), 0x3, 0xc0) bind$tipc(r5, &(0x7f00000005c0)=@nameseq={0x1e, 0x1, 0x3, {0x0, 0x3, 0x4}}, 0x10) getsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000080), &(0x7f00000000c0)=0x4) pipe2$watch_queue(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) inotify_add_watch(r6, &(0x7f0000000640)='./file0\x00', 0x2000220) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) syz_open_dev$vcsa(&(0x7f0000000040), 0x100000001, 0x0) (async) socket$tipc(0x1e, 0x5, 0x0) (async) setsockopt$TIPC_MCAST_REPLICAST(r1, 0x10f, 0x86) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x11000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000680)=ANY=[@ANYBLOB="480000001e1af82f3394921dd76333d17bb54759748c67c743992a996b341d5cc98fe1ac1e39536e0942b9b779d4136bf96659ef44c35f3830ea643519917a1a8b19b9aa339fa126e9d12bcb70d77fa860782cdd93c41a4b37", @ANYRES16=0x0, @ANYBLOB="020028bd7000fedbdf2504000000050012000800000005000d0001000000050005000000000014002000fc02b46ea1e69fa0036eb02b0c9cba0000000000", @ANYRES32, @ANYBLOB], 0x48}, 0x1, 0x0, 0x0, 0x40000}, 0x4000000) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) (async) recvmsg$can_raw(r2, &(0x7f0000000280)={&(0x7f0000000100)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000180)=""/49, 0x31}, {&(0x7f00000001c0)=""/28, 0x1c}], 0x2, &(0x7f0000000240)=""/18, 0x12}, 0x2001) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000440), 0xffffffffffffffff) (async) socketpair(0x1e, 0x2, 0x0, &(0x7f0000000540)) (async) setsockopt$TIPC_MCAST_REPLICAST(r4, 0x10f, 0x86) (async) sendmsg$L2TP_CMD_NOOP(r0, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x2c, r3, 0x20, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000010}, 0x80) (async) syz_open_dev$vcsa(&(0x7f0000000580), 0x3, 0xc0) (async) bind$tipc(r5, &(0x7f00000005c0)=@nameseq={0x1e, 0x1, 0x3, {0x0, 0x3, 0x4}}, 0x10) (async) getsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000080), &(0x7f00000000c0)=0x4) (async) pipe2$watch_queue(&(0x7f0000000600), 0x80) (async) inotify_add_watch(r6, &(0x7f0000000640)='./file0\x00', 0x2000220) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) 15:29:41 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (fail_nth: 2) [ 3274.554750][T21434] RAX: ffffffffffffffda RBX: 00007f438e9d0f60 RCX: 00007f438e8be209 [ 3274.610121][T21434] RDX: 0000000000000f85 RSI: 0000000020000000 RDI: 0000000000000003 [ 3274.610136][T21434] RBP: 00007f438e0341d0 R08: 0000000000000000 R09: 0000000000000000 [ 3274.610148][T21434] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3274.610160][T21434] R13: 00007ffd4feedd1f R14: 00007f438e034300 R15: 0000000000022000 [ 3274.610176][T21434] 15:29:41 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x28, 0x0, 0x400, 0x70bd25, 0x25dfdbff, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'veth0_to_bridge\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x200040c0}, 0x4000) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:41 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="9f", 0x1) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) request_key(&(0x7f0000000240)='.dead\x00', &(0x7f0000000180)={'syz', 0x0}, &(0x7f0000000280)='/dev/vcsa#\x00\x80l[G&x\x1a \x9a\xaf\x0e~;A\xaf\x0e\xcd\x8c\x87FX\xf7p\xcb\xe5\x1b\xb3\x18{\xdf\x86\x93H\x06n\xd6M\xe8tz\xeeA\xd3dQ\x9cyVj\x94\xe4\xa7h\xa3F\xa5u[s\xa9\xe4q\x19\xea\xe9\x9fUs\xf8\xbe\x13\x18\x90\f\xd0\xd0\xe8\xf173\xe2\xb1s.5F\v\xb9r\x84\xea}\xea~f\xfd\x80\xa8p~\x05<\x9b\xef\x01x\x98\x03\xf5\xa34ALY\xc7\xda\x94/\xda#\f\x8a\x06\xc6\xae\xd5\x8e|\xac\x8e1\xe9T\x1b\xe7\x8d\xfd\xa9\x82R\x9e\xe5\xbc\xb1\xd2\x9b4>Ob\x1fA#\x93r', 0xfffffffffffffff8) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000100)={r1, 0x20, 0x0, 0x8001, &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x7}, 0x20) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000200)={r0, r1, 0x10}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) openat$cgroup_pressure(r2, &(0x7f00000003c0)='cpu.pressure\x00', 0x2, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r3, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) sendmsg$TIPC_CMD_SET_NETID(r3, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000340)={&(0x7f00000001c0)={0x24, 0x0, 0x0, 0x70bd2d, 0x25dfdbff, {{}, {}, {0x8, 0x2, 0x6}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4000050}, 0x41) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000000)="9f", 0x1) (async) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) (async) request_key(&(0x7f0000000240)='.dead\x00', &(0x7f0000000180)={'syz', 0x0}, &(0x7f0000000280)='/dev/vcsa#\x00\x80l[G&x\x1a \x9a\xaf\x0e~;A\xaf\x0e\xcd\x8c\x87FX\xf7p\xcb\xe5\x1b\xb3\x18{\xdf\x86\x93H\x06n\xd6M\xe8tz\xeeA\xd3dQ\x9cyVj\x94\xe4\xa7h\xa3F\xa5u[s\xa9\xe4q\x19\xea\xe9\x9fUs\xf8\xbe\x13\x18\x90\f\xd0\xd0\xe8\xf173\xe2\xb1s.5F\v\xb9r\x84\xea}\xea~f\xfd\x80\xa8p~\x05<\x9b\xef\x01x\x98\x03\xf5\xa34ALY\xc7\xda\x94/\xda#\f\x8a\x06\xc6\xae\xd5\x8e|\xac\x8e1\xe9T\x1b\xe7\x8d\xfd\xa9\x82R\x9e\xe5\xbc\xb1\xd2\x9b4>Ob\x1fA#\x93r', 0xfffffffffffffff8) (async) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000100)={r1, 0x20, 0x0, 0x8001, &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x7}, 0x20) (async) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000200)={r0, r1, 0x10}, 0x10) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) (async) openat$cgroup_pressure(r2, &(0x7f00000003c0)='cpu.pressure\x00', 0x2, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$TIPC_CMD_SET_NETID(r3, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) sendmsg$TIPC_CMD_SET_NETID(r3, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000340)={&(0x7f00000001c0)={0x24, 0x0, 0x0, 0x70bd2d, 0x25dfdbff, {{}, {}, {0x8, 0x2, 0x6}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4000050}, 0x41) (async) 15:29:41 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000080)="0070188269010000000000000080000000d1", 0x12) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:41 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x100000001, 0x0) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_MCAST_REPLICAST(r1, 0x10f, 0x86) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x11000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000680)=ANY=[@ANYBLOB="480000001e1af82f3394921dd76333d17bb54759748c67c743992a996b341d5cc98fe1ac1e39536e0942b9b779d4136bf96659ef44c35f3830ea643519917a1a8b19b9aa339fa126e9d12bcb70d77fa860782cdd93c41a4b37", @ANYRES16=0x0, @ANYBLOB="020028bd7000fedbdf2504000000050012000800000005000d0001000000050005000000000014002000fc02b46ea1e69fa0036eb02b0c9cba0000000000", @ANYRES32, @ANYBLOB], 0x48}, 0x1, 0x0, 0x0, 0x40000}, 0x4000000) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) recvmsg$can_raw(r2, &(0x7f0000000280)={&(0x7f0000000100)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000180)=""/49, 0x31}, {&(0x7f00000001c0)=""/28, 0x1c}], 0x2, &(0x7f0000000240)=""/18, 0x12}, 0x2001) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000440), 0xffffffffffffffff) socketpair(0x1e, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$TIPC_MCAST_REPLICAST(r4, 0x10f, 0x86) sendmsg$L2TP_CMD_NOOP(r0, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x2c, r3, 0x20, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000010}, 0x80) r5 = syz_open_dev$vcsa(&(0x7f0000000580), 0x3, 0xc0) bind$tipc(r5, &(0x7f00000005c0)=@nameseq={0x1e, 0x1, 0x3, {0x0, 0x3, 0x4}}, 0x10) getsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000080), &(0x7f00000000c0)=0x4) pipe2$watch_queue(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) inotify_add_watch(r6, &(0x7f0000000640)='./file0\x00', 0x2000220) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) syz_open_dev$vcsa(&(0x7f0000000040), 0x100000001, 0x0) (async) socket$tipc(0x1e, 0x5, 0x0) (async) setsockopt$TIPC_MCAST_REPLICAST(r1, 0x10f, 0x86) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x11000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000680)=ANY=[@ANYBLOB="480000001e1af82f3394921dd76333d17bb54759748c67c743992a996b341d5cc98fe1ac1e39536e0942b9b779d4136bf96659ef44c35f3830ea643519917a1a8b19b9aa339fa126e9d12bcb70d77fa860782cdd93c41a4b37", @ANYRES16=0x0, @ANYBLOB="020028bd7000fedbdf2504000000050012000800000005000d0001000000050005000000000014002000fc02b46ea1e69fa0036eb02b0c9cba0000000000", @ANYRES32, @ANYBLOB], 0x48}, 0x1, 0x0, 0x0, 0x40000}, 0x4000000) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) (async) recvmsg$can_raw(r2, &(0x7f0000000280)={&(0x7f0000000100)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000180)=""/49, 0x31}, {&(0x7f00000001c0)=""/28, 0x1c}], 0x2, &(0x7f0000000240)=""/18, 0x12}, 0x2001) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000440), 0xffffffffffffffff) (async) socketpair(0x1e, 0x2, 0x0, &(0x7f0000000540)) (async) setsockopt$TIPC_MCAST_REPLICAST(r4, 0x10f, 0x86) (async) sendmsg$L2TP_CMD_NOOP(r0, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x2c, r3, 0x20, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000010}, 0x80) (async) syz_open_dev$vcsa(&(0x7f0000000580), 0x3, 0xc0) (async) bind$tipc(r5, &(0x7f00000005c0)=@nameseq={0x1e, 0x1, 0x3, {0x0, 0x3, 0x4}}, 0x10) (async) getsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000080), &(0x7f00000000c0)=0x4) (async) pipe2$watch_queue(&(0x7f0000000600), 0x80) (async) inotify_add_watch(r6, &(0x7f0000000640)='./file0\x00', 0x2000220) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) 15:29:41 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x28, 0x0, 0x400, 0x70bd25, 0x25dfdbff, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'veth0_to_bridge\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x200040c0}, 0x4000) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) [ 3274.702085][T21511] FAULT_INJECTION: forcing a failure. [ 3274.702085][T21511] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 3274.715181][T21511] CPU: 0 PID: 21511 Comm: syz-executor.5 Not tainted 5.19.0-syzkaller-dirty #0 [ 3274.715218][T21511] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 [ 3274.734305][T21511] Call Trace: 15:29:41 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:41 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) pipe2$watch_queue(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x68, 0x0, 0x400, 0x70bd2a, 0x25dfdbfe, {{}, {}, {0x4c, 0x18, {0x33, @link='syz0\x00'}}}, ["", "", "", "", "", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x801}, 0x10) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r2) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r3, &(0x7f0000000880)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x14, 0x0, 0x4}, 0x14}}, 0x0) sendmsg$NLBL_CIPSOV4_C_LIST(r3, &(0x7f0000000780)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000740)={&(0x7f00000003c0)={0x35c, 0x0, 0x2, 0x70bd26, 0x25dfdbfd, {}, [@NLBL_CIPSOV4_A_TAGLST={0x34, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x5}, {0x5, 0x3, 0x6}, {0x5, 0x3, 0x7}, {0x5}, {0x5, 0x3, 0x2}, {0x5}]}, @NLBL_CIPSOV4_A_MLSCATLST={0x108, 0xc, 0x0, 0x1, [{0xc, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x772486fa}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xd7de}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x7aeb}]}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x241c5463}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xca59}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x1ae3}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x2bf304aa}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x38a4}]}, {0x4}, {0x34, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x60a9352}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x4b2beebf}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x39c254f1}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x506}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xbd39}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x206}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x21ab854}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5fcca0a0}]}, {0x54, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xcdba}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x52ac7ddb}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xb5d}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x539a7f26}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x149d}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x40ddd90e}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x31231455}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x651e41fb}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x72c31445}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x70f083d2}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xf45e}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x62fdfd1a}]}]}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5}]}, @NLBL_CIPSOV4_A_MLSLVLLST={0x70, 0x8, 0x0, 0x1, [{0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x25}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x3f416a8b}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x68e7ac18}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7c7ff1ae}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x6ca6c7f3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x3354784d}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdd}]}, {0x24, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5363f159}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x30}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x94}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4b1ced2d}]}]}, @NLBL_CIPSOV4_A_MLSCATLST={0x28, 0xc, 0x0, 0x1, [{0x24, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x5b76}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x1120307d}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xa6d}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x7f8d}]}]}, @NLBL_CIPSOV4_A_MLSLVLLST={0x10, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x377e6c8f}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0x4c, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x6}, {0x5, 0x3, 0x6}, {0x5, 0x3, 0x5}, {0x5, 0x3, 0x1}, {0x5, 0x3, 0x5}, {0x5, 0x3, 0x3}, {0x5}, {0x5}, {0x5, 0x3, 0x5}]}, @NLBL_CIPSOV4_A_MLSCATLST={0x104, 0xc, 0x0, 0x1, [{0x44, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5b7ff79e}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x67d9fded}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x54781386}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x1ebd980f}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0xd3e391f}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x64e274d4}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x7023}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x4aec}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xe5bd}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x38d4}]}, {0x24, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x182e0277}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x2f1e581a}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x8607}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x54ea}]}, {0x24, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xf00c}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xaa5f}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x402c43b4}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x5298}]}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x3cbe6c9e}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x3552e80c}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x1514}]}, {0x44, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x217f5a57}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5657a11c}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xaa86}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x5741}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7d732cad}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x157}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xd19f}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xbf7f}]}]}]}, 0x35c}}, 0x10) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) r4 = syz_open_dev$vcsa(&(0x7f00000000c0), 0x7, 0x4100) ioctl$SNDRV_TIMER_IOCTL_GINFO(r4, 0xc0f85403, &(0x7f0000000100)={{0x3, 0x1, 0x1, 0x2, 0x3ff}, 0x4, 0x3, 'id0\x00', 'timer1\x00', 0x0, 0x6, 0x10000, 0x101, 0x100}) [ 3274.734312][T21511] [ 3274.734318][T21511] dump_stack_lvl+0xd6/0x122 [ 3274.734409][T21511] dump_stack+0x11/0x12 [ 3274.734432][T21511] should_fail+0x242/0x250 [ 3274.734516][T21511] should_fail_usercopy+0x16/0x20 [ 3274.734533][T21511] _copy_to_user+0x1a/0x90 [ 3274.734550][T21511] simple_read_from_buffer+0xab/0x120 [ 3274.734569][T21511] proc_fail_nth_read+0x10d/0x150 [ 3274.734590][T21511] ? proc_fault_inject_write+0x230/0x230 [ 3274.734642][T21511] vfs_read+0x1a1/0x6a0 [ 3274.734660][T21511] ? __fget_files+0x1a7/0x1e0 [ 3274.734680][T21511] ksys_read+0xe8/0x1a0 [ 3274.734699][T21511] __x64_sys_read+0x3e/0x50 [ 3274.734740][T21511] do_syscall_64+0x2b/0x70 [ 3274.734761][T21511] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 3274.734783][T21511] RIP: 0033:0x7f438e870dbc [ 3274.734797][T21511] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 [ 3274.734858][T21511] RSP: 002b:00007f438e034160 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 3274.734876][T21511] RAX: ffffffffffffffda RBX: 00007f438e9d0f60 RCX: 00007f438e870dbc [ 3274.734964][T21511] RDX: 000000000000000f RSI: 00007f438e0341e0 RDI: 0000000000000004 [ 3274.734976][T21511] RBP: 00007f438e0341d0 R08: 0000000000000000 R09: 0000000000000000 [ 3274.734989][T21511] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 15:29:41 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0xffffc, 0x0) socketpair(0x29, 0x3, 0x8, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$TIPC_CMD_RESET_LINK_STATS(r2, &(0x7f0000000280)={&(0x7f00000001c0), 0xc, &(0x7f0000000240)={&(0x7f0000000380)=ANY=[@ANYBLOB="734d218c4de1b7582e0bbb44c3a1a6ea707df1abd6b551d715b61a5ab8", @ANYRES16=0x0, @ANYBLOB="00012abd7000fddbdf2501000000000000000c410000000c001473797a3100000000"], 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0x45a0195cd333733e) getsockopt$PNPIPE_IFINDEX(r1, 0x113, 0x2, &(0x7f00000002c0), &(0x7f0000000340)=0x4) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000080)="8053800e394c7fba1974780e88b13491ecd6df6dc980bb", 0x17) syz_io_uring_setup(0x754d, &(0x7f00000000c0)={0x0, 0xd847, 0x10, 0x2, 0x290, 0x0, r0}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000040), &(0x7f0000000140)) 15:29:41 executing program 2: select(0x40, &(0x7f0000000080)={0xd9, 0x4, 0x95c, 0x6, 0x0, 0x3, 0x6, 0xd2}, &(0x7f00000000c0)={0x1, 0x80000001, 0x0, 0x3, 0x10001, 0x1, 0x7fffffff, 0x7}, &(0x7f0000000100)={0x81, 0x6b0586a2, 0x8, 0x80000000, 0x6, 0x10001, 0xf3f, 0x8001}, &(0x7f0000000140)={0x0, 0x2710}) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:41 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) pipe2$watch_queue(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x68, 0x0, 0x400, 0x70bd2a, 0x25dfdbfe, {{}, {}, {0x4c, 0x18, {0x33, @link='syz0\x00'}}}, ["", "", "", "", "", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x801}, 0x10) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r2) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r3, &(0x7f0000000880)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x14, 0x0, 0x4}, 0x14}}, 0x0) sendmsg$NLBL_CIPSOV4_C_LIST(r3, &(0x7f0000000780)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000740)={&(0x7f00000003c0)={0x35c, 0x0, 0x2, 0x70bd26, 0x25dfdbfd, {}, [@NLBL_CIPSOV4_A_TAGLST={0x34, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x5}, {0x5, 0x3, 0x6}, {0x5, 0x3, 0x7}, {0x5}, {0x5, 0x3, 0x2}, {0x5}]}, @NLBL_CIPSOV4_A_MLSCATLST={0x108, 0xc, 0x0, 0x1, [{0xc, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x772486fa}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xd7de}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x7aeb}]}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x241c5463}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xca59}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x1ae3}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x2bf304aa}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x38a4}]}, {0x4}, {0x34, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x60a9352}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x4b2beebf}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x39c254f1}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x506}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xbd39}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x206}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x21ab854}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5fcca0a0}]}, {0x54, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xcdba}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x52ac7ddb}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xb5d}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x539a7f26}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x149d}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x40ddd90e}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x31231455}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x651e41fb}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x72c31445}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x70f083d2}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xf45e}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x62fdfd1a}]}]}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5}]}, @NLBL_CIPSOV4_A_MLSLVLLST={0x70, 0x8, 0x0, 0x1, [{0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x25}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x3f416a8b}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x68e7ac18}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7c7ff1ae}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x6ca6c7f3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x3354784d}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdd}]}, {0x24, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5363f159}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x30}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x94}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4b1ced2d}]}]}, @NLBL_CIPSOV4_A_MLSCATLST={0x28, 0xc, 0x0, 0x1, [{0x24, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x5b76}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x1120307d}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xa6d}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x7f8d}]}]}, @NLBL_CIPSOV4_A_MLSLVLLST={0x10, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x377e6c8f}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0x4c, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x6}, {0x5, 0x3, 0x6}, {0x5, 0x3, 0x5}, {0x5, 0x3, 0x1}, {0x5, 0x3, 0x5}, {0x5, 0x3, 0x3}, {0x5}, {0x5}, {0x5, 0x3, 0x5}]}, @NLBL_CIPSOV4_A_MLSCATLST={0x104, 0xc, 0x0, 0x1, [{0x44, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5b7ff79e}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x67d9fded}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x54781386}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x1ebd980f}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0xd3e391f}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x64e274d4}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x7023}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x4aec}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xe5bd}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x38d4}]}, {0x24, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x182e0277}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x2f1e581a}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x8607}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x54ea}]}, {0x24, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xf00c}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xaa5f}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x402c43b4}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x5298}]}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x3cbe6c9e}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x3552e80c}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x1514}]}, {0x44, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x217f5a57}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5657a11c}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xaa86}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x5741}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7d732cad}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x157}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xd19f}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xbf7f}]}]}]}, 0x35c}}, 0x10) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) r4 = syz_open_dev$vcsa(&(0x7f00000000c0), 0x7, 0x4100) ioctl$SNDRV_TIMER_IOCTL_GINFO(r4, 0xc0f85403, &(0x7f0000000100)={{0x3, 0x1, 0x1, 0x2, 0x3ff}, 0x4, 0x3, 'id0\x00', 'timer1\x00', 0x0, 0x6, 0x10000, 0x101, 0x100}) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) pipe2$watch_queue(&(0x7f0000000200), 0x80) (async) sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x68, 0x0, 0x400, 0x70bd2a, 0x25dfdbfe, {{}, {}, {0x4c, 0x18, {0x33, @link='syz0\x00'}}}, ["", "", "", "", "", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x801}, 0x10) (async) pipe2$watch_queue(&(0x7f0000000080), 0x80) (async) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r2) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r3, &(0x7f0000000880)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x14, 0x0, 0x4}, 0x14}}, 0x0) (async) sendmsg$NLBL_CIPSOV4_C_LIST(r3, &(0x7f0000000780)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000740)={&(0x7f00000003c0)={0x35c, 0x0, 0x2, 0x70bd26, 0x25dfdbfd, {}, [@NLBL_CIPSOV4_A_TAGLST={0x34, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x5}, {0x5, 0x3, 0x6}, {0x5, 0x3, 0x7}, {0x5}, {0x5, 0x3, 0x2}, {0x5}]}, @NLBL_CIPSOV4_A_MLSCATLST={0x108, 0xc, 0x0, 0x1, [{0xc, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x772486fa}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xd7de}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x7aeb}]}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x241c5463}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xca59}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x1ae3}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x2bf304aa}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x38a4}]}, {0x4}, {0x34, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x60a9352}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x4b2beebf}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x39c254f1}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x506}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xbd39}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x206}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x21ab854}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5fcca0a0}]}, {0x54, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xcdba}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x52ac7ddb}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xb5d}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x539a7f26}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x149d}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x40ddd90e}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x31231455}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x651e41fb}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x72c31445}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x70f083d2}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xf45e}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x62fdfd1a}]}]}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5}]}, @NLBL_CIPSOV4_A_MLSLVLLST={0x70, 0x8, 0x0, 0x1, [{0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x25}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x3f416a8b}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x68e7ac18}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7c7ff1ae}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x6ca6c7f3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x3354784d}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdd}]}, {0x24, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5363f159}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x30}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x94}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4b1ced2d}]}]}, @NLBL_CIPSOV4_A_MLSCATLST={0x28, 0xc, 0x0, 0x1, [{0x24, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x5b76}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x1120307d}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xa6d}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x7f8d}]}]}, @NLBL_CIPSOV4_A_MLSLVLLST={0x10, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x377e6c8f}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0x4c, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x6}, {0x5, 0x3, 0x6}, {0x5, 0x3, 0x5}, {0x5, 0x3, 0x1}, {0x5, 0x3, 0x5}, {0x5, 0x3, 0x3}, {0x5}, {0x5}, {0x5, 0x3, 0x5}]}, @NLBL_CIPSOV4_A_MLSCATLST={0x104, 0xc, 0x0, 0x1, [{0x44, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5b7ff79e}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x67d9fded}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x54781386}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x1ebd980f}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0xd3e391f}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x64e274d4}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x7023}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x4aec}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xe5bd}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x38d4}]}, {0x24, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x182e0277}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x2f1e581a}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x8607}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x54ea}]}, {0x24, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xf00c}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xaa5f}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x402c43b4}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x5298}]}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x3cbe6c9e}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x3552e80c}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x1514}]}, {0x44, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x217f5a57}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5657a11c}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xaa86}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x5741}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7d732cad}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x157}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xd19f}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xbf7f}]}]}]}, 0x35c}}, 0x10) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) syz_open_dev$vcsa(&(0x7f00000000c0), 0x7, 0x4100) (async) ioctl$SNDRV_TIMER_IOCTL_GINFO(r4, 0xc0f85403, &(0x7f0000000100)={{0x3, 0x1, 0x1, 0x2, 0x3ff}, 0x4, 0x3, 'id0\x00', 'timer1\x00', 0x0, 0x6, 0x10000, 0x101, 0x100}) (async) [ 3274.735002][T21511] R13: 00007ffd4feedd1f R14: 00007f438e034300 R15: 0000000000022000 [ 3274.735017][T21511] [ 3274.909866][T21542] FAULT_INJECTION: forcing a failure. [ 3274.909866][T21542] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 3274.909903][T21542] CPU: 0 PID: 21542 Comm: syz-executor.0 Not tainted 5.19.0-syzkaller-dirty #0 [ 3274.909927][T21542] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 [ 3274.909939][T21542] Call Trace: [ 3274.909946][T21542] [ 3274.909953][T21542] dump_stack_lvl+0xd6/0x122 [ 3274.910029][T21542] dump_stack+0x11/0x12 [ 3274.910049][T21542] should_fail+0x242/0x250 [ 3274.910125][T21542] should_fail_usercopy+0x16/0x20 [ 3274.910144][T21542] _copy_from_user+0x1a/0xc0 [ 3274.910277][T21542] vcs_write+0x38b/0xc20 [ 3274.910372][T21542] ? avc_policy_seqno+0x22/0x30 [ 3274.910460][T21542] ? selinux_file_permission+0x223/0x350 [ 3274.910483][T21542] ? fsnotify_perm+0x5a/0x370 [ 3274.910586][T21542] ? vcs_read+0xae0/0xae0 [ 3274.910624][T21542] vfs_write+0x26d/0x890 [ 3274.910644][T21542] ? __fget_files+0x1a7/0x1e0 [ 3274.910665][T21542] ksys_write+0xe8/0x1a0 [ 3274.910709][T21542] __x64_sys_write+0x3e/0x50 [ 3274.910728][T21542] do_syscall_64+0x2b/0x70 [ 3274.910751][T21542] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 3274.910804][T21542] RIP: 0033:0x7fb0e9561209 [ 3274.910821][T21542] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 3274.910839][T21542] RSP: 002b:00007fb0e8cb6168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 3274.910859][T21542] RAX: ffffffffffffffda RBX: 00007fb0e9674030 RCX: 00007fb0e9561209 [ 3274.910873][T21542] RDX: 0000000000000f85 RSI: 0000000020000000 RDI: 0000000000000003 [ 3274.910933][T21542] RBP: 00007fb0e8cb61d0 R08: 0000000000000000 R09: 0000000000000000 [ 3274.910977][T21542] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 15:29:41 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="9f", 0x1) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) (async) request_key(&(0x7f0000000240)='.dead\x00', &(0x7f0000000180)={'syz', 0x0}, &(0x7f0000000280)='/dev/vcsa#\x00\x80l[G&x\x1a \x9a\xaf\x0e~;A\xaf\x0e\xcd\x8c\x87FX\xf7p\xcb\xe5\x1b\xb3\x18{\xdf\x86\x93H\x06n\xd6M\xe8tz\xeeA\xd3dQ\x9cyVj\x94\xe4\xa7h\xa3F\xa5u[s\xa9\xe4q\x19\xea\xe9\x9fUs\xf8\xbe\x13\x18\x90\f\xd0\xd0\xe8\xf173\xe2\xb1s.5F\v\xb9r\x84\xea}\xea~f\xfd\x80\xa8p~\x05<\x9b\xef\x01x\x98\x03\xf5\xa34ALY\xc7\xda\x94/\xda#\f\x8a\x06\xc6\xae\xd5\x8e|\xac\x8e1\xe9T\x1b\xe7\x8d\xfd\xa9\x82R\x9e\xe5\xbc\xb1\xd2\x9b4>Ob\x1fA#\x93r', 0xfffffffffffffff8) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000100)={r1, 0x20, 0x0, 0x8001, &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x7}, 0x20) (async) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000200)={r0, r1, 0x10}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) (async) openat$cgroup_pressure(r2, &(0x7f00000003c0)='cpu.pressure\x00', 0x2, 0x0) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r3, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) sendmsg$TIPC_CMD_SET_NETID(r3, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000340)={&(0x7f00000001c0)={0x24, 0x0, 0x0, 0x70bd2d, 0x25dfdbff, {{}, {}, {0x8, 0x2, 0x6}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4000050}, 0x41) 15:29:41 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (fail_nth: 3) 15:29:41 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0xffffc, 0x0) (async) socketpair(0x29, 0x3, 0x8, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$TIPC_CMD_RESET_LINK_STATS(r2, &(0x7f0000000280)={&(0x7f00000001c0), 0xc, &(0x7f0000000240)={&(0x7f0000000380)=ANY=[@ANYBLOB="734d218c4de1b7582e0bbb44c3a1a6ea707df1abd6b551d715b61a5ab8", @ANYRES16=0x0, @ANYBLOB="00012abd7000fddbdf2501000000000000000c410000000c001473797a3100000000"], 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0x45a0195cd333733e) getsockopt$PNPIPE_IFINDEX(r1, 0x113, 0x2, &(0x7f00000002c0), &(0x7f0000000340)=0x4) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000080)="8053800e394c7fba1974780e88b13491ecd6df6dc980bb", 0x17) syz_io_uring_setup(0x754d, &(0x7f00000000c0)={0x0, 0xd847, 0x10, 0x2, 0x290, 0x0, r0}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000040), &(0x7f0000000140)) 15:29:41 executing program 2: select(0x40, &(0x7f0000000080)={0xd9, 0x4, 0x95c, 0x6, 0x0, 0x3, 0x6, 0xd2}, &(0x7f00000000c0)={0x1, 0x80000001, 0x0, 0x3, 0x10001, 0x1, 0x7fffffff, 0x7}, &(0x7f0000000100)={0x81, 0x6b0586a2, 0x8, 0x80000000, 0x6, 0x10001, 0xf3f, 0x8001}, &(0x7f0000000140)={0x0, 0x2710}) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) select(0x40, &(0x7f0000000080)={0xd9, 0x4, 0x95c, 0x6, 0x0, 0x3, 0x6, 0xd2}, &(0x7f00000000c0)={0x1, 0x80000001, 0x0, 0x3, 0x10001, 0x1, 0x7fffffff, 0x7}, &(0x7f0000000100)={0x81, 0x6b0586a2, 0x8, 0x80000000, 0x6, 0x10001, 0xf3f, 0x8001}, &(0x7f0000000140)={0x0, 0x2710}) (async) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) 15:29:41 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) pipe2$watch_queue(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x68, 0x0, 0x400, 0x70bd2a, 0x25dfdbfe, {{}, {}, {0x4c, 0x18, {0x33, @link='syz0\x00'}}}, ["", "", "", "", "", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x801}, 0x10) (async) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r2) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r3, &(0x7f0000000880)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x14, 0x0, 0x4}, 0x14}}, 0x0) sendmsg$NLBL_CIPSOV4_C_LIST(r3, &(0x7f0000000780)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000740)={&(0x7f00000003c0)={0x35c, 0x0, 0x2, 0x70bd26, 0x25dfdbfd, {}, [@NLBL_CIPSOV4_A_TAGLST={0x34, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x5}, {0x5, 0x3, 0x6}, {0x5, 0x3, 0x7}, {0x5}, {0x5, 0x3, 0x2}, {0x5}]}, @NLBL_CIPSOV4_A_MLSCATLST={0x108, 0xc, 0x0, 0x1, [{0xc, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x772486fa}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xd7de}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x7aeb}]}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x241c5463}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xca59}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x1ae3}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x2bf304aa}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x38a4}]}, {0x4}, {0x34, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x60a9352}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x4b2beebf}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x39c254f1}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x506}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xbd39}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x206}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x21ab854}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5fcca0a0}]}, {0x54, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xcdba}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x52ac7ddb}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xb5d}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x539a7f26}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x149d}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x40ddd90e}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x31231455}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x651e41fb}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x72c31445}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x70f083d2}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xf45e}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x62fdfd1a}]}]}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5}]}, @NLBL_CIPSOV4_A_MLSLVLLST={0x70, 0x8, 0x0, 0x1, [{0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x25}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x3f416a8b}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x68e7ac18}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7c7ff1ae}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x6ca6c7f3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x3354784d}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdd}]}, {0x24, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5363f159}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x30}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x94}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4b1ced2d}]}]}, @NLBL_CIPSOV4_A_MLSCATLST={0x28, 0xc, 0x0, 0x1, [{0x24, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x5b76}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x1120307d}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xa6d}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x7f8d}]}]}, @NLBL_CIPSOV4_A_MLSLVLLST={0x10, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x377e6c8f}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0x4c, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x6}, {0x5, 0x3, 0x6}, {0x5, 0x3, 0x5}, {0x5, 0x3, 0x1}, {0x5, 0x3, 0x5}, {0x5, 0x3, 0x3}, {0x5}, {0x5}, {0x5, 0x3, 0x5}]}, @NLBL_CIPSOV4_A_MLSCATLST={0x104, 0xc, 0x0, 0x1, [{0x44, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5b7ff79e}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x67d9fded}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x54781386}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x1ebd980f}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0xd3e391f}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x64e274d4}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x7023}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x4aec}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xe5bd}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x38d4}]}, {0x24, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x182e0277}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x2f1e581a}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x8607}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x54ea}]}, {0x24, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xf00c}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xaa5f}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x402c43b4}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x5298}]}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x3cbe6c9e}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x3552e80c}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x1514}]}, {0x44, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x217f5a57}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5657a11c}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xaa86}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x5741}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7d732cad}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x157}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xd19f}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xbf7f}]}]}]}, 0x35c}}, 0x10) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) r4 = syz_open_dev$vcsa(&(0x7f00000000c0), 0x7, 0x4100) ioctl$SNDRV_TIMER_IOCTL_GINFO(r4, 0xc0f85403, &(0x7f0000000100)={{0x3, 0x1, 0x1, 0x2, 0x3ff}, 0x4, 0x3, 'id0\x00', 'timer1\x00', 0x0, 0x6, 0x10000, 0x101, 0x100}) [ 3274.910990][T21542] R13: 00007fffe90b9c8f R14: 00007fb0e8cb6300 R15: 0000000000022000 [ 3274.911006][T21542] 15:29:42 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0x8, 0x40a6c0) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r0) pkey_mprotect(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x8, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_open_dev$vcsa(&(0x7f00000004c0), 0x20, 0x9a002) recvfrom$l2tp(r3, &(0x7f0000000500)=""/4, 0x4, 0x40016120, &(0x7f0000000540), 0x10) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r4, 0x233}, 0x1c}}, 0x0) sendmsg$TIPC_CMD_SHOW_STATS(r2, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r4, 0x8, 0x70bd2a, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x40000d0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r6, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r6, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x42100001}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x30, r1, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {}, {0x14, 0x19, {0x0, 0x1000000, 0x7, 0x1}}}, ["", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x20000000) write$qrtrtun(r0, &(0x7f00000001c0)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) syz_genetlink_get_family_id$tipc(&(0x7f0000000580), 0xffffffffffffffff) r7 = openat$cgroup_ro(r0, &(0x7f0000000040)='blkio.bfq.dequeue\x00', 0x0, 0x0) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r5) sendmsg$NL80211_CMD_NEW_INTERFACE(r7, &(0x7f00000006c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80040000}, 0xc, &(0x7f0000000180)={&(0x7f00000005c0)=ANY=[@ANYBLOB="e4000000", @ANYRES16=r8, @ANYBLOB="000240000000fbdbdf25070000000500530001000000140004006873723000000000000000000000000005005300010000001c00e700a4b930c16facd2c0747ae7292a564442824a2830176cdd940a00e8000802110000000000200017800400030004000100040005000400030004000500040001000400040014001780040004000400020004000600040006002800178004000300040000040006000400040004000100040005001c00e700015d99cdb8a1b9893bf45f361b79d62934addf1cd7e373170a00e800ffffffffffff00"/222], 0xe4}, 0x1, 0x0, 0x0, 0x1}, 0x0) 15:29:42 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) socketpair(0x23, 0x5, 0x101, &(0x7f0000000080)) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x444540) 15:29:42 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs/custom0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x74, 0x0, &(0x7f0000000340)=[@decrefs={0x40046307, 0x2}, @enter_looper, @exit_looper, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000100)={@fda={0x66646185, 0x7, 0x2, 0x25}, @fda={0x66646185, 0x8, 0x1, 0x21}, @ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/12, 0xc, 0x1, 0x2f}}, &(0x7f0000000180)={0x0, 0x20, 0x40}}}, @register_looper, @increfs={0x40046304, 0x1}, @dead_binder_done, @release], 0x2b, 0x0, &(0x7f0000000240)="a807ee4eb4d24cd996b54f47d14d19e1dc38f4589902754fc30cfcbd24690b6edc9fe4d4d8427cb92b077f"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000300)) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) openat$cgroup_ro(r0, &(0x7f00000002c0)='net_prio.prioidx\x00', 0x0, 0x0) r2 = syz_open_dev$vcsa(&(0x7f00000001c0), 0x4, 0x48000) r3 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$PNPIPE_IFINDEX(r2, 0x113, 0x2, &(0x7f00000003c0), &(0x7f0000000400)=0x4) syz_genetlink_get_family_id$tipc(&(0x7f0000000200), r3) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r2, 0x5760, 0xa) 15:29:42 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0xffffc, 0x0) socketpair(0x29, 0x3, 0x8, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$TIPC_CMD_RESET_LINK_STATS(r2, &(0x7f0000000280)={&(0x7f00000001c0), 0xc, &(0x7f0000000240)={&(0x7f0000000380)=ANY=[@ANYBLOB="734d218c4de1b7582e0bbb44c3a1a6ea707df1abd6b551d715b61a5ab8", @ANYRES16=0x0, @ANYBLOB="00012abd7000fddbdf2501000000000000000c410000000c001473797a3100000000"], 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0x45a0195cd333733e) getsockopt$PNPIPE_IFINDEX(r1, 0x113, 0x2, &(0x7f00000002c0), &(0x7f0000000340)=0x4) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000080)="8053800e394c7fba1974780e88b13491ecd6df6dc980bb", 0x17) syz_io_uring_setup(0x754d, &(0x7f00000000c0)={0x0, 0xd847, 0x10, 0x2, 0x290, 0x0, r0}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000040), &(0x7f0000000140)) syz_open_dev$vcsa(&(0x7f0000000000), 0xffffc, 0x0) (async) socketpair(0x29, 0x3, 0x8, &(0x7f0000000180)) (async) sendmsg$TIPC_CMD_RESET_LINK_STATS(r2, &(0x7f0000000280)={&(0x7f00000001c0), 0xc, &(0x7f0000000240)={&(0x7f0000000380)=ANY=[@ANYBLOB="734d218c4de1b7582e0bbb44c3a1a6ea707df1abd6b551d715b61a5ab8", @ANYRES16=0x0, @ANYBLOB="00012abd7000fddbdf2501000000000000000c410000000c001473797a3100000000"], 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0x45a0195cd333733e) (async) getsockopt$PNPIPE_IFINDEX(r1, 0x113, 0x2, &(0x7f00000002c0), &(0x7f0000000340)=0x4) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000080)="8053800e394c7fba1974780e88b13491ecd6df6dc980bb", 0x17) (async) syz_io_uring_setup(0x754d, &(0x7f00000000c0)={0x0, 0xd847, 0x10, 0x2, 0x290, 0x0, r0}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000040), &(0x7f0000000140)) (async) [ 3275.146943][T21585] FAULT_INJECTION: forcing a failure. [ 3275.146943][T21585] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 3275.160135][T21585] CPU: 1 PID: 21585 Comm: syz-executor.0 Not tainted 5.19.0-syzkaller-dirty #0 [ 3275.169078][T21585] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 [ 3275.179242][T21585] Call Trace: [ 3275.179251][T21585] [ 3275.179258][T21585] dump_stack_lvl+0xd6/0x122 15:29:42 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0x8, 0x40a6c0) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r0) pkey_mprotect(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x8, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_open_dev$vcsa(&(0x7f00000004c0), 0x20, 0x9a002) recvfrom$l2tp(r3, &(0x7f0000000500)=""/4, 0x4, 0x40016120, &(0x7f0000000540), 0x10) (async, rerun: 32) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async, rerun: 32) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r4, 0x233}, 0x1c}}, 0x0) (async) sendmsg$TIPC_CMD_SHOW_STATS(r2, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r4, 0x8, 0x70bd2a, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x40000d0) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r6, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async, rerun: 32) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r6, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x42100001}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x30, r1, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {}, {0x14, 0x19, {0x0, 0x1000000, 0x7, 0x1}}}, ["", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x20000000) (rerun: 32) write$qrtrtun(r0, &(0x7f00000001c0)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) syz_genetlink_get_family_id$tipc(&(0x7f0000000580), 0xffffffffffffffff) (async) r7 = openat$cgroup_ro(r0, &(0x7f0000000040)='blkio.bfq.dequeue\x00', 0x0, 0x0) (async) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r5) sendmsg$NL80211_CMD_NEW_INTERFACE(r7, &(0x7f00000006c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80040000}, 0xc, &(0x7f0000000180)={&(0x7f00000005c0)=ANY=[@ANYBLOB="e4000000", @ANYRES16=r8, @ANYBLOB="000240000000fbdbdf25070000000500530001000000140004006873723000000000000000000000000005005300010000001c00e700a4b930c16facd2c0747ae7292a564442824a2830176cdd940a00e8000802110000000000200017800400030004000100040005000400030004000500040001000400040014001780040004000400020004000600040006002800178004000300040000040006000400040004000100040005001c00e700015d99cdb8a1b9893bf45f361b79d62934addf1cd7e373170a00e800ffffffffffff00"/222], 0xe4}, 0x1, 0x0, 0x0, 0x1}, 0x0) 15:29:42 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:42 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0x8, 0x40a6c0) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r0) (async) pkey_mprotect(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x8, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_open_dev$vcsa(&(0x7f00000004c0), 0x20, 0x9a002) recvfrom$l2tp(r3, &(0x7f0000000500)=""/4, 0x4, 0x40016120, &(0x7f0000000540), 0x10) (async) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async, rerun: 32) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) (rerun: 32) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r4, 0x233}, 0x1c}}, 0x0) (async, rerun: 64) sendmsg$TIPC_CMD_SHOW_STATS(r2, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r4, 0x8, 0x70bd2a, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x40000d0) (async, rerun: 64) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r6, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r6, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x42100001}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x30, r1, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {}, {0x14, 0x19, {0x0, 0x1000000, 0x7, 0x1}}}, ["", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x20000000) (async) write$qrtrtun(r0, &(0x7f00000001c0)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) syz_genetlink_get_family_id$tipc(&(0x7f0000000580), 0xffffffffffffffff) r7 = openat$cgroup_ro(r0, &(0x7f0000000040)='blkio.bfq.dequeue\x00', 0x0, 0x0) (async, rerun: 64) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r5) (rerun: 64) sendmsg$NL80211_CMD_NEW_INTERFACE(r7, &(0x7f00000006c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80040000}, 0xc, &(0x7f0000000180)={&(0x7f00000005c0)=ANY=[@ANYBLOB="e4000000", @ANYRES16=r8, @ANYBLOB="000240000000fbdbdf25070000000500530001000000140004006873723000000000000000000000000005005300010000001c00e700a4b930c16facd2c0747ae7292a564442824a2830176cdd940a00e8000802110000000000200017800400030004000100040005000400030004000500040001000400040014001780040004000400020004000600040006002800178004000300040000040006000400040004000100040005001c00e700015d99cdb8a1b9893bf45f361b79d62934addf1cd7e373170a00e800ffffffffffff00"/222], 0xe4}, 0x1, 0x0, 0x0, 0x1}, 0x0) 15:29:42 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0x71, 0x2bfac7d2c557a12e) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r0, 0x5760, 0xa) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r1, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) [ 3275.179300][T21585] dump_stack+0x11/0x12 [ 3275.179320][T21585] should_fail+0x242/0x250 [ 3275.179385][T21585] should_fail_usercopy+0x16/0x20 [ 3275.179405][T21585] _copy_to_user+0x1a/0x90 [ 3275.179424][T21585] simple_read_from_buffer+0xab/0x120 [ 3275.179577][T21585] proc_fail_nth_read+0x10d/0x150 [ 3275.179599][T21585] ? proc_fault_inject_write+0x230/0x230 [ 3275.179620][T21585] vfs_read+0x1a1/0x6a0 [ 3275.179675][T21585] ? save_fpregs_to_fpstate+0xfa/0x140 [ 3275.179751][T21585] ? __fget_files+0x1a7/0x1e0 [ 3275.179770][T21585] ksys_read+0xe8/0x1a0 [ 3275.179823][T21585] __x64_sys_read+0x3e/0x50 [ 3275.179873][T21585] do_syscall_64+0x2b/0x70 [ 3275.179895][T21585] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 3275.179964][T21585] RIP: 0033:0x7fb0e9513dbc [ 3275.179977][T21585] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 [ 3275.179993][T21585] RSP: 002b:00007fb0e8cd7160 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 3275.180011][T21585] RAX: ffffffffffffffda RBX: 00007fb0e9673f60 RCX: 00007fb0e9513dbc [ 3275.180024][T21585] RDX: 000000000000000f RSI: 00007fb0e8cd71e0 RDI: 0000000000000004 [ 3275.180036][T21585] RBP: 00007fb0e8cd71d0 R08: 0000000000000000 R09: 0000000000000000 [ 3275.180049][T21585] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 15:29:42 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) r1 = syz_open_dev$vcsa(&(0x7f0000000080), 0x3, 0x121480) setsockopt$TIPC_GROUP_LEAVE(r1, 0x10f, 0x88) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:42 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) socketpair(0x23, 0x5, 0x101, &(0x7f0000000080)) (async) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x444540) 15:29:42 executing program 2: select(0x40, &(0x7f0000000080)={0xd9, 0x4, 0x95c, 0x6, 0x0, 0x3, 0x6, 0xd2}, &(0x7f00000000c0)={0x1, 0x80000001, 0x0, 0x3, 0x10001, 0x1, 0x7fffffff, 0x7}, &(0x7f0000000100)={0x81, 0x6b0586a2, 0x8, 0x80000000, 0x6, 0x10001, 0xf3f, 0x8001}, &(0x7f0000000140)={0x0, 0x2710}) (async) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:42 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs/custom0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x74, 0x0, &(0x7f0000000340)=[@decrefs={0x40046307, 0x2}, @enter_looper, @exit_looper, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000100)={@fda={0x66646185, 0x7, 0x2, 0x25}, @fda={0x66646185, 0x8, 0x1, 0x21}, @ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/12, 0xc, 0x1, 0x2f}}, &(0x7f0000000180)={0x0, 0x20, 0x40}}}, @register_looper, @increfs={0x40046304, 0x1}, @dead_binder_done, @release], 0x2b, 0x0, &(0x7f0000000240)="a807ee4eb4d24cd996b54f47d14d19e1dc38f4589902754fc30cfcbd24690b6edc9fe4d4d8427cb92b077f"}) (async) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000300)) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) openat$cgroup_ro(r0, &(0x7f00000002c0)='net_prio.prioidx\x00', 0x0, 0x0) (async) r2 = syz_open_dev$vcsa(&(0x7f00000001c0), 0x4, 0x48000) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$PNPIPE_IFINDEX(r2, 0x113, 0x2, &(0x7f00000003c0), &(0x7f0000000400)=0x4) (async) syz_genetlink_get_family_id$tipc(&(0x7f0000000200), r3) (async) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r2, 0x5760, 0xa) 15:29:42 executing program 1: bind$l2tp(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @empty, 0x2}, 0x10) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f00000000c0)={0x4}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) 15:29:42 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0x71, 0x2bfac7d2c557a12e) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r0, 0x5760, 0xa) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r1, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:42 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) socketpair(0x23, 0x5, 0x101, &(0x7f0000000080)) (async) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x444540) 15:29:42 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs/custom0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x74, 0x0, &(0x7f0000000340)=[@decrefs={0x40046307, 0x2}, @enter_looper, @exit_looper, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000100)={@fda={0x66646185, 0x7, 0x2, 0x25}, @fda={0x66646185, 0x8, 0x1, 0x21}, @ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/12, 0xc, 0x1, 0x2f}}, &(0x7f0000000180)={0x0, 0x20, 0x40}}}, @register_looper, @increfs={0x40046304, 0x1}, @dead_binder_done, @release], 0x2b, 0x0, &(0x7f0000000240)="a807ee4eb4d24cd996b54f47d14d19e1dc38f4589902754fc30cfcbd24690b6edc9fe4d4d8427cb92b077f"}) (async) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000300)) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) openat$cgroup_ro(r0, &(0x7f00000002c0)='net_prio.prioidx\x00', 0x0, 0x0) (async) r2 = syz_open_dev$vcsa(&(0x7f00000001c0), 0x4, 0x48000) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) getsockopt$PNPIPE_IFINDEX(r2, 0x113, 0x2, &(0x7f00000003c0), &(0x7f0000000400)=0x4) syz_genetlink_get_family_id$tipc(&(0x7f0000000200), r3) (async) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r2, 0x5760, 0xa) 15:29:42 executing program 1: bind$l2tp(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @empty, 0x2}, 0x10) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f00000000c0)={0x4}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) bind$l2tp(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @empty, 0x2}, 0x10) (async) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f00000000c0)={0x4}) (async) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) (async) 15:29:42 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) r1 = syz_open_dev$vcsa(&(0x7f0000000080), 0x3, 0x121480) setsockopt$TIPC_GROUP_LEAVE(r1, 0x10f, 0x88) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) [ 3275.180061][T21585] R13: 00007fffe90b9c8f R14: 00007fb0e8cd7300 R15: 0000000000022000 [ 3275.180121][T21585] 15:29:42 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000000, 0x80010, r1, 0x8000000) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:42 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0x71, 0x2bfac7d2c557a12e) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r0, 0x5760, 0xa) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r1, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:42 executing program 1: bind$l2tp(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @empty, 0x2}, 0x10) (async) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async, rerun: 64) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (rerun: 64) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async, rerun: 32) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f00000000c0)={0x4}) (async, rerun: 32) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) 15:29:42 executing program 4: sendmsg$NLBL_MGMT_C_VERSION(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x34, 0x0, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0xffffffffffffffff}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0x1}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x2}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @remote}]}, 0x34}, 0x1, 0x0, 0x0, 0x405c0c4}, 0x80) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:42 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) r1 = syz_open_dev$vcsa(&(0x7f0000000080), 0x3, 0x121480) setsockopt$TIPC_GROUP_LEAVE(r1, 0x10f, 0x88) (async, rerun: 32) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (rerun: 32) 15:29:42 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_LINK_PRI(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x68, r1, 0x10, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x4c, 0x18, {0x9, @link='broadcast-link\x00'}}}, ["", "", "", "", "", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x4000050}, 0x40) 15:29:42 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async, rerun: 32) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (rerun: 32) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000000, 0x80010, r1, 0x8000000) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:42 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r0) syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), r0) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r1, 0x233}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000240)={&(0x7f00000003c0)={0x3bc, 0x0, 0x100, 0x70bd25, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x45d8, 0x5a}}}}, [@NL80211_ATTR_REKEY_DATA={0x3c, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "5da184a9c2714a71"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="c986cf87ec1214c450621af33cb397a1fe7837cdeb78efc2eee4a7610d9889a6"}, @NL80211_REKEY_DATA_AKM={0x8}]}, @NL80211_ATTR_REKEY_DATA={0xec, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="c47b8c0ef525022e366383ef187c1071fbda1f435cbb6e86"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="53cf2393c63cf5db5affc6a053aa132da158edbc371f28b3"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="38a650f8f88dee668ad0223f78d642d8"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="dc544cfde2ec6e206f181836a91ffa92e0c231264807481095255143aa07189a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="1201f5e56f44946adfb7926cfec68525"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="5a0ac48862497bc1365ba31254cac1209026fc8fd4e1898d"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="2053546ef09e79f257e039a4ce92d9c1d6aa5631edef9f6f"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="97216387ddda75670e443f48b24976fcb45faafd9eacac522307985f46f65ed5"}]}, @NL80211_ATTR_REKEY_DATA={0x4c, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="b96a6ecbbf331d118d65a0c8dac030bc3f7f086f7c58461b"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="d3a261e4c9d537e840adeac7cec6117e1dfee9c5bca058d50f15f4416da4e4fa"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}]}, @NL80211_ATTR_REKEY_DATA={0x88, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="b9aaa9364700cce6e07a5f3acae550dcf0492aa552818e07"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x8}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="50646b2ea87d9f25e5ec09cdb297bd92"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="76103e244291e96d572afbe0b02a7668"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="abb86627e644b2e0fd184fe501810e7f"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="66f03bae648b30737e187c6beabcec3195e5919a052db232"}, @NL80211_REKEY_DATA_AKM={0x8}]}, @NL80211_ATTR_REKEY_DATA={0x28, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="345e0d511b48fb59777a3196864b7a25244b0607c51892f2098c30882cd68a7b"}]}, @NL80211_ATTR_REKEY_DATA={0x38, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="ff442c921c34cdbb600e4ce58e158582a4acbe1b50a6b7b9de494e46746d06d8"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x9}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x480000}]}, @NL80211_ATTR_REKEY_DATA={0x78, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xffffff76}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="bc2b774713f2e22d0c1db4746fb7851f80ac8155a8cf356c"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "00ec56a0bdab83b0"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="f8343c67dfd2d45355d1d8eb43878009"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "16690120428e9e9d"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="c0ae377b690424a720687f264b5ff34c"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x80000001}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4}]}, @NL80211_ATTR_REKEY_DATA={0x44, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="f72fc269da503a4c292b3a950d9a85b9f52b5f0a75bff8e252bdb26b45779f74"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="57beaf4b52860f6e68772c8c94c8d5e6"}]}, @NL80211_ATTR_REKEY_DATA={0x84, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "5a29ce5d38cb1aa8"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xffffffff}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="3d693c8fa5940f933c985eade14121841946a42a23cb552ad9f40728bf1d35eb"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="b4f2c5858ef0e78aab58f7330a477b47"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "44a1a6ee4d3a5906"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "85170c7911100e12"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="04c6afcb74e04f52fd33d8c94204257d"}]}]}, 0x3bc}}, 0x40000) sendmsg$TIPC_CMD_GET_NETID(r0, &(0x7f0000000180)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000100)={0x1c, r1, 0x8, 0x70bd2b, 0x25dfdbfe, {}, ["", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x400c000}, 0x5) 15:29:42 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, 0xffffffffffffffff, 0xbb, &(0x7f0000000080)=""/195) 15:29:42 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_LINK_PRI(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x68, r1, 0x10, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x4c, 0x18, {0x9, @link='broadcast-link\x00'}}}, ["", "", "", "", "", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x4000050}, 0x40) 15:29:42 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r0) (async) syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), r0) (async, rerun: 32) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) (async, rerun: 32) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r1, 0x233}, 0x1c}}, 0x0) (async, rerun: 64) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000240)={&(0x7f00000003c0)={0x3bc, 0x0, 0x100, 0x70bd25, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x45d8, 0x5a}}}}, [@NL80211_ATTR_REKEY_DATA={0x3c, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "5da184a9c2714a71"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="c986cf87ec1214c450621af33cb397a1fe7837cdeb78efc2eee4a7610d9889a6"}, @NL80211_REKEY_DATA_AKM={0x8}]}, @NL80211_ATTR_REKEY_DATA={0xec, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="c47b8c0ef525022e366383ef187c1071fbda1f435cbb6e86"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="53cf2393c63cf5db5affc6a053aa132da158edbc371f28b3"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="38a650f8f88dee668ad0223f78d642d8"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="dc544cfde2ec6e206f181836a91ffa92e0c231264807481095255143aa07189a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="1201f5e56f44946adfb7926cfec68525"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="5a0ac48862497bc1365ba31254cac1209026fc8fd4e1898d"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="2053546ef09e79f257e039a4ce92d9c1d6aa5631edef9f6f"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="97216387ddda75670e443f48b24976fcb45faafd9eacac522307985f46f65ed5"}]}, @NL80211_ATTR_REKEY_DATA={0x4c, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="b96a6ecbbf331d118d65a0c8dac030bc3f7f086f7c58461b"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="d3a261e4c9d537e840adeac7cec6117e1dfee9c5bca058d50f15f4416da4e4fa"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}]}, @NL80211_ATTR_REKEY_DATA={0x88, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="b9aaa9364700cce6e07a5f3acae550dcf0492aa552818e07"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x8}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="50646b2ea87d9f25e5ec09cdb297bd92"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="76103e244291e96d572afbe0b02a7668"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="abb86627e644b2e0fd184fe501810e7f"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="66f03bae648b30737e187c6beabcec3195e5919a052db232"}, @NL80211_REKEY_DATA_AKM={0x8}]}, @NL80211_ATTR_REKEY_DATA={0x28, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="345e0d511b48fb59777a3196864b7a25244b0607c51892f2098c30882cd68a7b"}]}, @NL80211_ATTR_REKEY_DATA={0x38, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="ff442c921c34cdbb600e4ce58e158582a4acbe1b50a6b7b9de494e46746d06d8"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x9}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x480000}]}, @NL80211_ATTR_REKEY_DATA={0x78, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xffffff76}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="bc2b774713f2e22d0c1db4746fb7851f80ac8155a8cf356c"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "00ec56a0bdab83b0"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="f8343c67dfd2d45355d1d8eb43878009"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "16690120428e9e9d"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="c0ae377b690424a720687f264b5ff34c"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x80000001}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4}]}, @NL80211_ATTR_REKEY_DATA={0x44, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="f72fc269da503a4c292b3a950d9a85b9f52b5f0a75bff8e252bdb26b45779f74"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="57beaf4b52860f6e68772c8c94c8d5e6"}]}, @NL80211_ATTR_REKEY_DATA={0x84, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "5a29ce5d38cb1aa8"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xffffffff}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="3d693c8fa5940f933c985eade14121841946a42a23cb552ad9f40728bf1d35eb"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="b4f2c5858ef0e78aab58f7330a477b47"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "44a1a6ee4d3a5906"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "85170c7911100e12"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="04c6afcb74e04f52fd33d8c94204257d"}]}]}, 0x3bc}}, 0x40000) (rerun: 64) sendmsg$TIPC_CMD_GET_NETID(r0, &(0x7f0000000180)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000100)={0x1c, r1, 0x8, 0x70bd2b, 0x25dfdbfe, {}, ["", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x400c000}, 0x5) 15:29:42 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) getsockopt$PNPIPE_IFINDEX(r1, 0x113, 0x2, &(0x7f0000000080), &(0x7f00000001c0)=0x4) write$qrtrtun(r0, &(0x7f0000000000)="de8128", 0x3) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0xbbd36cde67aaa33d}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="a8100000", @ANYRES16=r2, @ANYBLOB="00022dbd7000fbdbdf25810000009010330028940300080211000001ffffffffffff50505050505059000802110000010802110000010010b61cfccc8de480b5d55c76d03bff29a64179f9190abb405e40c5ff7dbaab4d38fc4cec0ad28112f6a63bb38c84e0e3e94b7856024aa6ccd8758b34c06d6b279308db6cb9b778566aba043f1ab1e0b9f3e8e0c458e804c0e15665bff3a5705cbc8e07d83059db4e54c77cc16b09987abedabb4037568111aadf66bd5d190419c5991428183114c293c207ec417dc378bf8a92e508162487fdc0628a37cc25b5749fc8d66b48a97a2befa01f8dad87eda4fb2fb40abc3e0af1017681f70d7c47e2909762ffc44749d71367c398aba6169f55c5c3fea114d61f8ed1f9b047817629d705951a215c2ab61de93c0fa002bd702eda9f74fb4039799b4d60c4df5437397d9f07378da01fe7788f952d5c7bb03a999bc3a1a32f57dc4ae9b63a0de98ab10e228f3284dcb2ac7972c843ac5dfa712d5e099d9fd4d3e7f8ceb807ad9012f4b771bfa850c100ebc63b7df2344d1900d673f8b7971ae9fcfe2b193a0d833255f382b1a11ae2539847ee895a0ee13c881be015da7f21ad52927757f0bad04a54e128e4375b86b7138da4186ed21725195254d1238b4cf80283ce61e099c305ec5234611726e768a447ed67e7d0310d216d04ea17aef211c34a41e0742b2993b7d104d3d159c30a4eb888220e99f65d6e5d7e97782bc7472dd8d4af70438e5556c088c0c0b7b166f851e9be9ecc057b6ef076778a7ed3a641cc2a15ba5f363ce86ed340eecee2f045aadd97b52d072cb4c1e2c8af2c6b095b2e169b275049e2e7f9665745ca0e848475afc252badbd8e9fb3a5a312500e5cc402b384664a94ffd4eee81a95ef56b1dccee416bfb23cd179080fb83022a4cfd79541b90d31e6f5d885802e36eb417b689e3abcf0f69f90390f3ab57e294db6da3032fe89bd4e1b942c72e4ed7cb0db725148a4d97f584d6d9c10bcd83d4dcba5d3470f0e45e4ce686be7c642b67b8b1bafc25cb9a9d02209d32ee55ff06abc08d4bad483e36f000c6de61a7a5b5ca411d268f343ca8eaffc1697e92ac150341a4399acded00b4ba8862985c1240ef605eec9643324a7b96d484017f4a4a966f0e7570bc5e2e8fb33bc6e2bf33f9ff96e2ebb8c2414cda371823defd2cd9d4f2bb2bd5a54774e9bc4b23e28df775421dc3f1af47ce67e938acbc64f859a12d13556e5f09d33004afee91547b8d4fb602b67c3ad949221a7dd8ee637ce9976f076a2db321c0335d4ab797b789232212c48d0e81770c845808f94bfaa613c59061a0401db8b99a1a07251f253034954154e06b46db4596460e184c64ce22abb20686dd1c37dea9ea3b48996a5c8f83bfa2f5da26a53efd5e22597f76147f1563b7dcd436324fcdf3f6a24ed40837539ff3af17a6bc297abe0ce1dcb9e0c852085db97417490586fdcb27a5a1da18632891e5bda86de41319070f598523a90a43732fbfcd2f063836cdca369b2767b3eede5d755d41ed6b4ffdb825dd90b244bd4ad7c260e4ebd504ac3becf537c137278c7ade396e9b8fe3473be29c0e543ea21af17361f2d624beaac06d7c1caac0997ffc130d2c0e4f9ff426661bd34e3491832dcb369a0f850b895119dc325fdadc19e402e2e028ede71f2d7f46e3f42c7e40db2936d2c0ef6b516f5191c4b4974905106292d894918415417f504a301962818018b2ab84959495fd9af5c2c38ec87ff5c749175babc17abb441c6d87dc8138f6106bfac3ad5be77a5c63e4c896cced9b88a3469c48d083ea4ea6b79d12c043f7deff42910a3401d3102a90acd60a2d7243c2ae3e895dd68c327324aef41d85c555ad8ccb30faa0c68bbeb18a62bcfd6f548b67cd0958d300b88b9a2d13737c2a0bbd9b78de6c16dc19cd82467c86da7067f79c8cd6d4c616ba7ea14dc578ccc615ab276e50496ba9d33fae4f449f000788b6943c51ba922ec1edc7664130a7f46dcf6b5a9e03dabb08254ecc4ecb736fe68e78e6eabd23ac2f16090c34cc9845b9a7145512aa3342100c3e59374a41328a700439aa27180ed449eb65e2aa9f74706c6609994173a696fade9ae71c18fdbbf1fb9f126c836117df5a339532aca8e8094ab9f6781272cd3f9099a10e477788777e1bb65432740276aa59f76c2db9415de1b64ff6a30f7eda4cde66a0ae3db944d8d7194c4d37de4d3b5fdc900a8e7aa15728c4a570f78f03a86e971360ecfbec8a2a5353203ca03ec7ee1999d1a687da35c0fffb21d4c1c2edcd072393d1c7e71636eb4ef295fa96d54ed93f4f88b0fc2389a1fb6bb895960475565e896f83903a885758c52ff7e8b992b7cec0d4b8bccc721f85c8c9e8557a551f8d1d52afbdd7a99cbb009999d7938998a336cfca7a4dea97f80fa167d84034c147767e2743a33959e616df1f607cfb513bb4937c4628f754e7858af0f4abfe61a7b3829c7bb6a88d67d9c26949132b6a4ae434550180d9286485609376b9374c79348e8910f732d824f75956c26c0eda7c377d4a4966ea6d25a6c439b70df45f08cfc091d5ee65cc9175f45aaff4af5fe7b960e93ed96d6c17e643faa2db04dfd15753a6d64c18a37fe98c6416df2aa78e24cce7be9ae511cdb0832169d493dcb52175ec24220644e949c88b5fd4ae10fe01931358f14a38be5e1d25a76cdf7b4c821236ee8581602e2edfdd438b22fb1cb437fb4ec034281de483e1824b768f26234b3b86c624461f3e54641669eed24a98dbed279c43bf78d5cd1cdf541964090a2d6c575021b0adb38d43b49db900885d22a69693eca403ba558e6ea51cfc58c46a27b898e38a82a973525735dca6561483edf619b9824970ff113697de9eda3072ac3bec3dfcd5949c699fab86d09133dca2de23a1651b350497affab6500c06a88283f38e037bf9efaf9e9ab893d4783b269a6e30d9732770d3f59611c75da2ab5cb7deecd9f078fe2354d571368b7a3f5df18f4390b5f2b7ccf4b08039ee06ac4366da513a4442b3f9ccc3cc000a6e62d2cdda72fce8f9c8a2d83d3b4fbf3cbbd8ec300a9686f53d6a6107496f86dafdb38d174927d025bde286b123355c09af2485781388485a84c2a871650f60cdab267147c51f67f4001652e47011661b60c2035d8791b20dcf63f12e2e59b491ba298fe1f11d1c654824472af4178af7e0b2e11eeb446a33b13e47005ceabc2c7c27f42bb769534b92c8ccad5569c3a8c341c5a0b67483e209d7a5c03081d4aafaecfa2583360b76fb74aad46ccd47105b1ff88b87e57cfa546513ab4bf204a082efaa7b47758906eae45b9cfb5f475615b6dd43fc97b23591bae620015bac92f7addc9006515f500c74dc8c22eb6b1a035054236768880e497a38038afc716b50f5aa504776e0087b6a07c022d5cfca0038c133a60372dc547797879d23092025fab2599d217dc9f0df4665e61bc7da81d400a5bac9115d8ad3c1b058b15a28f06ebe6b89e139cc7cee973b4d1a31d6b9cf48778baf6930805feb00f56f13f92eb8b34d9646f0cf3377cfd0aa7adcc7c8a9af1041204bfb438cb06a2511cbc2f22e7316460928ee143489bd90830d076802ed1971d7a8a7b0a831bb7f9f029e96eadd085f2f4a50fee92bbe253a8b0216523d1cd631ea99b9b01264d4f42a69b6f1b232bc8041d188c20a2fa7a4b66fc83b878e06c91ffc58421937425173ca440bd096c64507b247c751c4bfdb8b1e3f33991a8cdbe5fbbaac20635cb31e47bde174f689829d8ca5f874ef53970319edd4e83953c370d0b71a05c054f74d0bf19ba6f10c192ae2af490ea84ffac5b57cddd89f328d9a7bed45b5b79c72950637726344366fbcc8297f8442e947b7066c56480fa6cd24ecc648b1633b578894a887a9ba7373a932d3589d2650b4abcfd11ae9bee41c3b2d3a957e19403054da7b55c1f938124508dec93dd3a0821a7be678a7879e8f63adb0bca5eecdf150b82ed949b339d9cba8be028da2cde6ba62609a48659a123c19b3f0185918dacc462ba6332e39f29732be01da067b5feb0a1c980f9e7726b3f310cfc3671a63d13397bc663ff85915b1c525f06fa106fa370b09ac870b49281189ec8782469485860b39581d509852e07065808c30a3c4796604f9f17e057cf1f2b9a4c0e26f388508984f30aedcca5bb412b7001f9b4d62c1cedea389bf4fbb9c95690f04fb8cbd62596ddff092dda6f0cad1d7a2088d99578c96cbacbe7e054362820f3e5ab308fb17a7908686d5a057ce09d4380b2289cc69bb50bde650fdaa6ae03a4a59d5d1ca837386e062e62c0d80fb6435070bd6ae7bfb7bc2496fd0dca0799684faaa0be9a5e43069d75cdf9b47f8f309fec70a887651d563a3094b08a9038211e0dfe91b14e8deab8ae1709083c1c2d3f4a194efdbb7754f84eedabf6e6c00174721de3990ae56a7a015c8279a8d53ea286b3a3684d5d717a001c659f6e0700ea3a49021e8120cb6559927fbb4aaadbcd2969cd848562f4e3a320c9182c955815a0d7b6a1936b572c0d705b4fce84b6599c800c1902756facdd9229ece49f9529365926e9264a5e990719683ee5a29eb901accf0fc73fabad58d9853102d2d8ac14f4b7acc83204e4a4b23feb851d6a64174a0dce450fb54f7578dba5c8e5dcb86161324735bc86ae8c9ff46b91330350f0f51aea323a6137addd371c23897d7cb0e434911c031eb7f11984f60e263de3c00166131b58afe8dc422284dab344b92926f923131c5490cd5dca4a5d05337bcb0b10404d2ccfae7b81b050f9d01f328ce1ce9b0d4ef87958ccca3fd410c8232c20857e0184de50a4ec585cd895a443ae1991480380eb0e249bfc8e799ad56c905052b6a4eac1ef36f4d17140ec3878918c2420c778f21e66df00e6b8945b46d65291379b7aedc25b4e8d4776303ae36cc5fbc28d01fb00f7f9e478e3dea004dca719c1a1970ee11a2fa820b71a1bd711626054919c3930db6fdfdd39d5dd14f3ab64f74bd0126cb3c3edca278332fdec77d392c14ffd81e530b9f715dadf919e9d8e10216e487b9a46595b0c8172cc2cc71aa1c821338f121ce9d4299daa0646466cfe0dd6df0698555fad26f20be9144fc2d09c23c11d42e1bf03121e4406d1b5ed94d82efab990a80788bb22fe013c59c0073d209fffe7c98e52c9638f765686d1d93c6072c3dabae3b11812541eaea0d7dc092590c45691065559bb1ba2e5268cb69aa8e35b3211a1348f9370063ffd1d8d6e2b7281d079df981c61310c02c5e7a6ca18cd64b9ebac1cf5f4ff1eedb8262cb4e2b1a7003e492ffe7c0b1d6d99528fe4b8ea5deec5aae26d0c588389eaf2db82e73530def6e5b7868fec5194780c6281eb8decaa5d0852a2fc2fed0f03ac5eedeccf8df890d61820ecdb140f1d9e96bb0415fac586b46a7ff75f9502754f0d9b4a7478ebd6d1d163de9c68974deca70249cefafdf3253002bb73c8d830d4ca81562323220e07d0416336861e8777f8fed6b56803fd23515ecd8749951395ab61529bc5e3c1d581e9f2d0cb38588d4984b9d1742488e581718164a90b4c94f80720207439fdd63c50f0fe9641237b8b20b24eb7cd79b422a9fa78796d3f7391fa1673ee7b725ece043e1f01c690e6edaca0a854506b871e8095ba0dd6429a087eed34fdea37fd20eb5699db773a90bbd10890cb484831ca1b0ca0a719ec02ed6541594aa0956a85b45c335d550b2bef03fb78b164ffbe6eb9a4e6cb527b3090bdc8c1d08dd1f8834075576e6a5689ec89d1499579cb1dd81321e4c50887f17d46bfd0bd0487284b7961118f4d232c5929725be6d940687e1a94a9fc487477c28420000080211000000ffffffffffff5300ef5527f6f37a69268680d8f42aaf6c4df57cdc348674015ad42c8807542f6242e8199da67cda2f010172e2d7f62e0858a06b57904eda51c721af38b0017e12286bc607829b9f8b8638703e03470470a89f9fd600"/4257], 0x10a8}, 0x1, 0x0, 0x0, 0x200000c5}, 0x10) 15:29:42 executing program 4: sendmsg$NLBL_MGMT_C_VERSION(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x34, 0x0, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0xffffffffffffffff}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0x1}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x2}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @remote}]}, 0x34}, 0x1, 0x0, 0x0, 0x405c0c4}, 0x80) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) sendmsg$NLBL_MGMT_C_VERSION(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x34, 0x0, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0xffffffffffffffff}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0x1}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x2}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @remote}]}, 0x34}, 0x1, 0x0, 0x0, 0x405c0c4}, 0x80) (async) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) 15:29:42 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000000, 0x80010, r1, 0x8000000) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:42 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x1, 0x70bd29, 0x25dfdbfb, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x4000000) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={&(0x7f0000000180), 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=@flushpolicy={0x1e8, 0x1d, 0x400, 0x70bd26, 0x25dfdbfd, "", [@replay_val={0x10, 0xa, {0x70bd28, 0x70bd28, 0x7}}, @algo_comp={0x7c, 0x3, {{'deflate\x00'}, 0x1a0, "d02f32bb3c28a9d7fb87528c0c5e049d27b16ee1d1b8db33f72b7b1d10390fbb50d48fcb19f6c874bdf8e1b4484c9c5d3241376a"}}, @replay_thresh={0x8, 0xb, 0x1}, @replay_val={0x10, 0xa, {0x70bd2c, 0x70bd25, 0x4}}, @algo_auth_trunc={0x134, 0x14, {{'sha1-ni\x00'}, 0x740, 0x180, "86fc4094128623025253ba1bf12b16628c193dab5921d90b17dab91cd9e7d3f1d026d807ba3ecf570a5c8faf2189409228958e556c73e1575979204064f79e721da1247aa795e21c03b2c526c6814bae29060668660a91e8b6117b279929536036dabaabaed87364561b5561e5778c56e89bebbf457581a3e83ba29124f9cdb02ad249eaa0986e7c772d4daa077953db62934429edb886ee03583c418032d772819f45c1a5bcdbef1d011d312973ba710cb544d62580928fa04a5eff9c54140bfa6f7144ca2e449f28a81d4c740c80077bff01e96f99be49be720c85761f58a9c5ac25c6bcd687e0"}}]}, 0x1e8}, 0x1, 0x0, 0x0, 0x20004050}, 0x11) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:42 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, 0xffffffffffffffff, 0xbb, &(0x7f0000000080)=""/195) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, 0xffffffffffffffff, 0xbb, &(0x7f0000000080)=""/195) (async) 15:29:42 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r0) syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), r0) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r1, 0x233}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000240)={&(0x7f00000003c0)={0x3bc, 0x0, 0x100, 0x70bd25, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x45d8, 0x5a}}}}, [@NL80211_ATTR_REKEY_DATA={0x3c, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "5da184a9c2714a71"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="c986cf87ec1214c450621af33cb397a1fe7837cdeb78efc2eee4a7610d9889a6"}, @NL80211_REKEY_DATA_AKM={0x8}]}, @NL80211_ATTR_REKEY_DATA={0xec, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="c47b8c0ef525022e366383ef187c1071fbda1f435cbb6e86"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="53cf2393c63cf5db5affc6a053aa132da158edbc371f28b3"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="38a650f8f88dee668ad0223f78d642d8"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="dc544cfde2ec6e206f181836a91ffa92e0c231264807481095255143aa07189a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="1201f5e56f44946adfb7926cfec68525"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="5a0ac48862497bc1365ba31254cac1209026fc8fd4e1898d"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="2053546ef09e79f257e039a4ce92d9c1d6aa5631edef9f6f"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="97216387ddda75670e443f48b24976fcb45faafd9eacac522307985f46f65ed5"}]}, @NL80211_ATTR_REKEY_DATA={0x4c, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="b96a6ecbbf331d118d65a0c8dac030bc3f7f086f7c58461b"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="d3a261e4c9d537e840adeac7cec6117e1dfee9c5bca058d50f15f4416da4e4fa"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}]}, @NL80211_ATTR_REKEY_DATA={0x88, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="b9aaa9364700cce6e07a5f3acae550dcf0492aa552818e07"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x8}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="50646b2ea87d9f25e5ec09cdb297bd92"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="76103e244291e96d572afbe0b02a7668"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="abb86627e644b2e0fd184fe501810e7f"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="66f03bae648b30737e187c6beabcec3195e5919a052db232"}, @NL80211_REKEY_DATA_AKM={0x8}]}, @NL80211_ATTR_REKEY_DATA={0x28, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="345e0d511b48fb59777a3196864b7a25244b0607c51892f2098c30882cd68a7b"}]}, @NL80211_ATTR_REKEY_DATA={0x38, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="ff442c921c34cdbb600e4ce58e158582a4acbe1b50a6b7b9de494e46746d06d8"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x9}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x480000}]}, @NL80211_ATTR_REKEY_DATA={0x78, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xffffff76}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="bc2b774713f2e22d0c1db4746fb7851f80ac8155a8cf356c"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "00ec56a0bdab83b0"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="f8343c67dfd2d45355d1d8eb43878009"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "16690120428e9e9d"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="c0ae377b690424a720687f264b5ff34c"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x80000001}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4}]}, @NL80211_ATTR_REKEY_DATA={0x44, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="f72fc269da503a4c292b3a950d9a85b9f52b5f0a75bff8e252bdb26b45779f74"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="57beaf4b52860f6e68772c8c94c8d5e6"}]}, @NL80211_ATTR_REKEY_DATA={0x84, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "5a29ce5d38cb1aa8"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xffffffff}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="3d693c8fa5940f933c985eade14121841946a42a23cb552ad9f40728bf1d35eb"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="b4f2c5858ef0e78aab58f7330a477b47"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "44a1a6ee4d3a5906"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "85170c7911100e12"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="04c6afcb74e04f52fd33d8c94204257d"}]}]}, 0x3bc}}, 0x40000) sendmsg$TIPC_CMD_GET_NETID(r0, &(0x7f0000000180)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000100)={0x1c, r1, 0x8, 0x70bd2b, 0x25dfdbfe, {}, ["", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x400c000}, 0x5) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r0) (async) syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), r0) (async) syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$TIPC_CMD_SHOW_STATS(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r1, 0x233}, 0x1c}}, 0x0) (async) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000240)={&(0x7f00000003c0)={0x3bc, 0x0, 0x100, 0x70bd25, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x45d8, 0x5a}}}}, [@NL80211_ATTR_REKEY_DATA={0x3c, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "5da184a9c2714a71"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="c986cf87ec1214c450621af33cb397a1fe7837cdeb78efc2eee4a7610d9889a6"}, @NL80211_REKEY_DATA_AKM={0x8}]}, @NL80211_ATTR_REKEY_DATA={0xec, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="c47b8c0ef525022e366383ef187c1071fbda1f435cbb6e86"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="53cf2393c63cf5db5affc6a053aa132da158edbc371f28b3"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="38a650f8f88dee668ad0223f78d642d8"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="dc544cfde2ec6e206f181836a91ffa92e0c231264807481095255143aa07189a"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="1201f5e56f44946adfb7926cfec68525"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="5a0ac48862497bc1365ba31254cac1209026fc8fd4e1898d"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="2053546ef09e79f257e039a4ce92d9c1d6aa5631edef9f6f"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="97216387ddda75670e443f48b24976fcb45faafd9eacac522307985f46f65ed5"}]}, @NL80211_ATTR_REKEY_DATA={0x4c, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="b96a6ecbbf331d118d65a0c8dac030bc3f7f086f7c58461b"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="d3a261e4c9d537e840adeac7cec6117e1dfee9c5bca058d50f15f4416da4e4fa"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}]}, @NL80211_ATTR_REKEY_DATA={0x88, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="b9aaa9364700cce6e07a5f3acae550dcf0492aa552818e07"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x8}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="50646b2ea87d9f25e5ec09cdb297bd92"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="76103e244291e96d572afbe0b02a7668"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="abb86627e644b2e0fd184fe501810e7f"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="66f03bae648b30737e187c6beabcec3195e5919a052db232"}, @NL80211_REKEY_DATA_AKM={0x8}]}, @NL80211_ATTR_REKEY_DATA={0x28, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="345e0d511b48fb59777a3196864b7a25244b0607c51892f2098c30882cd68a7b"}]}, @NL80211_ATTR_REKEY_DATA={0x38, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="ff442c921c34cdbb600e4ce58e158582a4acbe1b50a6b7b9de494e46746d06d8"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x9}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x480000}]}, @NL80211_ATTR_REKEY_DATA={0x78, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xffffff76}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="bc2b774713f2e22d0c1db4746fb7851f80ac8155a8cf356c"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "00ec56a0bdab83b0"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="f8343c67dfd2d45355d1d8eb43878009"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "16690120428e9e9d"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="c0ae377b690424a720687f264b5ff34c"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x80000001}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4}]}, @NL80211_ATTR_REKEY_DATA={0x44, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="f72fc269da503a4c292b3a950d9a85b9f52b5f0a75bff8e252bdb26b45779f74"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="57beaf4b52860f6e68772c8c94c8d5e6"}]}, @NL80211_ATTR_REKEY_DATA={0x84, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "5a29ce5d38cb1aa8"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xffffffff}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="3d693c8fa5940f933c985eade14121841946a42a23cb552ad9f40728bf1d35eb"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="b4f2c5858ef0e78aab58f7330a477b47"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "44a1a6ee4d3a5906"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "85170c7911100e12"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="04c6afcb74e04f52fd33d8c94204257d"}]}]}, 0x3bc}}, 0x40000) (async) sendmsg$TIPC_CMD_GET_NETID(r0, &(0x7f0000000180)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000100)={0x1c, r1, 0x8, 0x70bd2b, 0x25dfdbfe, {}, ["", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x400c000}, 0x5) (async) 15:29:42 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_LINK_PRI(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x68, r1, 0x10, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x4c, 0x18, {0x9, @link='broadcast-link\x00'}}}, ["", "", "", "", "", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x4000050}, 0x40) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) syz_genetlink_get_family_id$tipc(&(0x7f0000000080), 0xffffffffffffffff) (async) sendmsg$TIPC_CMD_SET_LINK_PRI(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x68, r1, 0x10, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x4c, 0x18, {0x9, @link='broadcast-link\x00'}}}, ["", "", "", "", "", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x4000050}, 0x40) (async) 15:29:42 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) getsockopt$PNPIPE_IFINDEX(r1, 0x113, 0x2, &(0x7f0000000080), &(0x7f00000001c0)=0x4) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8128", 0x3) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0xbbd36cde67aaa33d}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="a8100000", @ANYRES16=r2, @ANYBLOB="00022dbd7000fbdbdf25810000009010330028940300080211000001ffffffffffff50505050505059000802110000010802110000010010b61cfccc8de480b5d55c76d03bff29a64179f9190abb405e40c5ff7dbaab4d38fc4cec0ad28112f6a63bb38c84e0e3e94b7856024aa6ccd8758b34c06d6b279308db6cb9b778566aba043f1ab1e0b9f3e8e0c458e804c0e15665bff3a5705cbc8e07d83059db4e54c77cc16b09987abedabb4037568111aadf66bd5d190419c5991428183114c293c207ec417dc378bf8a92e508162487fdc0628a37cc25b5749fc8d66b48a97a2befa01f8dad87eda4fb2fb40abc3e0af1017681f70d7c47e2909762ffc44749d71367c398aba6169f55c5c3fea114d61f8ed1f9b047817629d705951a215c2ab61de93c0fa002bd702eda9f74fb4039799b4d60c4df5437397d9f07378da01fe7788f952d5c7bb03a999bc3a1a32f57dc4ae9b63a0de98ab10e228f3284dcb2ac7972c843ac5dfa712d5e099d9fd4d3e7f8ceb807ad9012f4b771bfa850c100ebc63b7df2344d1900d673f8b7971ae9fcfe2b193a0d833255f382b1a11ae2539847ee895a0ee13c881be015da7f21ad52927757f0bad04a54e128e4375b86b7138da4186ed21725195254d1238b4cf80283ce61e099c305ec5234611726e768a447ed67e7d0310d216d04ea17aef211c34a41e0742b2993b7d104d3d159c30a4eb888220e99f65d6e5d7e97782bc7472dd8d4af70438e5556c088c0c0b7b166f851e9be9ecc057b6ef076778a7ed3a641cc2a15ba5f363ce86ed340eecee2f045aadd97b52d072cb4c1e2c8af2c6b095b2e169b275049e2e7f9665745ca0e848475afc252badbd8e9fb3a5a312500e5cc402b384664a94ffd4eee81a95ef56b1dccee416bfb23cd179080fb83022a4cfd79541b90d31e6f5d885802e36eb417b689e3abcf0f69f90390f3ab57e294db6da3032fe89bd4e1b942c72e4ed7cb0db725148a4d97f584d6d9c10bcd83d4dcba5d3470f0e45e4ce686be7c642b67b8b1bafc25cb9a9d02209d32ee55ff06abc08d4bad483e36f000c6de61a7a5b5ca411d268f343ca8eaffc1697e92ac150341a4399acded00b4ba8862985c1240ef605eec9643324a7b96d484017f4a4a966f0e7570bc5e2e8fb33bc6e2bf33f9ff96e2ebb8c2414cda371823defd2cd9d4f2bb2bd5a54774e9bc4b23e28df775421dc3f1af47ce67e938acbc64f859a12d13556e5f09d33004afee91547b8d4fb602b67c3ad949221a7dd8ee637ce9976f076a2db321c0335d4ab797b789232212c48d0e81770c845808f94bfaa613c59061a0401db8b99a1a07251f253034954154e06b46db4596460e184c64ce22abb20686dd1c37dea9ea3b48996a5c8f83bfa2f5da26a53efd5e22597f76147f1563b7dcd436324fcdf3f6a24ed40837539ff3af17a6bc297abe0ce1dcb9e0c852085db97417490586fdcb27a5a1da18632891e5bda86de41319070f598523a90a43732fbfcd2f063836cdca369b2767b3eede5d755d41ed6b4ffdb825dd90b244bd4ad7c260e4ebd504ac3becf537c137278c7ade396e9b8fe3473be29c0e543ea21af17361f2d624beaac06d7c1caac0997ffc130d2c0e4f9ff426661bd34e3491832dcb369a0f850b895119dc325fdadc19e402e2e028ede71f2d7f46e3f42c7e40db2936d2c0ef6b516f5191c4b4974905106292d894918415417f504a301962818018b2ab84959495fd9af5c2c38ec87ff5c749175babc17abb441c6d87dc8138f6106bfac3ad5be77a5c63e4c896cced9b88a3469c48d083ea4ea6b79d12c043f7deff42910a3401d3102a90acd60a2d7243c2ae3e895dd68c327324aef41d85c555ad8ccb30faa0c68bbeb18a62bcfd6f548b67cd0958d300b88b9a2d13737c2a0bbd9b78de6c16dc19cd82467c86da7067f79c8cd6d4c616ba7ea14dc578ccc615ab276e50496ba9d33fae4f449f000788b6943c51ba922ec1edc7664130a7f46dcf6b5a9e03dabb08254ecc4ecb736fe68e78e6eabd23ac2f16090c34cc9845b9a7145512aa3342100c3e59374a41328a700439aa27180ed449eb65e2aa9f74706c6609994173a696fade9ae71c18fdbbf1fb9f126c836117df5a339532aca8e8094ab9f6781272cd3f9099a10e477788777e1bb65432740276aa59f76c2db9415de1b64ff6a30f7eda4cde66a0ae3db944d8d7194c4d37de4d3b5fdc900a8e7aa15728c4a570f78f03a86e971360ecfbec8a2a5353203ca03ec7ee1999d1a687da35c0fffb21d4c1c2edcd072393d1c7e71636eb4ef295fa96d54ed93f4f88b0fc2389a1fb6bb895960475565e896f83903a885758c52ff7e8b992b7cec0d4b8bccc721f85c8c9e8557a551f8d1d52afbdd7a99cbb009999d7938998a336cfca7a4dea97f80fa167d84034c147767e2743a33959e616df1f607cfb513bb4937c4628f754e7858af0f4abfe61a7b3829c7bb6a88d67d9c26949132b6a4ae434550180d9286485609376b9374c79348e8910f732d824f75956c26c0eda7c377d4a4966ea6d25a6c439b70df45f08cfc091d5ee65cc9175f45aaff4af5fe7b960e93ed96d6c17e643faa2db04dfd15753a6d64c18a37fe98c6416df2aa78e24cce7be9ae511cdb0832169d493dcb52175ec24220644e949c88b5fd4ae10fe01931358f14a38be5e1d25a76cdf7b4c821236ee8581602e2edfdd438b22fb1cb437fb4ec034281de483e1824b768f26234b3b86c624461f3e54641669eed24a98dbed279c43bf78d5cd1cdf541964090a2d6c575021b0adb38d43b49db900885d22a69693eca403ba558e6ea51cfc58c46a27b898e38a82a973525735dca6561483edf619b9824970ff113697de9eda3072ac3bec3dfcd5949c699fab86d09133dca2de23a1651b350497affab6500c06a88283f38e037bf9efaf9e9ab893d4783b269a6e30d9732770d3f59611c75da2ab5cb7deecd9f078fe2354d571368b7a3f5df18f4390b5f2b7ccf4b08039ee06ac4366da513a4442b3f9ccc3cc000a6e62d2cdda72fce8f9c8a2d83d3b4fbf3cbbd8ec300a9686f53d6a6107496f86dafdb38d174927d025bde286b123355c09af2485781388485a84c2a871650f60cdab267147c51f67f4001652e47011661b60c2035d8791b20dcf63f12e2e59b491ba298fe1f11d1c654824472af4178af7e0b2e11eeb446a33b13e47005ceabc2c7c27f42bb769534b92c8ccad5569c3a8c341c5a0b67483e209d7a5c03081d4aafaecfa2583360b76fb74aad46ccd47105b1ff88b87e57cfa546513ab4bf204a082efaa7b47758906eae45b9cfb5f475615b6dd43fc97b23591bae620015bac92f7addc9006515f500c74dc8c22eb6b1a035054236768880e497a38038afc716b50f5aa504776e0087b6a07c022d5cfca0038c133a60372dc547797879d23092025fab2599d217dc9f0df4665e61bc7da81d400a5bac9115d8ad3c1b058b15a28f06ebe6b89e139cc7cee973b4d1a31d6b9cf48778baf6930805feb00f56f13f92eb8b34d9646f0cf3377cfd0aa7adcc7c8a9af1041204bfb438cb06a2511cbc2f22e7316460928ee143489bd90830d076802ed1971d7a8a7b0a831bb7f9f029e96eadd085f2f4a50fee92bbe253a8b0216523d1cd631ea99b9b01264d4f42a69b6f1b232bc8041d188c20a2fa7a4b66fc83b878e06c91ffc58421937425173ca440bd096c64507b247c751c4bfdb8b1e3f33991a8cdbe5fbbaac20635cb31e47bde174f689829d8ca5f874ef53970319edd4e83953c370d0b71a05c054f74d0bf19ba6f10c192ae2af490ea84ffac5b57cddd89f328d9a7bed45b5b79c72950637726344366fbcc8297f8442e947b7066c56480fa6cd24ecc648b1633b578894a887a9ba7373a932d3589d2650b4abcfd11ae9bee41c3b2d3a957e19403054da7b55c1f938124508dec93dd3a0821a7be678a7879e8f63adb0bca5eecdf150b82ed949b339d9cba8be028da2cde6ba62609a48659a123c19b3f0185918dacc462ba6332e39f29732be01da067b5feb0a1c980f9e7726b3f310cfc3671a63d13397bc663ff85915b1c525f06fa106fa370b09ac870b49281189ec8782469485860b39581d509852e07065808c30a3c4796604f9f17e057cf1f2b9a4c0e26f388508984f30aedcca5bb412b7001f9b4d62c1cedea389bf4fbb9c95690f04fb8cbd62596ddff092dda6f0cad1d7a2088d99578c96cbacbe7e054362820f3e5ab308fb17a7908686d5a057ce09d4380b2289cc69bb50bde650fdaa6ae03a4a59d5d1ca837386e062e62c0d80fb6435070bd6ae7bfb7bc2496fd0dca0799684faaa0be9a5e43069d75cdf9b47f8f309fec70a887651d563a3094b08a9038211e0dfe91b14e8deab8ae1709083c1c2d3f4a194efdbb7754f84eedabf6e6c00174721de3990ae56a7a015c8279a8d53ea286b3a3684d5d717a001c659f6e0700ea3a49021e8120cb6559927fbb4aaadbcd2969cd848562f4e3a320c9182c955815a0d7b6a1936b572c0d705b4fce84b6599c800c1902756facdd9229ece49f9529365926e9264a5e990719683ee5a29eb901accf0fc73fabad58d9853102d2d8ac14f4b7acc83204e4a4b23feb851d6a64174a0dce450fb54f7578dba5c8e5dcb86161324735bc86ae8c9ff46b91330350f0f51aea323a6137addd371c23897d7cb0e434911c031eb7f11984f60e263de3c00166131b58afe8dc422284dab344b92926f923131c5490cd5dca4a5d05337bcb0b10404d2ccfae7b81b050f9d01f328ce1ce9b0d4ef87958ccca3fd410c8232c20857e0184de50a4ec585cd895a443ae1991480380eb0e249bfc8e799ad56c905052b6a4eac1ef36f4d17140ec3878918c2420c778f21e66df00e6b8945b46d65291379b7aedc25b4e8d4776303ae36cc5fbc28d01fb00f7f9e478e3dea004dca719c1a1970ee11a2fa820b71a1bd711626054919c3930db6fdfdd39d5dd14f3ab64f74bd0126cb3c3edca278332fdec77d392c14ffd81e530b9f715dadf919e9d8e10216e487b9a46595b0c8172cc2cc71aa1c821338f121ce9d4299daa0646466cfe0dd6df0698555fad26f20be9144fc2d09c23c11d42e1bf03121e4406d1b5ed94d82efab990a80788bb22fe013c59c0073d209fffe7c98e52c9638f765686d1d93c6072c3dabae3b11812541eaea0d7dc092590c45691065559bb1ba2e5268cb69aa8e35b3211a1348f9370063ffd1d8d6e2b7281d079df981c61310c02c5e7a6ca18cd64b9ebac1cf5f4ff1eedb8262cb4e2b1a7003e492ffe7c0b1d6d99528fe4b8ea5deec5aae26d0c588389eaf2db82e73530def6e5b7868fec5194780c6281eb8decaa5d0852a2fc2fed0f03ac5eedeccf8df890d61820ecdb140f1d9e96bb0415fac586b46a7ff75f9502754f0d9b4a7478ebd6d1d163de9c68974deca70249cefafdf3253002bb73c8d830d4ca81562323220e07d0416336861e8777f8fed6b56803fd23515ecd8749951395ab61529bc5e3c1d581e9f2d0cb38588d4984b9d1742488e581718164a90b4c94f80720207439fdd63c50f0fe9641237b8b20b24eb7cd79b422a9fa78796d3f7391fa1673ee7b725ece043e1f01c690e6edaca0a854506b871e8095ba0dd6429a087eed34fdea37fd20eb5699db773a90bbd10890cb484831ca1b0ca0a719ec02ed6541594aa0956a85b45c335d550b2bef03fb78b164ffbe6eb9a4e6cb527b3090bdc8c1d08dd1f8834075576e6a5689ec89d1499579cb1dd81321e4c50887f17d46bfd0bd0487284b7961118f4d232c5929725be6d940687e1a94a9fc487477c28420000080211000000ffffffffffff5300ef5527f6f37a69268680d8f42aaf6c4df57cdc348674015ad42c8807542f6242e8199da67cda2f010172e2d7f62e0858a06b57904eda51c721af38b0017e12286bc607829b9f8b8638703e03470470a89f9fd600"/4257], 0x10a8}, 0x1, 0x0, 0x0, 0x200000c5}, 0x10) 15:29:42 executing program 4: sendmsg$NLBL_MGMT_C_VERSION(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x34, 0x0, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0xffffffffffffffff}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0x1}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x2}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @remote}]}, 0x34}, 0x1, 0x0, 0x0, 0x405c0c4}, 0x80) (async) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:42 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, 0xffffffffffffffff, 0xbb, &(0x7f0000000080)=""/195) 15:29:42 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4c, 0x0, &(0x7f0000000240)=[@reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000080)=""/137, 0x89, 0x2, 0xb}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/39, 0x27, 0x0, 0x37}, @fda={0x66646185, 0x5, 0x2, 0xb}}, &(0x7f0000000200)={0x0, 0x28, 0x50}}, 0x1000}], 0xec, 0x0, &(0x7f00000002c0)="3aa5705e1426af3fdefa4e41d570df45d859156316ee21483c63d7a9a2107360bfa48ae84aa2f484c6b87c3e1430e0c004d8a93dc8ffb96b054d05eccb4b699068a6566657660150184d158758a1c683ef16c20b268ad01766d9b6a7f2bee532ed4b08e6c910a3331dcf96898199ed5c628f56c99e955702ff395664ceaf68e7417c809893a2770f91bd359c0d9ca2fed04bb2cba5061951c76effbf850919ae0f199e27eda0a5c3c4a18af3e313acc1166fdab757f087f41639a1394ca699ef3883c5bc466151fb496185a9d1bd84bec607a08da135150c32cab6364781dee1a8a89d166bfe6d3c1b370e7e"}) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:42 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000), 0x2e) epoll_wait(0xffffffffffffffff, &(0x7f0000000080)=[{}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0) 15:29:42 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) getsockopt$PNPIPE_IFINDEX(r1, 0x113, 0x2, &(0x7f0000000080), &(0x7f00000001c0)=0x4) write$qrtrtun(r0, &(0x7f0000000000)="de8128", 0x3) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0xbbd36cde67aaa33d}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="a8100000", @ANYRES16=r2, @ANYBLOB="00022dbd7000fbdbdf25810000009010330028940300080211000001ffffffffffff50505050505059000802110000010802110000010010b61cfccc8de480b5d55c76d03bff29a64179f9190abb405e40c5ff7dbaab4d38fc4cec0ad28112f6a63bb38c84e0e3e94b7856024aa6ccd8758b34c06d6b279308db6cb9b778566aba043f1ab1e0b9f3e8e0c458e804c0e15665bff3a5705cbc8e07d83059db4e54c77cc16b09987abedabb4037568111aadf66bd5d190419c5991428183114c293c207ec417dc378bf8a92e508162487fdc0628a37cc25b5749fc8d66b48a97a2befa01f8dad87eda4fb2fb40abc3e0af1017681f70d7c47e2909762ffc44749d71367c398aba6169f55c5c3fea114d61f8ed1f9b047817629d705951a215c2ab61de93c0fa002bd702eda9f74fb4039799b4d60c4df5437397d9f07378da01fe7788f952d5c7bb03a999bc3a1a32f57dc4ae9b63a0de98ab10e228f3284dcb2ac7972c843ac5dfa712d5e099d9fd4d3e7f8ceb807ad9012f4b771bfa850c100ebc63b7df2344d1900d673f8b7971ae9fcfe2b193a0d833255f382b1a11ae2539847ee895a0ee13c881be015da7f21ad52927757f0bad04a54e128e4375b86b7138da4186ed21725195254d1238b4cf80283ce61e099c305ec5234611726e768a447ed67e7d0310d216d04ea17aef211c34a41e0742b2993b7d104d3d159c30a4eb888220e99f65d6e5d7e97782bc7472dd8d4af70438e5556c088c0c0b7b166f851e9be9ecc057b6ef076778a7ed3a641cc2a15ba5f363ce86ed340eecee2f045aadd97b52d072cb4c1e2c8af2c6b095b2e169b275049e2e7f9665745ca0e848475afc252badbd8e9fb3a5a312500e5cc402b384664a94ffd4eee81a95ef56b1dccee416bfb23cd179080fb83022a4cfd79541b90d31e6f5d885802e36eb417b689e3abcf0f69f90390f3ab57e294db6da3032fe89bd4e1b942c72e4ed7cb0db725148a4d97f584d6d9c10bcd83d4dcba5d3470f0e45e4ce686be7c642b67b8b1bafc25cb9a9d02209d32ee55ff06abc08d4bad483e36f000c6de61a7a5b5ca411d268f343ca8eaffc1697e92ac150341a4399acded00b4ba8862985c1240ef605eec9643324a7b96d484017f4a4a966f0e7570bc5e2e8fb33bc6e2bf33f9ff96e2ebb8c2414cda371823defd2cd9d4f2bb2bd5a54774e9bc4b23e28df775421dc3f1af47ce67e938acbc64f859a12d13556e5f09d33004afee91547b8d4fb602b67c3ad949221a7dd8ee637ce9976f076a2db321c0335d4ab797b789232212c48d0e81770c845808f94bfaa613c59061a0401db8b99a1a07251f253034954154e06b46db4596460e184c64ce22abb20686dd1c37dea9ea3b48996a5c8f83bfa2f5da26a53efd5e22597f76147f1563b7dcd436324fcdf3f6a24ed40837539ff3af17a6bc297abe0ce1dcb9e0c852085db97417490586fdcb27a5a1da18632891e5bda86de41319070f598523a90a43732fbfcd2f063836cdca369b2767b3eede5d755d41ed6b4ffdb825dd90b244bd4ad7c260e4ebd504ac3becf537c137278c7ade396e9b8fe3473be29c0e543ea21af17361f2d624beaac06d7c1caac0997ffc130d2c0e4f9ff426661bd34e3491832dcb369a0f850b895119dc325fdadc19e402e2e028ede71f2d7f46e3f42c7e40db2936d2c0ef6b516f5191c4b4974905106292d894918415417f504a301962818018b2ab84959495fd9af5c2c38ec87ff5c749175babc17abb441c6d87dc8138f6106bfac3ad5be77a5c63e4c896cced9b88a3469c48d083ea4ea6b79d12c043f7deff42910a3401d3102a90acd60a2d7243c2ae3e895dd68c327324aef41d85c555ad8ccb30faa0c68bbeb18a62bcfd6f548b67cd0958d300b88b9a2d13737c2a0bbd9b78de6c16dc19cd82467c86da7067f79c8cd6d4c616ba7ea14dc578ccc615ab276e50496ba9d33fae4f449f000788b6943c51ba922ec1edc7664130a7f46dcf6b5a9e03dabb08254ecc4ecb736fe68e78e6eabd23ac2f16090c34cc9845b9a7145512aa3342100c3e59374a41328a700439aa27180ed449eb65e2aa9f74706c6609994173a696fade9ae71c18fdbbf1fb9f126c836117df5a339532aca8e8094ab9f6781272cd3f9099a10e477788777e1bb65432740276aa59f76c2db9415de1b64ff6a30f7eda4cde66a0ae3db944d8d7194c4d37de4d3b5fdc900a8e7aa15728c4a570f78f03a86e971360ecfbec8a2a5353203ca03ec7ee1999d1a687da35c0fffb21d4c1c2edcd072393d1c7e71636eb4ef295fa96d54ed93f4f88b0fc2389a1fb6bb895960475565e896f83903a885758c52ff7e8b992b7cec0d4b8bccc721f85c8c9e8557a551f8d1d52afbdd7a99cbb009999d7938998a336cfca7a4dea97f80fa167d84034c147767e2743a33959e616df1f607cfb513bb4937c4628f754e7858af0f4abfe61a7b3829c7bb6a88d67d9c26949132b6a4ae434550180d9286485609376b9374c79348e8910f732d824f75956c26c0eda7c377d4a4966ea6d25a6c439b70df45f08cfc091d5ee65cc9175f45aaff4af5fe7b960e93ed96d6c17e643faa2db04dfd15753a6d64c18a37fe98c6416df2aa78e24cce7be9ae511cdb0832169d493dcb52175ec24220644e949c88b5fd4ae10fe01931358f14a38be5e1d25a76cdf7b4c821236ee8581602e2edfdd438b22fb1cb437fb4ec034281de483e1824b768f26234b3b86c624461f3e54641669eed24a98dbed279c43bf78d5cd1cdf541964090a2d6c575021b0adb38d43b49db900885d22a69693eca403ba558e6ea51cfc58c46a27b898e38a82a973525735dca6561483edf619b9824970ff113697de9eda3072ac3bec3dfcd5949c699fab86d09133dca2de23a1651b350497affab6500c06a88283f38e037bf9efaf9e9ab893d4783b269a6e30d9732770d3f59611c75da2ab5cb7deecd9f078fe2354d571368b7a3f5df18f4390b5f2b7ccf4b08039ee06ac4366da513a4442b3f9ccc3cc000a6e62d2cdda72fce8f9c8a2d83d3b4fbf3cbbd8ec300a9686f53d6a6107496f86dafdb38d174927d025bde286b123355c09af2485781388485a84c2a871650f60cdab267147c51f67f4001652e47011661b60c2035d8791b20dcf63f12e2e59b491ba298fe1f11d1c654824472af4178af7e0b2e11eeb446a33b13e47005ceabc2c7c27f42bb769534b92c8ccad5569c3a8c341c5a0b67483e209d7a5c03081d4aafaecfa2583360b76fb74aad46ccd47105b1ff88b87e57cfa546513ab4bf204a082efaa7b47758906eae45b9cfb5f475615b6dd43fc97b23591bae620015bac92f7addc9006515f500c74dc8c22eb6b1a035054236768880e497a38038afc716b50f5aa504776e0087b6a07c022d5cfca0038c133a60372dc547797879d23092025fab2599d217dc9f0df4665e61bc7da81d400a5bac9115d8ad3c1b058b15a28f06ebe6b89e139cc7cee973b4d1a31d6b9cf48778baf6930805feb00f56f13f92eb8b34d9646f0cf3377cfd0aa7adcc7c8a9af1041204bfb438cb06a2511cbc2f22e7316460928ee143489bd90830d076802ed1971d7a8a7b0a831bb7f9f029e96eadd085f2f4a50fee92bbe253a8b0216523d1cd631ea99b9b01264d4f42a69b6f1b232bc8041d188c20a2fa7a4b66fc83b878e06c91ffc58421937425173ca440bd096c64507b247c751c4bfdb8b1e3f33991a8cdbe5fbbaac20635cb31e47bde174f689829d8ca5f874ef53970319edd4e83953c370d0b71a05c054f74d0bf19ba6f10c192ae2af490ea84ffac5b57cddd89f328d9a7bed45b5b79c72950637726344366fbcc8297f8442e947b7066c56480fa6cd24ecc648b1633b578894a887a9ba7373a932d3589d2650b4abcfd11ae9bee41c3b2d3a957e19403054da7b55c1f938124508dec93dd3a0821a7be678a7879e8f63adb0bca5eecdf150b82ed949b339d9cba8be028da2cde6ba62609a48659a123c19b3f0185918dacc462ba6332e39f29732be01da067b5feb0a1c980f9e7726b3f310cfc3671a63d13397bc663ff85915b1c525f06fa106fa370b09ac870b49281189ec8782469485860b39581d509852e07065808c30a3c4796604f9f17e057cf1f2b9a4c0e26f388508984f30aedcca5bb412b7001f9b4d62c1cedea389bf4fbb9c95690f04fb8cbd62596ddff092dda6f0cad1d7a2088d99578c96cbacbe7e054362820f3e5ab308fb17a7908686d5a057ce09d4380b2289cc69bb50bde650fdaa6ae03a4a59d5d1ca837386e062e62c0d80fb6435070bd6ae7bfb7bc2496fd0dca0799684faaa0be9a5e43069d75cdf9b47f8f309fec70a887651d563a3094b08a9038211e0dfe91b14e8deab8ae1709083c1c2d3f4a194efdbb7754f84eedabf6e6c00174721de3990ae56a7a015c8279a8d53ea286b3a3684d5d717a001c659f6e0700ea3a49021e8120cb6559927fbb4aaadbcd2969cd848562f4e3a320c9182c955815a0d7b6a1936b572c0d705b4fce84b6599c800c1902756facdd9229ece49f9529365926e9264a5e990719683ee5a29eb901accf0fc73fabad58d9853102d2d8ac14f4b7acc83204e4a4b23feb851d6a64174a0dce450fb54f7578dba5c8e5dcb86161324735bc86ae8c9ff46b91330350f0f51aea323a6137addd371c23897d7cb0e434911c031eb7f11984f60e263de3c00166131b58afe8dc422284dab344b92926f923131c5490cd5dca4a5d05337bcb0b10404d2ccfae7b81b050f9d01f328ce1ce9b0d4ef87958ccca3fd410c8232c20857e0184de50a4ec585cd895a443ae1991480380eb0e249bfc8e799ad56c905052b6a4eac1ef36f4d17140ec3878918c2420c778f21e66df00e6b8945b46d65291379b7aedc25b4e8d4776303ae36cc5fbc28d01fb00f7f9e478e3dea004dca719c1a1970ee11a2fa820b71a1bd711626054919c3930db6fdfdd39d5dd14f3ab64f74bd0126cb3c3edca278332fdec77d392c14ffd81e530b9f715dadf919e9d8e10216e487b9a46595b0c8172cc2cc71aa1c821338f121ce9d4299daa0646466cfe0dd6df0698555fad26f20be9144fc2d09c23c11d42e1bf03121e4406d1b5ed94d82efab990a80788bb22fe013c59c0073d209fffe7c98e52c9638f765686d1d93c6072c3dabae3b11812541eaea0d7dc092590c45691065559bb1ba2e5268cb69aa8e35b3211a1348f9370063ffd1d8d6e2b7281d079df981c61310c02c5e7a6ca18cd64b9ebac1cf5f4ff1eedb8262cb4e2b1a7003e492ffe7c0b1d6d99528fe4b8ea5deec5aae26d0c588389eaf2db82e73530def6e5b7868fec5194780c6281eb8decaa5d0852a2fc2fed0f03ac5eedeccf8df890d61820ecdb140f1d9e96bb0415fac586b46a7ff75f9502754f0d9b4a7478ebd6d1d163de9c68974deca70249cefafdf3253002bb73c8d830d4ca81562323220e07d0416336861e8777f8fed6b56803fd23515ecd8749951395ab61529bc5e3c1d581e9f2d0cb38588d4984b9d1742488e581718164a90b4c94f80720207439fdd63c50f0fe9641237b8b20b24eb7cd79b422a9fa78796d3f7391fa1673ee7b725ece043e1f01c690e6edaca0a854506b871e8095ba0dd6429a087eed34fdea37fd20eb5699db773a90bbd10890cb484831ca1b0ca0a719ec02ed6541594aa0956a85b45c335d550b2bef03fb78b164ffbe6eb9a4e6cb527b3090bdc8c1d08dd1f8834075576e6a5689ec89d1499579cb1dd81321e4c50887f17d46bfd0bd0487284b7961118f4d232c5929725be6d940687e1a94a9fc487477c28420000080211000000ffffffffffff5300ef5527f6f37a69268680d8f42aaf6c4df57cdc348674015ad42c8807542f6242e8199da67cda2f010172e2d7f62e0858a06b57904eda51c721af38b0017e12286bc607829b9f8b8638703e03470470a89f9fd600"/4257], 0x10a8}, 0x1, 0x0, 0x0, 0x200000c5}, 0x10) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) getsockopt$PNPIPE_IFINDEX(r1, 0x113, 0x2, &(0x7f0000000080), &(0x7f00000001c0)=0x4) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8128", 0x3) (async) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) (async) sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0xbbd36cde67aaa33d}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="a8100000", @ANYRES16=r2, @ANYBLOB="00022dbd7000fbdbdf25810000009010330028940300080211000001ffffffffffff50505050505059000802110000010802110000010010b61cfccc8de480b5d55c76d03bff29a64179f9190abb405e40c5ff7dbaab4d38fc4cec0ad28112f6a63bb38c84e0e3e94b7856024aa6ccd8758b34c06d6b279308db6cb9b778566aba043f1ab1e0b9f3e8e0c458e804c0e15665bff3a5705cbc8e07d83059db4e54c77cc16b09987abedabb4037568111aadf66bd5d190419c5991428183114c293c207ec417dc378bf8a92e508162487fdc0628a37cc25b5749fc8d66b48a97a2befa01f8dad87eda4fb2fb40abc3e0af1017681f70d7c47e2909762ffc44749d71367c398aba6169f55c5c3fea114d61f8ed1f9b047817629d705951a215c2ab61de93c0fa002bd702eda9f74fb4039799b4d60c4df5437397d9f07378da01fe7788f952d5c7bb03a999bc3a1a32f57dc4ae9b63a0de98ab10e228f3284dcb2ac7972c843ac5dfa712d5e099d9fd4d3e7f8ceb807ad9012f4b771bfa850c100ebc63b7df2344d1900d673f8b7971ae9fcfe2b193a0d833255f382b1a11ae2539847ee895a0ee13c881be015da7f21ad52927757f0bad04a54e128e4375b86b7138da4186ed21725195254d1238b4cf80283ce61e099c305ec5234611726e768a447ed67e7d0310d216d04ea17aef211c34a41e0742b2993b7d104d3d159c30a4eb888220e99f65d6e5d7e97782bc7472dd8d4af70438e5556c088c0c0b7b166f851e9be9ecc057b6ef076778a7ed3a641cc2a15ba5f363ce86ed340eecee2f045aadd97b52d072cb4c1e2c8af2c6b095b2e169b275049e2e7f9665745ca0e848475afc252badbd8e9fb3a5a312500e5cc402b384664a94ffd4eee81a95ef56b1dccee416bfb23cd179080fb83022a4cfd79541b90d31e6f5d885802e36eb417b689e3abcf0f69f90390f3ab57e294db6da3032fe89bd4e1b942c72e4ed7cb0db725148a4d97f584d6d9c10bcd83d4dcba5d3470f0e45e4ce686be7c642b67b8b1bafc25cb9a9d02209d32ee55ff06abc08d4bad483e36f000c6de61a7a5b5ca411d268f343ca8eaffc1697e92ac150341a4399acded00b4ba8862985c1240ef605eec9643324a7b96d484017f4a4a966f0e7570bc5e2e8fb33bc6e2bf33f9ff96e2ebb8c2414cda371823defd2cd9d4f2bb2bd5a54774e9bc4b23e28df775421dc3f1af47ce67e938acbc64f859a12d13556e5f09d33004afee91547b8d4fb602b67c3ad949221a7dd8ee637ce9976f076a2db321c0335d4ab797b789232212c48d0e81770c845808f94bfaa613c59061a0401db8b99a1a07251f253034954154e06b46db4596460e184c64ce22abb20686dd1c37dea9ea3b48996a5c8f83bfa2f5da26a53efd5e22597f76147f1563b7dcd436324fcdf3f6a24ed40837539ff3af17a6bc297abe0ce1dcb9e0c852085db97417490586fdcb27a5a1da18632891e5bda86de41319070f598523a90a43732fbfcd2f063836cdca369b2767b3eede5d755d41ed6b4ffdb825dd90b244bd4ad7c260e4ebd504ac3becf537c137278c7ade396e9b8fe3473be29c0e543ea21af17361f2d624beaac06d7c1caac0997ffc130d2c0e4f9ff426661bd34e3491832dcb369a0f850b895119dc325fdadc19e402e2e028ede71f2d7f46e3f42c7e40db2936d2c0ef6b516f5191c4b4974905106292d894918415417f504a301962818018b2ab84959495fd9af5c2c38ec87ff5c749175babc17abb441c6d87dc8138f6106bfac3ad5be77a5c63e4c896cced9b88a3469c48d083ea4ea6b79d12c043f7deff42910a3401d3102a90acd60a2d7243c2ae3e895dd68c327324aef41d85c555ad8ccb30faa0c68bbeb18a62bcfd6f548b67cd0958d300b88b9a2d13737c2a0bbd9b78de6c16dc19cd82467c86da7067f79c8cd6d4c616ba7ea14dc578ccc615ab276e50496ba9d33fae4f449f000788b6943c51ba922ec1edc7664130a7f46dcf6b5a9e03dabb08254ecc4ecb736fe68e78e6eabd23ac2f16090c34cc9845b9a7145512aa3342100c3e59374a41328a700439aa27180ed449eb65e2aa9f74706c6609994173a696fade9ae71c18fdbbf1fb9f126c836117df5a339532aca8e8094ab9f6781272cd3f9099a10e477788777e1bb65432740276aa59f76c2db9415de1b64ff6a30f7eda4cde66a0ae3db944d8d7194c4d37de4d3b5fdc900a8e7aa15728c4a570f78f03a86e971360ecfbec8a2a5353203ca03ec7ee1999d1a687da35c0fffb21d4c1c2edcd072393d1c7e71636eb4ef295fa96d54ed93f4f88b0fc2389a1fb6bb895960475565e896f83903a885758c52ff7e8b992b7cec0d4b8bccc721f85c8c9e8557a551f8d1d52afbdd7a99cbb009999d7938998a336cfca7a4dea97f80fa167d84034c147767e2743a33959e616df1f607cfb513bb4937c4628f754e7858af0f4abfe61a7b3829c7bb6a88d67d9c26949132b6a4ae434550180d9286485609376b9374c79348e8910f732d824f75956c26c0eda7c377d4a4966ea6d25a6c439b70df45f08cfc091d5ee65cc9175f45aaff4af5fe7b960e93ed96d6c17e643faa2db04dfd15753a6d64c18a37fe98c6416df2aa78e24cce7be9ae511cdb0832169d493dcb52175ec24220644e949c88b5fd4ae10fe01931358f14a38be5e1d25a76cdf7b4c821236ee8581602e2edfdd438b22fb1cb437fb4ec034281de483e1824b768f26234b3b86c624461f3e54641669eed24a98dbed279c43bf78d5cd1cdf541964090a2d6c575021b0adb38d43b49db900885d22a69693eca403ba558e6ea51cfc58c46a27b898e38a82a973525735dca6561483edf619b9824970ff113697de9eda3072ac3bec3dfcd5949c699fab86d09133dca2de23a1651b350497affab6500c06a88283f38e037bf9efaf9e9ab893d4783b269a6e30d9732770d3f59611c75da2ab5cb7deecd9f078fe2354d571368b7a3f5df18f4390b5f2b7ccf4b08039ee06ac4366da513a4442b3f9ccc3cc000a6e62d2cdda72fce8f9c8a2d83d3b4fbf3cbbd8ec300a9686f53d6a6107496f86dafdb38d174927d025bde286b123355c09af2485781388485a84c2a871650f60cdab267147c51f67f4001652e47011661b60c2035d8791b20dcf63f12e2e59b491ba298fe1f11d1c654824472af4178af7e0b2e11eeb446a33b13e47005ceabc2c7c27f42bb769534b92c8ccad5569c3a8c341c5a0b67483e209d7a5c03081d4aafaecfa2583360b76fb74aad46ccd47105b1ff88b87e57cfa546513ab4bf204a082efaa7b47758906eae45b9cfb5f475615b6dd43fc97b23591bae620015bac92f7addc9006515f500c74dc8c22eb6b1a035054236768880e497a38038afc716b50f5aa504776e0087b6a07c022d5cfca0038c133a60372dc547797879d23092025fab2599d217dc9f0df4665e61bc7da81d400a5bac9115d8ad3c1b058b15a28f06ebe6b89e139cc7cee973b4d1a31d6b9cf48778baf6930805feb00f56f13f92eb8b34d9646f0cf3377cfd0aa7adcc7c8a9af1041204bfb438cb06a2511cbc2f22e7316460928ee143489bd90830d076802ed1971d7a8a7b0a831bb7f9f029e96eadd085f2f4a50fee92bbe253a8b0216523d1cd631ea99b9b01264d4f42a69b6f1b232bc8041d188c20a2fa7a4b66fc83b878e06c91ffc58421937425173ca440bd096c64507b247c751c4bfdb8b1e3f33991a8cdbe5fbbaac20635cb31e47bde174f689829d8ca5f874ef53970319edd4e83953c370d0b71a05c054f74d0bf19ba6f10c192ae2af490ea84ffac5b57cddd89f328d9a7bed45b5b79c72950637726344366fbcc8297f8442e947b7066c56480fa6cd24ecc648b1633b578894a887a9ba7373a932d3589d2650b4abcfd11ae9bee41c3b2d3a957e19403054da7b55c1f938124508dec93dd3a0821a7be678a7879e8f63adb0bca5eecdf150b82ed949b339d9cba8be028da2cde6ba62609a48659a123c19b3f0185918dacc462ba6332e39f29732be01da067b5feb0a1c980f9e7726b3f310cfc3671a63d13397bc663ff85915b1c525f06fa106fa370b09ac870b49281189ec8782469485860b39581d509852e07065808c30a3c4796604f9f17e057cf1f2b9a4c0e26f388508984f30aedcca5bb412b7001f9b4d62c1cedea389bf4fbb9c95690f04fb8cbd62596ddff092dda6f0cad1d7a2088d99578c96cbacbe7e054362820f3e5ab308fb17a7908686d5a057ce09d4380b2289cc69bb50bde650fdaa6ae03a4a59d5d1ca837386e062e62c0d80fb6435070bd6ae7bfb7bc2496fd0dca0799684faaa0be9a5e43069d75cdf9b47f8f309fec70a887651d563a3094b08a9038211e0dfe91b14e8deab8ae1709083c1c2d3f4a194efdbb7754f84eedabf6e6c00174721de3990ae56a7a015c8279a8d53ea286b3a3684d5d717a001c659f6e0700ea3a49021e8120cb6559927fbb4aaadbcd2969cd848562f4e3a320c9182c955815a0d7b6a1936b572c0d705b4fce84b6599c800c1902756facdd9229ece49f9529365926e9264a5e990719683ee5a29eb901accf0fc73fabad58d9853102d2d8ac14f4b7acc83204e4a4b23feb851d6a64174a0dce450fb54f7578dba5c8e5dcb86161324735bc86ae8c9ff46b91330350f0f51aea323a6137addd371c23897d7cb0e434911c031eb7f11984f60e263de3c00166131b58afe8dc422284dab344b92926f923131c5490cd5dca4a5d05337bcb0b10404d2ccfae7b81b050f9d01f328ce1ce9b0d4ef87958ccca3fd410c8232c20857e0184de50a4ec585cd895a443ae1991480380eb0e249bfc8e799ad56c905052b6a4eac1ef36f4d17140ec3878918c2420c778f21e66df00e6b8945b46d65291379b7aedc25b4e8d4776303ae36cc5fbc28d01fb00f7f9e478e3dea004dca719c1a1970ee11a2fa820b71a1bd711626054919c3930db6fdfdd39d5dd14f3ab64f74bd0126cb3c3edca278332fdec77d392c14ffd81e530b9f715dadf919e9d8e10216e487b9a46595b0c8172cc2cc71aa1c821338f121ce9d4299daa0646466cfe0dd6df0698555fad26f20be9144fc2d09c23c11d42e1bf03121e4406d1b5ed94d82efab990a80788bb22fe013c59c0073d209fffe7c98e52c9638f765686d1d93c6072c3dabae3b11812541eaea0d7dc092590c45691065559bb1ba2e5268cb69aa8e35b3211a1348f9370063ffd1d8d6e2b7281d079df981c61310c02c5e7a6ca18cd64b9ebac1cf5f4ff1eedb8262cb4e2b1a7003e492ffe7c0b1d6d99528fe4b8ea5deec5aae26d0c588389eaf2db82e73530def6e5b7868fec5194780c6281eb8decaa5d0852a2fc2fed0f03ac5eedeccf8df890d61820ecdb140f1d9e96bb0415fac586b46a7ff75f9502754f0d9b4a7478ebd6d1d163de9c68974deca70249cefafdf3253002bb73c8d830d4ca81562323220e07d0416336861e8777f8fed6b56803fd23515ecd8749951395ab61529bc5e3c1d581e9f2d0cb38588d4984b9d1742488e581718164a90b4c94f80720207439fdd63c50f0fe9641237b8b20b24eb7cd79b422a9fa78796d3f7391fa1673ee7b725ece043e1f01c690e6edaca0a854506b871e8095ba0dd6429a087eed34fdea37fd20eb5699db773a90bbd10890cb484831ca1b0ca0a719ec02ed6541594aa0956a85b45c335d550b2bef03fb78b164ffbe6eb9a4e6cb527b3090bdc8c1d08dd1f8834075576e6a5689ec89d1499579cb1dd81321e4c50887f17d46bfd0bd0487284b7961118f4d232c5929725be6d940687e1a94a9fc487477c28420000080211000000ffffffffffff5300ef5527f6f37a69268680d8f42aaf6c4df57cdc348674015ad42c8807542f6242e8199da67cda2f010172e2d7f62e0858a06b57904eda51c721af38b0017e12286bc607829b9f8b8638703e03470470a89f9fd600"/4257], 0x10a8}, 0x1, 0x0, 0x0, 0x200000c5}, 0x10) (async) 15:29:42 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x1, 0x70bd29, 0x25dfdbfb, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x4000000) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={&(0x7f0000000180), 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=@flushpolicy={0x1e8, 0x1d, 0x400, 0x70bd26, 0x25dfdbfd, "", [@replay_val={0x10, 0xa, {0x70bd28, 0x70bd28, 0x7}}, @algo_comp={0x7c, 0x3, {{'deflate\x00'}, 0x1a0, "d02f32bb3c28a9d7fb87528c0c5e049d27b16ee1d1b8db33f72b7b1d10390fbb50d48fcb19f6c874bdf8e1b4484c9c5d3241376a"}}, @replay_thresh={0x8, 0xb, 0x1}, @replay_val={0x10, 0xa, {0x70bd2c, 0x70bd25, 0x4}}, @algo_auth_trunc={0x134, 0x14, {{'sha1-ni\x00'}, 0x740, 0x180, "86fc4094128623025253ba1bf12b16628c193dab5921d90b17dab91cd9e7d3f1d026d807ba3ecf570a5c8faf2189409228958e556c73e1575979204064f79e721da1247aa795e21c03b2c526c6814bae29060668660a91e8b6117b279929536036dabaabaed87364561b5561e5778c56e89bebbf457581a3e83ba29124f9cdb02ad249eaa0986e7c772d4daa077953db62934429edb886ee03583c418032d772819f45c1a5bcdbef1d011d312973ba710cb544d62580928fa04a5eff9c54140bfa6f7144ca2e449f28a81d4c740c80077bff01e96f99be49be720c85761f58a9c5ac25c6bcd687e0"}}]}, 0x1e8}, 0x1, 0x0, 0x0, 0x20004050}, 0x11) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x1, 0x70bd29, 0x25dfdbfb, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x4000000) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={&(0x7f0000000180), 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=@flushpolicy={0x1e8, 0x1d, 0x400, 0x70bd26, 0x25dfdbfd, "", [@replay_val={0x10, 0xa, {0x70bd28, 0x70bd28, 0x7}}, @algo_comp={0x7c, 0x3, {{'deflate\x00'}, 0x1a0, "d02f32bb3c28a9d7fb87528c0c5e049d27b16ee1d1b8db33f72b7b1d10390fbb50d48fcb19f6c874bdf8e1b4484c9c5d3241376a"}}, @replay_thresh={0x8, 0xb, 0x1}, @replay_val={0x10, 0xa, {0x70bd2c, 0x70bd25, 0x4}}, @algo_auth_trunc={0x134, 0x14, {{'sha1-ni\x00'}, 0x740, 0x180, "86fc4094128623025253ba1bf12b16628c193dab5921d90b17dab91cd9e7d3f1d026d807ba3ecf570a5c8faf2189409228958e556c73e1575979204064f79e721da1247aa795e21c03b2c526c6814bae29060668660a91e8b6117b279929536036dabaabaed87364561b5561e5778c56e89bebbf457581a3e83ba29124f9cdb02ad249eaa0986e7c772d4daa077953db62934429edb886ee03583c418032d772819f45c1a5bcdbef1d011d312973ba710cb544d62580928fa04a5eff9c54140bfa6f7144ca2e449f28a81d4c740c80077bff01e96f99be49be720c85761f58a9c5ac25c6bcd687e0"}}]}, 0x1e8}, 0x1, 0x0, 0x0, 0x20004050}, 0x11) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) 15:29:42 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) r1 = getpid() kcmp$KCMP_EPOLL_TFD(0x0, r1, 0x7, 0xffffffffffffffff, 0x0) r2 = epoll_create1(0x80000) kcmp$KCMP_EPOLL_TFD(0x0, r1, 0x7, 0xffffffffffffffff, &(0x7f0000000080)={r2, r0, 0x3}) write$qrtrtun(r0, &(0x7f0000000000)="de391e", 0x3) 15:29:42 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4c, 0x0, &(0x7f0000000240)=[@reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000080)=""/137, 0x89, 0x2, 0xb}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/39, 0x27, 0x0, 0x37}, @fda={0x66646185, 0x5, 0x2, 0xb}}, &(0x7f0000000200)={0x0, 0x28, 0x50}}, 0x1000}], 0xec, 0x0, &(0x7f00000002c0)="3aa5705e1426af3fdefa4e41d570df45d859156316ee21483c63d7a9a2107360bfa48ae84aa2f484c6b87c3e1430e0c004d8a93dc8ffb96b054d05eccb4b699068a6566657660150184d158758a1c683ef16c20b268ad01766d9b6a7f2bee532ed4b08e6c910a3331dcf96898199ed5c628f56c99e955702ff395664ceaf68e7417c809893a2770f91bd359c0d9ca2fed04bb2cba5061951c76effbf850919ae0f199e27eda0a5c3c4a18af3e313acc1166fdab757f087f41639a1394ca699ef3883c5bc466151fb496185a9d1bd84bec607a08da135150c32cab6364781dee1a8a89d166bfe6d3c1b370e7e"}) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4c, 0x0, &(0x7f0000000240)=[@reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000080)=""/137, 0x89, 0x2, 0xb}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/39, 0x27, 0x0, 0x37}, @fda={0x66646185, 0x5, 0x2, 0xb}}, &(0x7f0000000200)={0x0, 0x28, 0x50}}, 0x1000}], 0xec, 0x0, &(0x7f00000002c0)="3aa5705e1426af3fdefa4e41d570df45d859156316ee21483c63d7a9a2107360bfa48ae84aa2f484c6b87c3e1430e0c004d8a93dc8ffb96b054d05eccb4b699068a6566657660150184d158758a1c683ef16c20b268ad01766d9b6a7f2bee532ed4b08e6c910a3331dcf96898199ed5c628f56c99e955702ff395664ceaf68e7417c809893a2770f91bd359c0d9ca2fed04bb2cba5061951c76effbf850919ae0f199e27eda0a5c3c4a18af3e313acc1166fdab757f087f41639a1394ca699ef3883c5bc466151fb496185a9d1bd84bec607a08da135150c32cab6364781dee1a8a89d166bfe6d3c1b370e7e"}) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) 15:29:42 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000), 0x2e) epoll_wait(0xffffffffffffffff, &(0x7f0000000080)=[{}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0) 15:29:42 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x8842) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:42 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x1, 0x70bd29, 0x25dfdbfb, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x4000000) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={&(0x7f0000000180), 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=@flushpolicy={0x1e8, 0x1d, 0x400, 0x70bd26, 0x25dfdbfd, "", [@replay_val={0x10, 0xa, {0x70bd28, 0x70bd28, 0x7}}, @algo_comp={0x7c, 0x3, {{'deflate\x00'}, 0x1a0, "d02f32bb3c28a9d7fb87528c0c5e049d27b16ee1d1b8db33f72b7b1d10390fbb50d48fcb19f6c874bdf8e1b4484c9c5d3241376a"}}, @replay_thresh={0x8, 0xb, 0x1}, @replay_val={0x10, 0xa, {0x70bd2c, 0x70bd25, 0x4}}, @algo_auth_trunc={0x134, 0x14, {{'sha1-ni\x00'}, 0x740, 0x180, "86fc4094128623025253ba1bf12b16628c193dab5921d90b17dab91cd9e7d3f1d026d807ba3ecf570a5c8faf2189409228958e556c73e1575979204064f79e721da1247aa795e21c03b2c526c6814bae29060668660a91e8b6117b279929536036dabaabaed87364561b5561e5778c56e89bebbf457581a3e83ba29124f9cdb02ad249eaa0986e7c772d4daa077953db62934429edb886ee03583c418032d772819f45c1a5bcdbef1d011d312973ba710cb544d62580928fa04a5eff9c54140bfa6f7144ca2e449f28a81d4c740c80077bff01e96f99be49be720c85761f58a9c5ac25c6bcd687e0"}}]}, 0x1e8}, 0x1, 0x0, 0x0, 0x20004050}, 0x11) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:42 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async, rerun: 64) r1 = getpid() (rerun: 64) kcmp$KCMP_EPOLL_TFD(0x0, r1, 0x7, 0xffffffffffffffff, 0x0) r2 = epoll_create1(0x80000) kcmp$KCMP_EPOLL_TFD(0x0, r1, 0x7, 0xffffffffffffffff, &(0x7f0000000080)={r2, r0, 0x3}) write$qrtrtun(r0, &(0x7f0000000000)="de391e", 0x3) 15:29:42 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x40a841) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) inotify_add_watch(r1, &(0x7f0000000080)='./file0\x00', 0x4) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:42 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x8842) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:42 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0xffffc, 0x88000) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x1) 15:29:42 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000), 0x2e) (async, rerun: 64) epoll_wait(0xffffffffffffffff, &(0x7f0000000080)=[{}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0) (rerun: 64) 15:29:42 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4c, 0x0, &(0x7f0000000240)=[@reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x0, &(0x7f0000000080)=""/137, 0x89, 0x2, 0xb}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/39, 0x27, 0x0, 0x37}, @fda={0x66646185, 0x5, 0x2, 0xb}}, &(0x7f0000000200)={0x0, 0x28, 0x50}}, 0x1000}], 0xec, 0x0, &(0x7f00000002c0)="3aa5705e1426af3fdefa4e41d570df45d859156316ee21483c63d7a9a2107360bfa48ae84aa2f484c6b87c3e1430e0c004d8a93dc8ffb96b054d05eccb4b699068a6566657660150184d158758a1c683ef16c20b268ad01766d9b6a7f2bee532ed4b08e6c910a3331dcf96898199ed5c628f56c99e955702ff395664ceaf68e7417c809893a2770f91bd359c0d9ca2fed04bb2cba5061951c76effbf850919ae0f199e27eda0a5c3c4a18af3e313acc1166fdab757f087f41639a1394ca699ef3883c5bc466151fb496185a9d1bd84bec607a08da135150c32cab6364781dee1a8a89d166bfe6d3c1b370e7e"}) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:42 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x8842) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:42 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) r1 = getpid() kcmp$KCMP_EPOLL_TFD(0x0, r1, 0x7, 0xffffffffffffffff, 0x0) r2 = epoll_create1(0x80000) kcmp$KCMP_EPOLL_TFD(0x0, r1, 0x7, 0xffffffffffffffff, &(0x7f0000000080)={r2, r0, 0x3}) write$qrtrtun(r0, &(0x7f0000000000)="de391e", 0x3) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) getpid() (async) kcmp$KCMP_EPOLL_TFD(0x0, r1, 0x7, 0xffffffffffffffff, 0x0) (async) epoll_create1(0x80000) (async) kcmp$KCMP_EPOLL_TFD(0x0, r1, 0x7, 0xffffffffffffffff, &(0x7f0000000080)={r2, r0, 0x3}) (async) write$qrtrtun(r0, &(0x7f0000000000)="de391e", 0x3) (async) 15:29:42 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0xffffc, 0x88000) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x1) 15:29:42 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x10000000) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000080)) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) getsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000100), &(0x7f0000000140)=0x4) setsockopt$TIPC_DEST_DROPPABLE(r1, 0x10f, 0x81, &(0x7f0000000000)=0x8, 0x4) write$qrtrtun(r1, &(0x7f0000000300)="9f", 0x1) 15:29:42 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x4, 0xa843) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000180)=@IORING_OP_MADVISE={0x19, 0x5, 0x0, 0x0, 0x0, &(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x10, 0x1}, 0x401) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) ioctl$SNDRV_TIMER_IOCTL_GINFO(r1, 0xc0f85403, &(0x7f0000000080)={{0x3, 0x2, 0x8000, 0x1, 0x100}, 0x8, 0xff, 'id1\x00', 'timer0\x00', 0x0, 0x8001, 0x0, 0x8dcb, 0x1}) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:42 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x40a841) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) inotify_add_watch(r1, &(0x7f0000000080)='./file0\x00', 0x4) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:42 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) r1 = request_key(&(0x7f0000000040)='cifs.spnego\x00', &(0x7f0000000080)={'syz', 0x3}, &(0x7f00000000c0)='/dev/vcsa#\x00', 0xffffffffffffffff) request_key(&(0x7f0000000140)='ceph\x00', &(0x7f0000000000)={'syz', 0x2}, &(0x7f00000001c0)='/dev/vcsa#\x00', r1) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) keyctl$KEYCTL_WATCH_KEY(0x20, r1, r2, 0x81) 15:29:42 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0xffffc, 0x88000) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x1) 15:29:42 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x4, 0xa843) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000180)=@IORING_OP_MADVISE={0x19, 0x5, 0x0, 0x0, 0x0, &(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x10, 0x1}, 0x401) (async) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async, rerun: 64) ioctl$SNDRV_TIMER_IOCTL_GINFO(r1, 0xc0f85403, &(0x7f0000000080)={{0x3, 0x2, 0x8000, 0x1, 0x100}, 0x8, 0xff, 'id1\x00', 'timer0\x00', 0x0, 0x8001, 0x0, 0x8dcb, 0x1}) (async, rerun: 64) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:42 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x40a841) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) inotify_add_watch(r1, &(0x7f0000000080)='./file0\x00', 0x4) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x40a841) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) inotify_add_watch(r1, &(0x7f0000000080)='./file0\x00', 0x4) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) 15:29:42 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x10000000) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000080)) (async) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) getsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000100), &(0x7f0000000140)=0x4) (async) setsockopt$TIPC_DEST_DROPPABLE(r1, 0x10f, 0x81, &(0x7f0000000000)=0x8, 0x4) (async) write$qrtrtun(r1, &(0x7f0000000300)="9f", 0x1) 15:29:42 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) pipe2$watch_queue(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x4, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x7}, [@alu={0x7, 0x0, 0x4, 0x7, 0x6, 0xfffffffffffffff0, 0xffffffffffffffff}]}, &(0x7f00000000c0)='syzkaller\x00', 0x7, 0xbc, &(0x7f0000000100)=""/188, 0x40f00, 0x5, '\x00', 0x0, 0x1a, r0, 0x8, &(0x7f00000001c0)={0x3, 0x3}, 0x8, 0x10, &(0x7f0000000200)={0x1, 0x107, 0x10001}, 0x10, 0xffffffffffffffff, r0, 0x0, &(0x7f0000000240)=[r0, 0xffffffffffffffff, r0, r1, r0, 0xffffffffffffffff, r0, r0, r0]}, 0x80) r3 = openat$cgroup(r0, &(0x7f0000000340)='syz0\x00', 0x200002, 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000380)={r2, r3, 0x5}, 0x10) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:42 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x4, 0xa843) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000180)=@IORING_OP_MADVISE={0x19, 0x5, 0x0, 0x0, 0x0, &(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x10, 0x1}, 0x401) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) ioctl$SNDRV_TIMER_IOCTL_GINFO(r1, 0xc0f85403, &(0x7f0000000080)={{0x3, 0x2, 0x8000, 0x1, 0x100}, 0x8, 0xff, 'id1\x00', 'timer0\x00', 0x0, 0x8001, 0x0, 0x8dcb, 0x1}) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:42 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) r1 = request_key(&(0x7f0000000040)='cifs.spnego\x00', &(0x7f0000000080)={'syz', 0x3}, &(0x7f00000000c0)='/dev/vcsa#\x00', 0xffffffffffffffff) request_key(&(0x7f0000000140)='ceph\x00', &(0x7f0000000000)={'syz', 0x2}, &(0x7f00000001c0)='/dev/vcsa#\x00', r1) (async) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) (async) keyctl$KEYCTL_WATCH_KEY(0x20, r1, r2, 0x81) 15:29:42 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) pipe2$watch_queue(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x4, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x7}, [@alu={0x7, 0x0, 0x4, 0x7, 0x6, 0xfffffffffffffff0, 0xffffffffffffffff}]}, &(0x7f00000000c0)='syzkaller\x00', 0x7, 0xbc, &(0x7f0000000100)=""/188, 0x40f00, 0x5, '\x00', 0x0, 0x1a, r0, 0x8, &(0x7f00000001c0)={0x3, 0x3}, 0x8, 0x10, &(0x7f0000000200)={0x1, 0x107, 0x10001}, 0x10, 0xffffffffffffffff, r0, 0x0, &(0x7f0000000240)=[r0, 0xffffffffffffffff, r0, r1, r0, 0xffffffffffffffff, r0, r0, r0]}, 0x80) (async) r3 = openat$cgroup(r0, &(0x7f0000000340)='syz0\x00', 0x200002, 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000380)={r2, r3, 0x5}, 0x10) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:42 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = getpid() kcmp$KCMP_EPOLL_TFD(0x0, r1, 0x7, 0xffffffffffffffff, 0x0) r2 = getpgrp(0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r3, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) r4 = epoll_create1(0x0) socketpair(0x2e, 0x80000, 0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r0) sendmsg$NL80211_CMD_NEW_INTERFACE(r5, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x44, r6, 0x100, 0x70bd2d, 0x25dfdbfe, {{}, {@val={0x8, 0x1, 0x32}, @void, @void}}, [@NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'geneve1\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x4024040}, 0x4000000) kcmp$KCMP_EPOLL_TFD(r1, r2, 0x7, r3, &(0x7f0000000080)={r4, r0, 0x5}) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) r7 = getpgrp(r1) r8 = getpid() kcmp$KCMP_EPOLL_TFD(0x0, r8, 0x7, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r9 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r9, 0x10000000) kcmp$KCMP_EPOLL_TFD(r7, r8, 0x7, r3, &(0x7f0000000280)={r9, r4, 0xffff0001}) 15:29:42 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x10000000) (async) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000080)) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) getsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000100), &(0x7f0000000140)=0x4) (async) setsockopt$TIPC_DEST_DROPPABLE(r1, 0x10f, 0x81, &(0x7f0000000000)=0x8, 0x4) (async) write$qrtrtun(r1, &(0x7f0000000300)="9f", 0x1) 15:29:42 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) pipe2$watch_queue(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x4, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x7}, [@alu={0x7, 0x0, 0x4, 0x7, 0x6, 0xfffffffffffffff0, 0xffffffffffffffff}]}, &(0x7f00000000c0)='syzkaller\x00', 0x7, 0xbc, &(0x7f0000000100)=""/188, 0x40f00, 0x5, '\x00', 0x0, 0x1a, r0, 0x8, &(0x7f00000001c0)={0x3, 0x3}, 0x8, 0x10, &(0x7f0000000200)={0x1, 0x107, 0x10001}, 0x10, 0xffffffffffffffff, r0, 0x0, &(0x7f0000000240)=[r0, 0xffffffffffffffff, r0, r1, r0, 0xffffffffffffffff, r0, r0, r0]}, 0x80) r3 = openat$cgroup(r0, &(0x7f0000000340)='syz0\x00', 0x200002, 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000380)={r2, r3, 0x5}, 0x10) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:42 executing program 4: bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x25, 0x4}, 0x10) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:42 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) r1 = request_key(&(0x7f0000000040)='cifs.spnego\x00', &(0x7f0000000080)={'syz', 0x3}, &(0x7f00000000c0)='/dev/vcsa#\x00', 0xffffffffffffffff) request_key(&(0x7f0000000140)='ceph\x00', &(0x7f0000000000)={'syz', 0x2}, &(0x7f00000001c0)='/dev/vcsa#\x00', r1) (async) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) keyctl$KEYCTL_WATCH_KEY(0x20, r1, r2, 0x81) 15:29:42 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x10000000) connect$l2tp(r0, &(0x7f0000000000)={0x2, 0x0, @rand_addr=0x64010101, 0x2}, 0x10) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r1, &(0x7f0000000300)="9f", 0x1) 15:29:42 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="def9ff", 0x3) 15:29:42 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000080)="9fe6d3c4930bb1df8da95191c3c88d1596154f463da42ca55abcaf9da8662c299c39318984b805689d8d0a4d1e8c271e58a6bc729ffb0792e6fd833a3d854e5c37d31601d94e0230cee3fb67d65082793b00f823f166029e669e1f6e61e70acfd9b2810cea545e40e6b4c573ed72d1ecc3d0454051a3ab31d73d986001436f595775de95e66d246e33b6940a7d43f1becc5eb1ae8b086cd4ff15419a20bc3e96332bf596c1679fcbf346b41e4d789592e6d1e688be039c323a30043d79da73fc4108eeaa00415cc149884eec75bf7acd78304102a19c0c97d77653c674b749e712be6b60d8e859989fd9294ba76d6719d3605184ea2db5525aba702a8c6f2d7d104edb17fb72fec64e93cb7e2fec76199be68ec8c49df75d5349c5a76982b521f2b6701d0647c370c991ad57c2faecd79b242bfc38ffb05c7ece429f467fa65a783509f8992ef98f69d50a9e4f278f2774e51371fdbadceb0a7b530fbab7b5c081e53ec1f706db3b45dad825a2f05cbd1128dc2acb6da98f2b0a55b6cf2a6185e885c7f1ba3af39387e6c0e23e7ebee453e11181e05c961addc818d59f5b2586", 0x1a0) r1 = inotify_add_watch(r0, &(0x7f0000000240)='./file0\x00', 0x20) inotify_rm_watch(r0, r1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:42 executing program 4: bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x25, 0x4}, 0x10) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x25, 0x4}, 0x10) (async) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) 15:29:42 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) r1 = getpid() kcmp$KCMP_EPOLL_TFD(0x0, r1, 0x7, 0xffffffffffffffff, 0x0) (async) r2 = getpgrp(0x0) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r3, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) r4 = epoll_create1(0x0) (async) socketpair(0x2e, 0x80000, 0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r0) sendmsg$NL80211_CMD_NEW_INTERFACE(r5, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x44, r6, 0x100, 0x70bd2d, 0x25dfdbfe, {{}, {@val={0x8, 0x1, 0x32}, @void, @void}}, [@NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'geneve1\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x4024040}, 0x4000000) kcmp$KCMP_EPOLL_TFD(r1, r2, 0x7, r3, &(0x7f0000000080)={r4, r0, 0x5}) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) r7 = getpgrp(r1) (async) r8 = getpid() kcmp$KCMP_EPOLL_TFD(0x0, r8, 0x7, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async, rerun: 32) r9 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (rerun: 32) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r9, 0x10000000) kcmp$KCMP_EPOLL_TFD(r7, r8, 0x7, r3, &(0x7f0000000280)={r9, r4, 0xffff0001}) 15:29:42 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) syz_open_dev$vcsa(&(0x7f0000000080), 0x2, 0x1ed802) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:42 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000080)="9fe6d3c4930bb1df8da95191c3c88d1596154f463da42ca55abcaf9da8662c299c39318984b805689d8d0a4d1e8c271e58a6bc729ffb0792e6fd833a3d854e5c37d31601d94e0230cee3fb67d65082793b00f823f166029e669e1f6e61e70acfd9b2810cea545e40e6b4c573ed72d1ecc3d0454051a3ab31d73d986001436f595775de95e66d246e33b6940a7d43f1becc5eb1ae8b086cd4ff15419a20bc3e96332bf596c1679fcbf346b41e4d789592e6d1e688be039c323a30043d79da73fc4108eeaa00415cc149884eec75bf7acd78304102a19c0c97d77653c674b749e712be6b60d8e859989fd9294ba76d6719d3605184ea2db5525aba702a8c6f2d7d104edb17fb72fec64e93cb7e2fec76199be68ec8c49df75d5349c5a76982b521f2b6701d0647c370c991ad57c2faecd79b242bfc38ffb05c7ece429f467fa65a783509f8992ef98f69d50a9e4f278f2774e51371fdbadceb0a7b530fbab7b5c081e53ec1f706db3b45dad825a2f05cbd1128dc2acb6da98f2b0a55b6cf2a6185e885c7f1ba3af39387e6c0e23e7ebee453e11181e05c961addc818d59f5b2586", 0x1a0) r1 = inotify_add_watch(r0, &(0x7f0000000240)='./file0\x00', 0x20) inotify_rm_watch(r0, r1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000080)="9fe6d3c4930bb1df8da95191c3c88d1596154f463da42ca55abcaf9da8662c299c39318984b805689d8d0a4d1e8c271e58a6bc729ffb0792e6fd833a3d854e5c37d31601d94e0230cee3fb67d65082793b00f823f166029e669e1f6e61e70acfd9b2810cea545e40e6b4c573ed72d1ecc3d0454051a3ab31d73d986001436f595775de95e66d246e33b6940a7d43f1becc5eb1ae8b086cd4ff15419a20bc3e96332bf596c1679fcbf346b41e4d789592e6d1e688be039c323a30043d79da73fc4108eeaa00415cc149884eec75bf7acd78304102a19c0c97d77653c674b749e712be6b60d8e859989fd9294ba76d6719d3605184ea2db5525aba702a8c6f2d7d104edb17fb72fec64e93cb7e2fec76199be68ec8c49df75d5349c5a76982b521f2b6701d0647c370c991ad57c2faecd79b242bfc38ffb05c7ece429f467fa65a783509f8992ef98f69d50a9e4f278f2774e51371fdbadceb0a7b530fbab7b5c081e53ec1f706db3b45dad825a2f05cbd1128dc2acb6da98f2b0a55b6cf2a6185e885c7f1ba3af39387e6c0e23e7ebee453e11181e05c961addc818d59f5b2586", 0x1a0) (async) inotify_add_watch(r0, &(0x7f0000000240)='./file0\x00', 0x20) (async) inotify_rm_watch(r0, r1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) 15:29:42 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="def9ff", 0x3) 15:29:42 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x10000000) connect$l2tp(r0, &(0x7f0000000000)={0x2, 0x0, @rand_addr=0x64010101, 0x2}, 0x10) (async) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r1, &(0x7f0000000300)="9f", 0x1) 15:29:42 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) syz_open_dev$vcsa(&(0x7f0000000080), 0x2, 0x1ed802) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:42 executing program 4: bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x25, 0x4}, 0x10) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x25, 0x4}, 0x10) (async) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) 15:29:42 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="def9ff", 0x3) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000000)="def9ff", 0x3) (async) 15:29:42 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000080)="9fe6d3c4930bb1df8da95191c3c88d1596154f463da42ca55abcaf9da8662c299c39318984b805689d8d0a4d1e8c271e58a6bc729ffb0792e6fd833a3d854e5c37d31601d94e0230cee3fb67d65082793b00f823f166029e669e1f6e61e70acfd9b2810cea545e40e6b4c573ed72d1ecc3d0454051a3ab31d73d986001436f595775de95e66d246e33b6940a7d43f1becc5eb1ae8b086cd4ff15419a20bc3e96332bf596c1679fcbf346b41e4d789592e6d1e688be039c323a30043d79da73fc4108eeaa00415cc149884eec75bf7acd78304102a19c0c97d77653c674b749e712be6b60d8e859989fd9294ba76d6719d3605184ea2db5525aba702a8c6f2d7d104edb17fb72fec64e93cb7e2fec76199be68ec8c49df75d5349c5a76982b521f2b6701d0647c370c991ad57c2faecd79b242bfc38ffb05c7ece429f467fa65a783509f8992ef98f69d50a9e4f278f2774e51371fdbadceb0a7b530fbab7b5c081e53ec1f706db3b45dad825a2f05cbd1128dc2acb6da98f2b0a55b6cf2a6185e885c7f1ba3af39387e6c0e23e7ebee453e11181e05c961addc818d59f5b2586", 0x1a0) (async) r1 = inotify_add_watch(r0, &(0x7f0000000240)='./file0\x00', 0x20) inotify_rm_watch(r0, r1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:42 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x10000000) connect$l2tp(r0, &(0x7f0000000000)={0x2, 0x0, @rand_addr=0x64010101, 0x2}, 0x10) (async) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r1, &(0x7f0000000300)="9f", 0x1) 15:29:42 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) syz_open_dev$vcsa(&(0x7f0000000080), 0x2, 0x1ed802) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:42 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = getpid() kcmp$KCMP_EPOLL_TFD(0x0, r1, 0x7, 0xffffffffffffffff, 0x0) r2 = getpgrp(0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r3, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) r4 = epoll_create1(0x0) socketpair(0x2e, 0x80000, 0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r0) sendmsg$NL80211_CMD_NEW_INTERFACE(r5, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x44, r6, 0x100, 0x70bd2d, 0x25dfdbfe, {{}, {@val={0x8, 0x1, 0x32}, @void, @void}}, [@NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'geneve1\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x4024040}, 0x4000000) kcmp$KCMP_EPOLL_TFD(r1, r2, 0x7, r3, &(0x7f0000000080)={r4, r0, 0x5}) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) r7 = getpgrp(r1) r8 = getpid() kcmp$KCMP_EPOLL_TFD(0x0, r8, 0x7, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r9 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r9, 0x10000000) kcmp$KCMP_EPOLL_TFD(r7, r8, 0x7, r3, &(0x7f0000000280)={r9, r4, 0xffff0001}) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) getpid() (async) kcmp$KCMP_EPOLL_TFD(0x0, r1, 0x7, 0xffffffffffffffff, 0x0) (async) getpgrp(0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$TIPC_CMD_SET_NETID(r3, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) epoll_create1(0x0) (async) socketpair(0x2e, 0x80000, 0x8, &(0x7f00000000c0)) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r0) (async) sendmsg$NL80211_CMD_NEW_INTERFACE(r5, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x44, r6, 0x100, 0x70bd2d, 0x25dfdbfe, {{}, {@val={0x8, 0x1, 0x32}, @void, @void}}, [@NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'geneve1\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x4024040}, 0x4000000) (async) kcmp$KCMP_EPOLL_TFD(r1, r2, 0x7, r3, &(0x7f0000000080)={r4, r0, 0x5}) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) getpgrp(r1) (async) getpid() (async) kcmp$KCMP_EPOLL_TFD(0x0, r8, 0x7, 0xffffffffffffffff, 0x0) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r9, 0x10000000) (async) kcmp$KCMP_EPOLL_TFD(r7, r8, 0x7, r3, &(0x7f0000000280)={r9, r4, 0xffff0001}) (async) 15:29:42 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffd, 0x0) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:42 executing program 4: pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$SIOCGETVIFCNT(r0, 0x89e0, &(0x7f00000000c0)) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r1, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x0, @empty, 0x1}, 0x10) 15:29:42 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) epoll_create1(0x80000) 15:29:42 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:42 executing program 3: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, ["", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000040}, 0x80000) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x10bc41) r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x10000000) write$qrtrtun(r0, &(0x7f0000000000)="0000000007454724a9bf55c75f2b", 0xe) 15:29:42 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) 15:29:42 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) epoll_create1(0x80000) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) epoll_create1(0x80000) (async) 15:29:42 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffd, 0x0) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:42 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f00000000c0)="9f4afef285bb5ce4412783b6723f0767a0c4f3380803bf481e5782d961783e4cfbe278049e9a09252946082b02b3b42f34ecb5359be690daa76f173acf7442e8d45226dc41fb15029252ed3de4377ae229cb7f3131ccf1a37f792c07953f4aa94910ed461c651e41537844d9c612eee2c867c2850080000000000000100df587955083126a4a907aad6f33eab1c2512b8d243baf2facd3418e88ad5053a15c6851b89155dbf5220946d80d9ad941db916f42866af8222be04f44070008a1912f91df6f000000", 0xc6) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:42 executing program 4: pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$SIOCGETVIFCNT(r0, 0x89e0, &(0x7f00000000c0)) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r1, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x0, @empty, 0x1}, 0x10) pipe2$watch_queue(&(0x7f0000000080), 0x80) (async) ioctl$SIOCGETVIFCNT(r0, 0x89e0, &(0x7f00000000c0)) (async) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r1, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) (async) ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0) (async) connect$l2tp(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x0, @empty, 0x1}, 0x10) (async) 15:29:42 executing program 3: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, ["", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000040}, 0x80000) (async) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x10bc41) (async) r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x10000000) (async) write$qrtrtun(r0, &(0x7f0000000000)="0000000007454724a9bf55c75f2b", 0xe) 15:29:42 executing program 4: pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$SIOCGETVIFCNT(r0, 0x89e0, &(0x7f00000000c0)) (async) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r1, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) (async) ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0) (async) connect$l2tp(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x0, @empty, 0x1}, 0x10) 15:29:42 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f00000000c0)="9f4afef285bb5ce4412783b6723f0767a0c4f3380803bf481e5782d961783e4cfbe278049e9a09252946082b02b3b42f34ecb5359be690daa76f173acf7442e8d45226dc41fb15029252ed3de4377ae229cb7f3131ccf1a37f792c07953f4aa94910ed461c651e41537844d9c612eee2c867c2850080000000000000100df587955083126a4a907aad6f33eab1c2512b8d243baf2facd3418e88ad5053a15c6851b89155dbf5220946d80d9ad941db916f42866af8222be04f44070008a1912f91df6f000000", 0xc6) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:42 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) 15:29:42 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) epoll_create1(0x80000) 15:29:42 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffd, 0x0) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:42 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) setsockopt$TIPC_MCAST_BROADCAST(r0, 0x10f, 0x85) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) syz_open_dev$vcsa(&(0x7f0000000080), 0x1, 0x400002) 15:29:42 executing program 3: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, ["", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000040}, 0x80000) (async) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x10bc41) r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x10000000) write$qrtrtun(r0, &(0x7f0000000000)="0000000007454724a9bf55c75f2b", 0xe) 15:29:42 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x10, 0x70bd26, 0x25dfdbfe, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x2) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:42 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0xffff8, 0x0) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r0) pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff}, 0x80) ioctl$IOC_WATCH_QUEUE_SET_FILTER(r1, 0x5761, &(0x7f00000000c0)={0x1, 0x0, [{0x6, 0x2, 0x5, [0x7fff, 0x4, 0x5, 0x8, 0x7, 0x1000, 0x0, 0x400]}]}) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) inotify_rm_watch(r0, 0x0) 15:29:42 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f00000000c0)="9f4afef285bb5ce4412783b6723f0767a0c4f3380803bf481e5782d961783e4cfbe278049e9a09252946082b02b3b42f34ecb5359be690daa76f173acf7442e8d45226dc41fb15029252ed3de4377ae229cb7f3131ccf1a37f792c07953f4aa94910ed461c651e41537844d9c612eee2c867c2850080000000000000100df587955083126a4a907aad6f33eab1c2512b8d243baf2facd3418e88ad5053a15c6851b89155dbf5220946d80d9ad941db916f42866af8222be04f44070008a1912f91df6f000000", 0xc6) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:42 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, 0x0, 0x0, 0x70bd28, 0x25dfdbfc, {{}, {}, {0x14, 0x19, {0x3, 0x8001, 0x4, 0x9}}}, ["", "", "", "", "", "", "", ""]}, 0x30}}, 0x800) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:42 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) setsockopt$TIPC_MCAST_BROADCAST(r0, 0x10f, 0x85) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) syz_open_dev$vcsa(&(0x7f0000000080), 0x1, 0x400002) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) setsockopt$TIPC_MCAST_BROADCAST(r0, 0x10f, 0x85) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) syz_open_dev$vcsa(&(0x7f0000000080), 0x1, 0x400002) (async) 15:29:42 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x10, 0x70bd26, 0x25dfdbfe, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x2) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:42 executing program 3: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x10000000) write$qrtrtun(r0, &(0x7f0000000080)="8fd410d245c8cfe28fa807dcd2a8680bcd2c03b30fde4dea306d81096f2d5c2e4d5f9f948c9d926845737418efad44236ea1dc76893cd57b7b0de26f6f548fd62609324856deb1c2d2a4dc3c8fee4f3932c7f8ceb9601f368d0bd86cedcb10247e46583662f8fc14bfe33350137f23928f80a770278025adda1315ab6296b8ea23fcb0dfbc9e3ddea18a9cc47673f7cc0c2ace4fcf0b1f45e722a6292b58d8542704e2c3eedf06d54490314c558a553ff84b9240d9052e66c55b8b12", 0xffffffffffffff92) 15:29:42 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0xffff8, 0x0) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r0) pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff}, 0x80) ioctl$IOC_WATCH_QUEUE_SET_FILTER(r1, 0x5761, &(0x7f00000000c0)={0x1, 0x0, [{0x6, 0x2, 0x5, [0x7fff, 0x4, 0x5, 0x8, 0x7, 0x1000, 0x0, 0x400]}]}) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) inotify_rm_watch(r0, 0x0) 15:29:42 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, 0x0, 0x0, 0x70bd28, 0x25dfdbfc, {{}, {}, {0x14, 0x19, {0x3, 0x8001, 0x4, 0x9}}}, ["", "", "", "", "", "", "", ""]}, 0x30}}, 0x800) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:42 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) setsockopt$TIPC_MCAST_BROADCAST(r0, 0x10f, 0x85) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) syz_open_dev$vcsa(&(0x7f0000000080), 0x1, 0x400002) 15:29:42 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x10, 0x70bd26, 0x25dfdbfe, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x2) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:42 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_MCAST_REPLICAST(r0, 0x10f, 0x86) setsockopt$TIPC_MCAST_REPLICAST(r0, 0x10f, 0x86) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r1, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r1, &(0x7f0000000000)="de8138", 0xf85) syz_io_uring_setup(0x176f, &(0x7f0000000080), &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)) syz_io_uring_submit(r2, 0x0, &(0x7f0000000180)=@IORING_OP_WRITE_FIXED={0x5, 0x0, 0x0, @fd_index}, 0x8a86c60) r3 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) recvfrom$unix(r3, &(0x7f0000000280)=""/24, 0x18, 0x40000001, &(0x7f0000000340)=@abs={0x0, 0x0, 0x4e24}, 0x6e) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000240), r4) io_uring_setup(0x3b4d, &(0x7f00000003c0)={0x0, 0x322b, 0x4, 0x3, 0x30e, 0x0, r3}) syz_io_uring_setup(0x5df9, &(0x7f0000000080)={0x0, 0x3c47, 0x2, 0x2, 0xc}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) syz_io_uring_submit(r2, r5, &(0x7f0000000200)=@IORING_OP_WRITEV={0x2, 0x5, 0x2000, @fd_index=0xa, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000180)="faa17a4424e34194fa1c4e680d4310facc3aca", 0x13}], 0x1, 0x1, 0x0, {0x1}}, 0x80) 15:29:42 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0xffff8, 0x0) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r0) pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff}, 0x80) ioctl$IOC_WATCH_QUEUE_SET_FILTER(r1, 0x5761, &(0x7f00000000c0)={0x1, 0x0, [{0x6, 0x2, 0x5, [0x7fff, 0x4, 0x5, 0x8, 0x7, 0x1000, 0x0, 0x400]}]}) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) inotify_rm_watch(r0, 0x0) syz_open_dev$vcsa(&(0x7f0000000080), 0xffff8, 0x0) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r0) (async) pipe2$watch_queue(&(0x7f0000000040), 0x80) (async) ioctl$IOC_WATCH_QUEUE_SET_FILTER(r1, 0x5761, &(0x7f00000000c0)={0x1, 0x0, [{0x6, 0x2, 0x5, [0x7fff, 0x4, 0x5, 0x8, 0x7, 0x1000, 0x0, 0x400]}]}) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) inotify_rm_watch(r0, 0x0) (async) 15:29:42 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, 0x0, 0x0, 0x70bd28, 0x25dfdbfc, {{}, {}, {0x14, 0x19, {0x3, 0x8001, 0x4, 0x9}}}, ["", "", "", "", "", "", "", ""]}, 0x30}}, 0x800) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, 0x0, 0x0, 0x70bd28, 0x25dfdbfc, {{}, {}, {0x14, 0x19, {0x3, 0x8001, 0x4, 0x9}}}, ["", "", "", "", "", "", "", ""]}, 0x30}}, 0x800) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) 15:29:42 executing program 3: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x10000000) write$qrtrtun(r0, &(0x7f0000000080)="8fd410d245c8cfe28fa807dcd2a8680bcd2c03b30fde4dea306d81096f2d5c2e4d5f9f948c9d926845737418efad44236ea1dc76893cd57b7b0de26f6f548fd62609324856deb1c2d2a4dc3c8fee4f3932c7f8ceb9601f368d0bd86cedcb10247e46583662f8fc14bfe33350137f23928f80a770278025adda1315ab6296b8ea23fcb0dfbc9e3ddea18a9cc47673f7cc0c2ace4fcf0b1f45e722a6292b58d8542704e2c3eedf06d54490314c558a553ff84b9240d9052e66c55b8b12", 0xffffffffffffff92) 15:29:42 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) socket$tipc(0x1e, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) socket$unix(0x1, 0x1, 0x0) r2 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_MCAST_REPLICAST(r2, 0x10f, 0x86) getsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000240), &(0x7f0000000280)=0x4) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) r3 = syz_open_dev$vcsa(&(0x7f00000001c0), 0x10000, 0x581c00) socket$phonet_pipe(0x23, 0x5, 0x2) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r3, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=0x0, @ANYRES8=r0], 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x404c804) getsockopt$TIPC_CONN_TIMEOUT(r0, 0x10f, 0x82, &(0x7f00000000c0), &(0x7f0000000200)=0x4) 15:29:42 executing program 3: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x10000000) write$qrtrtun(r0, &(0x7f0000000080)="8fd410d245c8cfe28fa807dcd2a8680bcd2c03b30fde4dea306d81096f2d5c2e4d5f9f948c9d926845737418efad44236ea1dc76893cd57b7b0de26f6f548fd62609324856deb1c2d2a4dc3c8fee4f3932c7f8ceb9601f368d0bd86cedcb10247e46583662f8fc14bfe33350137f23928f80a770278025adda1315ab6296b8ea23fcb0dfbc9e3ddea18a9cc47673f7cc0c2ace4fcf0b1f45e722a6292b58d8542704e2c3eedf06d54490314c558a553ff84b9240d9052e66c55b8b12", 0xffffffffffffff92) 15:29:42 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async, rerun: 32) socket$tipc(0x1e, 0x2, 0x0) (async, rerun: 32) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) socket$unix(0x1, 0x1, 0x0) (async) r2 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_MCAST_REPLICAST(r2, 0x10f, 0x86) getsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000240), &(0x7f0000000280)=0x4) (async) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) r3 = syz_open_dev$vcsa(&(0x7f00000001c0), 0x10000, 0x581c00) socket$phonet_pipe(0x23, 0x5, 0x2) (async) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r3, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=0x0, @ANYRES8=r0], 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x404c804) getsockopt$TIPC_CONN_TIMEOUT(r0, 0x10f, 0x82, &(0x7f00000000c0), &(0x7f0000000200)=0x4) 15:29:42 executing program 2: write$qrtrtun(0xffffffffffffffff, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)="de8138", 0x3) 15:29:42 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000080)="de8138", 0x3) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='hugetlb.1GB.usage_in_bytes\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x14, 0x0, &(0x7f00000000c0)=[@acquire_done={0x40106309, 0x2}], 0xe2, 0x0, &(0x7f0000000100)="7bee4f9bbb5daab7c55dbc65f3afd4e5edd2a35b51fe6230c022bb46aae331ac3a9911894d55855974ec9db952bde1eba5009405bfef783cc01a667b051c78f6970c98608a3b5f48959191a4d4cd0fee0d611325818eb769fb8773a43c624db7584a9745fd0ea54ced04d49050bb38dde5e501305d4efc22074c88f2d47fceddbdfca5fb2d46436774396eabfb635389a213ee1850afb9964583249cdc6dd5270cd341c3c9177550aa99c30519c051b4bfe2507b0c9ae2bd7b6ea286eec97cf23691685a10462d598b1d82d01ef73ecd32d12ad5bc68c32736f634565c2237345656"}) 15:29:42 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_MCAST_REPLICAST(r0, 0x10f, 0x86) setsockopt$TIPC_MCAST_REPLICAST(r0, 0x10f, 0x86) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r1, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r1, &(0x7f0000000000)="de8138", 0xf85) syz_io_uring_setup(0x176f, &(0x7f0000000080), &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)) syz_io_uring_submit(r2, 0x0, &(0x7f0000000180)=@IORING_OP_WRITE_FIXED={0x5, 0x0, 0x0, @fd_index}, 0x8a86c60) r3 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) recvfrom$unix(r3, &(0x7f0000000280)=""/24, 0x18, 0x40000001, &(0x7f0000000340)=@abs={0x0, 0x0, 0x4e24}, 0x6e) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000240), r4) io_uring_setup(0x3b4d, &(0x7f00000003c0)={0x0, 0x322b, 0x4, 0x3, 0x30e, 0x0, r3}) syz_io_uring_setup(0x5df9, &(0x7f0000000080)={0x0, 0x3c47, 0x2, 0x2, 0xc}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) syz_io_uring_submit(r2, r5, &(0x7f0000000200)=@IORING_OP_WRITEV={0x2, 0x5, 0x2000, @fd_index=0xa, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000180)="faa17a4424e34194fa1c4e680d4310facc3aca", 0x13}], 0x1, 0x1, 0x0, {0x1}}, 0x80) socket$tipc(0x1e, 0x5, 0x0) (async) setsockopt$TIPC_MCAST_REPLICAST(r0, 0x10f, 0x86) (async) setsockopt$TIPC_MCAST_REPLICAST(r0, 0x10f, 0x86) (async) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r1, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r1, &(0x7f0000000000)="de8138", 0xf85) (async) syz_io_uring_setup(0x176f, &(0x7f0000000080), &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000140)) (async) syz_io_uring_submit(r2, 0x0, &(0x7f0000000180)=@IORING_OP_WRITE_FIXED={0x5, 0x0, 0x0, @fd_index}, 0x8a86c60) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) (async) recvfrom$unix(r3, &(0x7f0000000280)=""/24, 0x18, 0x40000001, &(0x7f0000000340)=@abs={0x0, 0x0, 0x4e24}, 0x6e) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000240), r4) (async) io_uring_setup(0x3b4d, &(0x7f00000003c0)={0x0, 0x322b, 0x4, 0x3, 0x30e, 0x0, r3}) (async) syz_io_uring_setup(0x5df9, &(0x7f0000000080)={0x0, 0x3c47, 0x2, 0x2, 0xc}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000140)) (async) syz_io_uring_submit(r2, r5, &(0x7f0000000200)=@IORING_OP_WRITEV={0x2, 0x5, 0x2000, @fd_index=0xa, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000180)="faa17a4424e34194fa1c4e680d4310facc3aca", 0x13}], 0x1, 0x1, 0x0, {0x1}}, 0x80) (async) 15:29:42 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) inotify_init1(0x81000) 15:29:42 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000080)="de8138", 0x3) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='hugetlb.1GB.usage_in_bytes\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x14, 0x0, &(0x7f00000000c0)=[@acquire_done={0x40106309, 0x2}], 0xe2, 0x0, &(0x7f0000000100)="7bee4f9bbb5daab7c55dbc65f3afd4e5edd2a35b51fe6230c022bb46aae331ac3a9911894d55855974ec9db952bde1eba5009405bfef783cc01a667b051c78f6970c98608a3b5f48959191a4d4cd0fee0d611325818eb769fb8773a43c624db7584a9745fd0ea54ced04d49050bb38dde5e501305d4efc22074c88f2d47fceddbdfca5fb2d46436774396eabfb635389a213ee1850afb9964583249cdc6dd5270cd341c3c9177550aa99c30519c051b4bfe2507b0c9ae2bd7b6ea286eec97cf23691685a10462d598b1d82d01ef73ecd32d12ad5bc68c32736f634565c2237345656"}) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000080)="de8138", 0x3) (async) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='hugetlb.1GB.usage_in_bytes\x00', 0x0, 0x0) (async) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x14, 0x0, &(0x7f00000000c0)=[@acquire_done={0x40106309, 0x2}], 0xe2, 0x0, &(0x7f0000000100)="7bee4f9bbb5daab7c55dbc65f3afd4e5edd2a35b51fe6230c022bb46aae331ac3a9911894d55855974ec9db952bde1eba5009405bfef783cc01a667b051c78f6970c98608a3b5f48959191a4d4cd0fee0d611325818eb769fb8773a43c624db7584a9745fd0ea54ced04d49050bb38dde5e501305d4efc22074c88f2d47fceddbdfca5fb2d46436774396eabfb635389a213ee1850afb9964583249cdc6dd5270cd341c3c9177550aa99c30519c051b4bfe2507b0c9ae2bd7b6ea286eec97cf23691685a10462d598b1d82d01ef73ecd32d12ad5bc68c32736f634565c2237345656"}) (async) 15:29:42 executing program 4: semop(0xffffffffffffffff, &(0x7f0000000140)=[{0x3, 0x9, 0x1800}, {0x3, 0x6, 0x1800}, {0x4, 0x800}, {0x6, 0xff, 0x800}, {0x3, 0x7, 0x1400}, {0x0, 0x81}, {0x2, 0xfe00, 0x800}, {0x0, 0x5}, {0x1, 0xf2, 0x1000}], 0x9) setsockopt$TIPC_MCAST_BROADCAST(0xffffffffffffffff, 0x10f, 0x85) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa001) semop(0x0, &(0x7f0000000100)=[{0x2, 0x0, 0x800}, {0x0, 0x4, 0x800}, {0x3, 0x8, 0x800}, {0x4, 0x1, 0x1000}, {0x4, 0x800, 0x2000}], 0x5) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57def722b4fc3d462e540000", 0x18) fcntl$getownex(r0, 0x10, &(0x7f0000000080)) 15:29:42 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) socket$tipc(0x1e, 0x2, 0x0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) socket$unix(0x1, 0x1, 0x0) (async) r2 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_MCAST_REPLICAST(r2, 0x10f, 0x86) (async) getsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000240), &(0x7f0000000280)=0x4) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) r3 = syz_open_dev$vcsa(&(0x7f00000001c0), 0x10000, 0x581c00) socket$phonet_pipe(0x23, 0x5, 0x2) (async) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r3, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=0x0, @ANYRES8=r0], 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x404c804) getsockopt$TIPC_CONN_TIMEOUT(r0, 0x10f, 0x82, &(0x7f00000000c0), &(0x7f0000000200)=0x4) 15:29:42 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) inotify_init1(0x81000) 15:29:42 executing program 2: write$qrtrtun(0xffffffffffffffff, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)="de8138", 0x3) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)="de8138", 0x3) (async) 15:29:42 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_MCAST_REPLICAST(r0, 0x10f, 0x86) (async) setsockopt$TIPC_MCAST_REPLICAST(r0, 0x10f, 0x86) (async) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r1, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async, rerun: 64) write$qrtrtun(r1, &(0x7f0000000000)="de8138", 0xf85) (async, rerun: 64) syz_io_uring_setup(0x176f, &(0x7f0000000080), &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)) syz_io_uring_submit(r2, 0x0, &(0x7f0000000180)=@IORING_OP_WRITE_FIXED={0x5, 0x0, 0x0, @fd_index}, 0x8a86c60) r3 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) (async) recvfrom$unix(r3, &(0x7f0000000280)=""/24, 0x18, 0x40000001, &(0x7f0000000340)=@abs={0x0, 0x0, 0x4e24}, 0x6e) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000240), r4) io_uring_setup(0x3b4d, &(0x7f00000003c0)={0x0, 0x322b, 0x4, 0x3, 0x30e, 0x0, r3}) (async) syz_io_uring_setup(0x5df9, &(0x7f0000000080)={0x0, 0x3c47, 0x2, 0x2, 0xc}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) syz_io_uring_submit(r2, r5, &(0x7f0000000200)=@IORING_OP_WRITEV={0x2, 0x5, 0x2000, @fd_index=0xa, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000180)="faa17a4424e34194fa1c4e680d4310facc3aca", 0x13}], 0x1, 0x1, 0x0, {0x1}}, 0x80) 15:29:42 executing program 4: semop(0xffffffffffffffff, &(0x7f0000000140)=[{0x3, 0x9, 0x1800}, {0x3, 0x6, 0x1800}, {0x4, 0x800}, {0x6, 0xff, 0x800}, {0x3, 0x7, 0x1400}, {0x0, 0x81}, {0x2, 0xfe00, 0x800}, {0x0, 0x5}, {0x1, 0xf2, 0x1000}], 0x9) (async) setsockopt$TIPC_MCAST_BROADCAST(0xffffffffffffffff, 0x10f, 0x85) (async) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa001) semop(0x0, &(0x7f0000000100)=[{0x2, 0x0, 0x800}, {0x0, 0x4, 0x800}, {0x3, 0x8, 0x800}, {0x4, 0x1, 0x1000}, {0x4, 0x800, 0x2000}], 0x5) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57def722b4fc3d462e540000", 0x18) (async) fcntl$getownex(r0, 0x10, &(0x7f0000000080)) 15:29:42 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000080)="de8138", 0x3) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='hugetlb.1GB.usage_in_bytes\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x14, 0x0, &(0x7f00000000c0)=[@acquire_done={0x40106309, 0x2}], 0xe2, 0x0, &(0x7f0000000100)="7bee4f9bbb5daab7c55dbc65f3afd4e5edd2a35b51fe6230c022bb46aae331ac3a9911894d55855974ec9db952bde1eba5009405bfef783cc01a667b051c78f6970c98608a3b5f48959191a4d4cd0fee0d611325818eb769fb8773a43c624db7584a9745fd0ea54ced04d49050bb38dde5e501305d4efc22074c88f2d47fceddbdfca5fb2d46436774396eabfb635389a213ee1850afb9964583249cdc6dd5270cd341c3c9177550aa99c30519c051b4bfe2507b0c9ae2bd7b6ea286eec97cf23691685a10462d598b1d82d01ef73ecd32d12ad5bc68c32736f634565c2237345656"}) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000080)="de8138", 0x3) (async) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='hugetlb.1GB.usage_in_bytes\x00', 0x0, 0x0) (async) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x14, 0x0, &(0x7f00000000c0)=[@acquire_done={0x40106309, 0x2}], 0xe2, 0x0, &(0x7f0000000100)="7bee4f9bbb5daab7c55dbc65f3afd4e5edd2a35b51fe6230c022bb46aae331ac3a9911894d55855974ec9db952bde1eba5009405bfef783cc01a667b051c78f6970c98608a3b5f48959191a4d4cd0fee0d611325818eb769fb8773a43c624db7584a9745fd0ea54ced04d49050bb38dde5e501305d4efc22074c88f2d47fceddbdfca5fb2d46436774396eabfb635389a213ee1850afb9964583249cdc6dd5270cd341c3c9177550aa99c30519c051b4bfe2507b0c9ae2bd7b6ea286eec97cf23691685a10462d598b1d82d01ef73ecd32d12ad5bc68c32736f634565c2237345656"}) (async) 15:29:42 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) inotify_init1(0x81000) 15:29:42 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) ioctl$SNDRV_TIMER_IOCTL_STATUS64(r1, 0x80605414, &(0x7f0000000180)) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="ffff0000", @ANYRES16=0x0, @ANYBLOB="000228bd7000ffdbdf2582000000"], 0x14}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) r2 = io_uring_setup(0x5562, &(0x7f0000000200)={0x0, 0x8a5a, 0x10, 0x1, 0x44, 0x0, r0}) mmap$IORING_OFF_SQES(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x2000002, 0x10, r2, 0x10000000) 15:29:42 executing program 2: write$qrtrtun(0xffffffffffffffff, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)="de8138", 0x3) 15:29:42 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xfffec, 0x430303) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) getsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000140), &(0x7f0000000180)=0x4) write$qrtrtun(r1, &(0x7f0000000080)="9b8ac8ed36c529e682f2a78331188f1b91503537c7ea0d10a9379a698e973cb5d179936246a839f5161aeb58d69930e86514ba6b1dc4de3b206a925d7bacaa5fb1e634d9c03ff08a89ce4a7ff20d0b7f829e55d1d47f8ddd34ad03467d52c7ac7cea2038b86a0221a163a67385ab1f40a032e6a58916da30a78959538cc33dbb4ab33dc244f0f5d5143f549942156f0cda05221a9ed498df73aad0bd8a202807660eda711c00136b1a8db6329ffa1475459222208f00bc24c34b6178f3a8", 0xbe) 15:29:42 executing program 4: semop(0xffffffffffffffff, &(0x7f0000000140)=[{0x3, 0x9, 0x1800}, {0x3, 0x6, 0x1800}, {0x4, 0x800}, {0x6, 0xff, 0x800}, {0x3, 0x7, 0x1400}, {0x0, 0x81}, {0x2, 0xfe00, 0x800}, {0x0, 0x5}, {0x1, 0xf2, 0x1000}], 0x9) setsockopt$TIPC_MCAST_BROADCAST(0xffffffffffffffff, 0x10f, 0x85) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa001) semop(0x0, &(0x7f0000000100)=[{0x2, 0x0, 0x800}, {0x0, 0x4, 0x800}, {0x3, 0x8, 0x800}, {0x4, 0x1, 0x1000}, {0x4, 0x800, 0x2000}], 0x5) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57def722b4fc3d462e540000", 0x18) fcntl$getownex(r0, 0x10, &(0x7f0000000080)) semop(0xffffffffffffffff, &(0x7f0000000140)=[{0x3, 0x9, 0x1800}, {0x3, 0x6, 0x1800}, {0x4, 0x800}, {0x6, 0xff, 0x800}, {0x3, 0x7, 0x1400}, {0x0, 0x81}, {0x2, 0xfe00, 0x800}, {0x0, 0x5}, {0x1, 0xf2, 0x1000}], 0x9) (async) setsockopt$TIPC_MCAST_BROADCAST(0xffffffffffffffff, 0x10f, 0x85) (async) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa001) (async) semop(0x0, &(0x7f0000000100)=[{0x2, 0x0, 0x800}, {0x0, 0x4, 0x800}, {0x3, 0x8, 0x800}, {0x4, 0x1, 0x1000}, {0x4, 0x800, 0x2000}], 0x5) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57def722b4fc3d462e540000", 0x18) (async) fcntl$getownex(r0, 0x10, &(0x7f0000000080)) (async) 15:29:42 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) setsockopt$MRT_DEL_MFC(r0, 0x0, 0xcd, &(0x7f0000000080)={@rand_addr=0x64010100, @rand_addr=0x64010102, 0x1, "5099e06442a91af90fd785b6b0a277538eba1533c951d2f05d64388b9f18bb3b", 0x10000, 0x80000001, 0x5, 0xffff8001}, 0x3c) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x30, 0x0, 0x200, 0x70bd2a, 0x25dfdbfe, {{}, {}, {0x14, 0x19, {0x1, 0xffff1489, 0x14000000, 0x9}}}, ["", "", "", "", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x800}, 0x20008880) 15:29:42 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r2, 0x233}, 0x1c}}, 0x20040804) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r0, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x30, r2, 0x1, 0x70bd29, 0x25dfdbfe, {{}, {}, {0x14, 0x19, {0x1f, 0x1, 0x3}}}, [""]}, 0x30}, 0x1, 0x0, 0x0, 0x24000041}, 0x8000) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000900}, 0xc, &(0x7f00000000c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="028bca00552d5ab9d4ec5f1d1c695a891e020c60d0700ce81b56f20322eefff0c797d1966d1b53a22c4e4cd86f8ac90d77b89b9d189fa81c78940f0fa6422e7f5c0600000000000020000000000000000000", @ANYBLOB="4088f2f610f7246385dac6a331e737b1bbaa08a01cbc64917903ea9f9272107300fd8eadadcc191a4e1c059eced390f4baa9ea0cc06be3cceac467d03b7c417339a6078eaa8cb804e565a63449143223497a20789fac59654ac866214f4f63f69cc5cdc80b55304d356a8f87dccb5f082b59a783dcb92378f32207eace75acdfab14cbdcda3b5669e20cc90c6fd333463af8ee02046733247e810797b8b5cf463f4a6919ccb3", @ANYBLOB="002228bd7000fcdbdf2501000000000000000107538c4b4100000018001700000017000089d96574683a697036746e6c3000"], 0x34}, 0x1, 0x0, 0x0, 0x4884}, 0x4) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000004c0), r1) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r1, &(0x7f0000000580)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x30, r4, 0x4, 0x70bd2d, 0x25dfdbfb, {{}, {}, {0x14, 0x19, {0x101, 0x8, 0xbb4f, 0xf9}}}, [""]}, 0x30}, 0x1, 0x0, 0x0, 0x2c091}, 0x8000) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r6, &(0x7f0000000440)={&(0x7f0000000240), 0xc, &(0x7f0000000400)={&(0x7f0000000080)=ANY=[@ANYBLOB="141a952de7e88d2f0000813ee7d3bf4cd84c3b6c4cc01ea6c300", @ANYRES16=r5, @ANYBLOB="0100000000000000000005000000"], 0x14}}, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000740)={0xffffffffffffffff, 0xf, 0x0, 0x54, &(0x7f0000000700)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x6}, 0x20) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000640)={&(0x7f0000000780)=ANY=[@ANYBLOB="4000ff8d5ae8ee34158e9e79e5", @ANYRES16=r5, @ANYBLOB="200029bd7000fedbdf250500000014001f00fc00000000000000000000000000000106000100783c000005001400020000000500220000000000"], 0x40}, 0x1, 0x0, 0x0, 0x840}, 0x4000) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r7, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r3) sendmsg$L2TP_CMD_NOOP(r7, &(0x7f0000000440)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="000300000000"], 0x24}}, 0x4000040) 15:29:43 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) getsockname$l2tp(r0, &(0x7f0000000080)={0x2, 0x0, @loopback}, &(0x7f00000000c0)=0x10) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 15:29:43 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r1) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) openat$cgroup_ro(r2, &(0x7f00000000c0)='cgroup.stat\x00', 0x0, 0x0) 15:29:43 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) setsockopt$MRT_DEL_MFC(r0, 0x0, 0xcd, &(0x7f0000000080)={@rand_addr=0x64010100, @rand_addr=0x64010102, 0x1, "5099e06442a91af90fd785b6b0a277538eba1533c951d2f05d64388b9f18bb3b", 0x10000, 0x80000001, 0x5, 0xffff8001}, 0x3c) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x30, 0x0, 0x200, 0x70bd2a, 0x25dfdbfe, {{}, {}, {0x14, 0x19, {0x1, 0xffff1489, 0x14000000, 0x9}}}, ["", "", "", "", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x800}, 0x20008880) 15:29:43 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) ioctl$SNDRV_TIMER_IOCTL_STATUS64(r1, 0x80605414, &(0x7f0000000180)) (async) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="ffff0000", @ANYRES16=0x0, @ANYBLOB="000228bd7000ffdbdf2582000000"], 0x14}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) r2 = io_uring_setup(0x5562, &(0x7f0000000200)={0x0, 0x8a5a, 0x10, 0x1, 0x44, 0x0, r0}) mmap$IORING_OFF_SQES(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x2000002, 0x10, r2, 0x10000000) 15:29:43 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xfffec, 0x430303) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) getsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000140), &(0x7f0000000180)=0x4) write$qrtrtun(r1, &(0x7f0000000080)="9b8ac8ed36c529e682f2a78331188f1b91503537c7ea0d10a9379a698e973cb5d179936246a839f5161aeb58d69930e86514ba6b1dc4de3b206a925d7bacaa5fb1e634d9c03ff08a89ce4a7ff20d0b7f829e55d1d47f8ddd34ad03467d52c7ac7cea2038b86a0221a163a67385ab1f40a032e6a58916da30a78959538cc33dbb4ab33dc244f0f5d5143f549942156f0cda05221a9ed498df73aad0bd8a202807660eda711c00136b1a8db6329ffa1475459222208f00bc24c34b6178f3a8", 0xbe) syz_open_dev$vcsa(&(0x7f0000000040), 0xfffec, 0x430303) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) getsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000140), &(0x7f0000000180)=0x4) (async) write$qrtrtun(r1, &(0x7f0000000080)="9b8ac8ed36c529e682f2a78331188f1b91503537c7ea0d10a9379a698e973cb5d179936246a839f5161aeb58d69930e86514ba6b1dc4de3b206a925d7bacaa5fb1e634d9c03ff08a89ce4a7ff20d0b7f829e55d1d47f8ddd34ad03467d52c7ac7cea2038b86a0221a163a67385ab1f40a032e6a58916da30a78959538cc33dbb4ab33dc244f0f5d5143f549942156f0cda05221a9ed498df73aad0bd8a202807660eda711c00136b1a8db6329ffa1475459222208f00bc24c34b6178f3a8", 0xbe) (async) 15:29:43 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) (async, rerun: 64) r3 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64) sendmsg$TIPC_CMD_SHOW_STATS(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r2, 0x233}, 0x1c}}, 0x20040804) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r0, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x30, r2, 0x1, 0x70bd29, 0x25dfdbfe, {{}, {}, {0x14, 0x19, {0x1f, 0x1, 0x3}}}, [""]}, 0x30}, 0x1, 0x0, 0x0, 0x24000041}, 0x8000) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000900}, 0xc, &(0x7f00000000c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="028bca00552d5ab9d4ec5f1d1c695a891e020c60d0700ce81b56f20322eefff0c797d1966d1b53a22c4e4cd86f8ac90d77b89b9d189fa81c78940f0fa6422e7f5c0600000000000020000000000000000000", @ANYBLOB="4088f2f610f7246385dac6a331e737b1bbaa08a01cbc64917903ea9f9272107300fd8eadadcc191a4e1c059eced390f4baa9ea0cc06be3cceac467d03b7c417339a6078eaa8cb804e565a63449143223497a20789fac59654ac866214f4f63f69cc5cdc80b55304d356a8f87dccb5f082b59a783dcb92378f32207eace75acdfab14cbdcda3b5669e20cc90c6fd333463af8ee02046733247e810797b8b5cf463f4a6919ccb3", @ANYBLOB="002228bd7000fcdbdf2501000000000000000107538c4b4100000018001700000017000089d96574683a697036746e6c3000"], 0x34}, 0x1, 0x0, 0x0, 0x4884}, 0x4) (async, rerun: 32) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000004c0), r1) (rerun: 32) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r1, &(0x7f0000000580)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x30, r4, 0x4, 0x70bd2d, 0x25dfdbfb, {{}, {}, {0x14, 0x19, {0x101, 0x8, 0xbb4f, 0xf9}}}, [""]}, 0x30}, 0x1, 0x0, 0x0, 0x2c091}, 0x8000) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r6, &(0x7f0000000440)={&(0x7f0000000240), 0xc, &(0x7f0000000400)={&(0x7f0000000080)=ANY=[@ANYBLOB="141a952de7e88d2f0000813ee7d3bf4cd84c3b6c4cc01ea6c300", @ANYRES16=r5, @ANYBLOB="0100000000000000000005000000"], 0x14}}, 0x0) (async, rerun: 64) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000740)={0xffffffffffffffff, 0xf, 0x0, 0x54, &(0x7f0000000700)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x6}, 0x20) (async, rerun: 64) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000640)={&(0x7f0000000780)=ANY=[@ANYBLOB="4000ff8d5ae8ee34158e9e79e5", @ANYRES16=r5, @ANYBLOB="200029bd7000fedbdf250500000014001f00fc00000000000000000000000000000106000100783c000005001400020000000500220000000000"], 0x40}, 0x1, 0x0, 0x0, 0x840}, 0x4000) (async, rerun: 64) r7 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64) sendmsg$TIPC_CMD_SET_NETID(r7, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r3) sendmsg$L2TP_CMD_NOOP(r7, &(0x7f0000000440)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="000300000000"], 0x24}}, 0x4000040) 15:29:43 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) ioctl$SNDRV_TIMER_IOCTL_STATUS64(r1, 0x80605414, &(0x7f0000000180)) (async) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="ffff0000", @ANYRES16=0x0, @ANYBLOB="000228bd7000ffdbdf2582000000"], 0x14}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) r2 = io_uring_setup(0x5562, &(0x7f0000000200)={0x0, 0x8a5a, 0x10, 0x1, 0x44, 0x0, r0}) mmap$IORING_OFF_SQES(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x2000002, 0x10, r2, 0x10000000) 15:29:43 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) getsockname$l2tp(r0, &(0x7f0000000080)={0x2, 0x0, @loopback}, &(0x7f00000000c0)=0x10) (async) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 15:29:43 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async, rerun: 32) r1 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r1) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) openat$cgroup_ro(r2, &(0x7f00000000c0)='cgroup.stat\x00', 0x0, 0x0) 15:29:43 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xfffec, 0x430303) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) getsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000140), &(0x7f0000000180)=0x4) (async) write$qrtrtun(r1, &(0x7f0000000080)="9b8ac8ed36c529e682f2a78331188f1b91503537c7ea0d10a9379a698e973cb5d179936246a839f5161aeb58d69930e86514ba6b1dc4de3b206a925d7bacaa5fb1e634d9c03ff08a89ce4a7ff20d0b7f829e55d1d47f8ddd34ad03467d52c7ac7cea2038b86a0221a163a67385ab1f40a032e6a58916da30a78959538cc33dbb4ab33dc244f0f5d5143f549942156f0cda05221a9ed498df73aad0bd8a202807660eda711c00136b1a8db6329ffa1475459222208f00bc24c34b6178f3a8", 0xbe) 15:29:43 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r1) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) openat$cgroup_ro(r2, &(0x7f00000000c0)='cgroup.stat\x00', 0x0, 0x0) 15:29:43 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) setsockopt$MRT_DEL_MFC(r0, 0x0, 0xcd, &(0x7f0000000080)={@rand_addr=0x64010100, @rand_addr=0x64010102, 0x1, "5099e06442a91af90fd785b6b0a277538eba1533c951d2f05d64388b9f18bb3b", 0x10000, 0x80000001, 0x5, 0xffff8001}, 0x3c) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x30, 0x0, 0x200, 0x70bd2a, 0x25dfdbfe, {{}, {}, {0x14, 0x19, {0x1, 0xffff1489, 0x14000000, 0x9}}}, ["", "", "", "", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x800}, 0x20008880) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) setsockopt$MRT_DEL_MFC(r0, 0x0, 0xcd, &(0x7f0000000080)={@rand_addr=0x64010100, @rand_addr=0x64010102, 0x1, "5099e06442a91af90fd785b6b0a277538eba1533c951d2f05d64388b9f18bb3b", 0x10000, 0x80000001, 0x5, 0xffff8001}, 0x3c) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x30, 0x0, 0x200, 0x70bd2a, 0x25dfdbfe, {{}, {}, {0x14, 0x19, {0x1, 0xffff1489, 0x14000000, 0x9}}}, ["", "", "", "", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x800}, 0x20008880) (async) 15:29:43 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) pipe2$watch_queue(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) write$qrtrtun(r1, &(0x7f0000000940)="41191301f7564a15c0d847fbe6fdb1c807a209bb2e690ff9947988fb8f312b08041d5c36decff7d3c9c22dc6c1dc3a504ded21cade479cd6f9610c9413db795868f085a9feac65d1027c7ad0085353858c0db0740c31c7a46f8de048d35c496c30166be34fe4e6da545597f3d23cabf7e41ee4b29b63d2d45573d1a46b6b4d0833b65820f053b2878a4be352fbda51d67f01db47ff458fce0c5ec6f0956344f93f453c77c629881124316e515cf2ee59a7ca983a804e2920c78aeb63658d6f899614ec64bec1f8bd2ded8d98b911c92292cd02003b692ea7e65962d32bc819b098f6c34d4121d39c9f286b0fa8fde1ad8d639839769da37e0a7ea8761ebf89caef05bcc61a2bbc61ae01a72297cd36e518dd20dea61a3826d5d9ee0e530426774bfd5ced4e25f93a1d9d9fcc3349f23b5cbca394676a5e4326392fc40cdcc228680bc7ae6ad316780e6edae0e0cba4d5843c33fd626770d57c7f8f2637fcf47d67d88352618b09dc667f4abe46a9c84c0f35c68ecf7ac045469b97a4cf25da2835689fc4e3f5e2b57ec1992edfdfe35ccb126cddf3eecb6bf5be7a19ca0d2e322f32c1e0a8298619b87d36039b229f50a5e370ef6f46801a84db7abb7dd81dfce3412cf9288016f64d1be0e6d221295e26aed0c32e62d6adc0f0023ab0707d995d3f0cf0367b3891f9e2b18e721b85fa510108e5177587f0d7fd6f10ee2ccc869e2ad783aae703fe80a6e41bced4d629bd4706263261dd5e5c5df24ff4355483444475d3da0e5261e98668195193142eac000f01f82bf57b791caf0ff3f5ad9c2a9d1ed5abb85d846113fe0d497fa67476766fa6a01381c87b37104a43fe08e5ef973e2b53ac7d31adc47b7623e8c4fc1f7193b2bb70859e55ef7adaf072b2cc696c6ba55ec74e8a07746158810a76271657327e0c7fcbdb178b55ad0a59384c4c51bb6b8958bfcde7708e826d1e93bb40e0a7ce126fcdf5a799c5095fe58ecf6611c7c0d35520d56f1cce4df828d0011bc7f4c85cfa556c6a1fc04b511f2a5d147fcec116e1ea61f8a443fe150247fc9b39870b36c54a45f0bfd246f2b614c4408d79cf0e9f87ab22464ecc02dc857450366557d1d308ca886b0949a93e5d6c3ea9acc5e72b1e0b4ce9f6ac61be58e7514745b03c08b539ba4b5a93e16b43ac24704e5122ccc794a3e42b580cd4a33a00c3d695734e3668030a891ccdd24a9679323c89d15c7430c9225aa7187ae421c20f76e4458cd3530b9cd2ce7a49600ffa7c5ee2d8b5aaa33bf4bbae24e3ad0e890c00d30fbc0a74c337386e344333de33dd059d5123f8d94af16b3579ae2ebc89804f1ed2fa2d3c4d7796c57e629cfa94c33208591b4c3475f2570cb328319d052c9f973b949b677006c09e73d2510669bb8cd8bd3fafd42e044d9f2b357bf66f815cc1b0e24cdf1f72be0d0c4434772f5c1a3035bcdf02c226c36e689106baa8b07ce9158fba0b879d02cba41fd969b67d308dd8e7ca55e66951dc6bd39d831a0f6cdb27bed9dffc4e24a61cde58b6275d387b2c759aaf1b6bdaccae666594ae2d5666c6a9bd9f9113f51a84d95a4165d746807c764db60ee72658f1a3fc07de7f586eeaafbbd18ebb724fdd6cfe286537e350f298edbdd973b624618e780d100a7d570dcd3024bfeb03aea4d17fd7aba7e2ab8b6c416c87c24581eddbb8a955a383a6b1d3eb73115a3caf3482931e54c7aba3ca502bdb00c8edbaae425fbc6b2876ee78dfbaa123efcc477e65f59b0971d1fd5e891ea2dbd15f41a8e9fa675d9c399958891bc75f83b157f86382c8472aece61a6fb0344fadf52b2c9fff7557d62a2ca002b2879b88302353f7606dcc6f71503f36642a2755ebfaf47521f430ab458d882e543474a6b5a3fc9530b203e9d083bc111fd1833f4d39a864daf3efae696e4176ba8a6feeb2cc82c32ba52228fc65064e55dfe5dfdff7f6094dab78ca2f17548440d5211831cf974e0f3ab18a44409a09ba07bb8468d30e36544f6fabe82058a8d1a7093306978fa53b9d7e5e5ba024d462d409eb431083470b809b823d55fac1d4447611df1254377131db912c54022504b4966c02542a18a3562ecaacf12f9ea33778d29767030e525a38ca0a4ea42382f595df9df12a2b737ea70a44e0ba69fee2da143f9485dbc82e4463398bbc506265b8cab92a05271f0b489649bfe047abfdabe673738ec89a943889de8448ec372779f395e44b859566996c07ace5da9ed530e8f45ecc457b8bafbd8303cc37028238c245e0d8788b9f335faa816508f13f44414c597ddddb094f09df9e2a20797db1325d1b5e897ed3569e1112f5c05adc7de7ab8417d0730328a85808ff1fda263f73f49ca334d22a4a1d656cff73e8b756e02b84b166ec7bada7261495f357ed13e4ffb5fef539eacbd4c42249e173f3e8fe06c7eade887158e203b9cc4778e32b9c69d0b6513e4fb134001704bef7927008bcdfc12841098e111a9f891c5c7daa2ef7f9f67c1c6364b522171cd44742e0998d42c2aa031f2689b5d04dfbd586a51f962d6f3d851ed1c709ea5fa7c474c0f47aeeac994574d3f43a14100c23acc698a022b6ed8406bcaf785764028d5a16463b134940209fd76b6a6635047d7aa68f299d48c7add927e956db8ce8fe6106ea193e445b40d3ca2046c4f0163c41ed396d78f97d5232e07a367fa1dda71406e255b012bff64b43c7ef50495aea823268e19ff939c4a4ae6e35e13654534fcdf416f032d3e6d5131aa1227e1f456cf6a319d4e88c59dc2a1615678b507ec7dcc6b18278299a5c12c73aca719ec159d3c8f5fcd13789003c87f9583e0d1c99fb5c6c011fc68cefdaf6749b20bfc5b317d8dbca161578b0b4763173475ac466b1b0c5869e321a9ac1bf5646ec7ea9512e23aa1189ce2b9fa263dfaf92223f4c978431eb64e16f61affd1c0c10635c5ae0c249a40750f0743e7fe669b2b3449b7f5d00a4310947bcd1c6fd1c7ae7f82339b437653fbdbfc7a91b4c24cf34e7578fe623ae7911f5f13c6175132cee4db72cc0141f666466896a13e0270c9c13e82760adfc4193118bbcbeff7e6cd90421089bc6a135a8258fb74a74d42be72f1b6a26c7aee575c474613271021839d78c1113d5ef69bd731a35be9c072b6f5e89ae43fc97b1c495a9e609b5408804cd2ff939e10f0bf7fdf1fb24d92f8bcb7b3e407f4d0dcc443bb2a99590f97718345c0df0f90f35f1f1d60d4063730e09761c93425d8d3002912558db8bc7669f47d74ab166c47bd81ce56e86e29f275f72924f34eb95ef113f8381a51dabf60a056be90154e83ca3312095b01421ca08f6cd629da20bcc48597e85581e6f850f31eec97656f7214d6cac72f3de19f1c229d8bdc7f6f91043dde5515eeb9a1fa5ba8c76251393ecfe2fc6b9464cd4bbf0630eaca6aec1b8acd8397ea427f1342f48da80c88364eac599ce3a34166381fa331b6743af10e25647fcfb21b0a9d9a862d6aa93c40f76924eeb5eb80dfdea179ade762b511a4aa9913e3b7b838c1d68b14bc31cbcf61504f675241d89571e3018d4114fe9f4cf014240b9ea742389754daea7221e474691e8ea20de76c64eca68015124e12be31cc704f1af62e19253766cbfad1646198adfbb3c6d421617e466239efb33dfed16342fada851533ee9b9465a4531bdcc78127b0b7bfd5bb913a301c8550274aec8930b17094b35e090bb0da63e67b92144f80ef4b7cc66ca4a75e29f8ffcf5293be72e6bc839ca979b1358fc68d880c83ce27f48310e7ebc5ff25210a81078745b5fdfc4d6535c38184a44d1f54ab512a82016b9640ddaa578cbc837816cb46d32816a953751904a791e6dd09fa9efcea11df018474580dec0fff1bdce423d216b848b4dd3cb3aec37cfc79e8b4ab87eb133fb511ba290293150d8ac7118fd89278fb334239cf53022512170d8f01f9cf491f98b2dbf9f0bb990b7d56ed103bc0a064a1c92e08fff2557791427134ae85636fdc38db68e50f0dd24afbc44c70aae33c5c4f2aecb1ae514605d7f0b3fd6eb082f5386d8dd1eba28f9c5a852fe01082bbb109b757474ed70b1f1c16538669f9ea14c7a7d5a3f56ad4f4f04cb98bbb26a50e9807e32051222bf93055378cd462156b54e68612a0a2d638ce8fdc89107c0632566dd0588c2cbdb5465904d1ca57cf48fd9f71e652ee6ade1730117fd6c27a66fd7d393ead666943e8e788e02dadef45e735143537452db35c799b932ab866f4f04e26526984c7617d1622e3b50323dd299a7872a50457b6d4d4d036457ebb19f790cd7c0720bd1a12fd502c223f5c9e74a871def643eb9641fe8d275e4f18d1a3cd798486d8f3b4b997e47950bf664022a90cba69a03cea466415ef47a9471784719d3f6013ca1406cb259cb012458e24d49ccfb33b926af4674da41192bc119c8aa62536c68cf1ce4ef9990eaf24b9a8762c33fdceec1d5d3ec48542da48f50af5b0fadb5c26cfc654be4229b6da6be2c9696176c36c0bbc7e4418e0176ceff06a2a64ae35088a8bea5ca40a483cbdf22c196192cc4933056d93e15b0b193fedb0ed7ae213b8cec482d225bf67a1c5d3b3d9edd5fb806233b83a1c9ea084abc973de8de66cc4e440e4761f6142bcfa05e829ec518eb5d1e2749d68a9a2ff61425f6df9f75941771b8035fab846ea416ac54b14f8b3a42520ee44335448e8a0139dbd1960dd20f580d0eb67493d409d560bdb558485f4c0a8ed6a0b31a974437ce647d027661a25aef1ec00f2775e68d1bd7420446dae81259693c805bb4597b7e427aef4c5429fea06611cfd212b6eed968b51be3233d3eeee8aba496340ede7b1661e9975603e8e91dd59f8b2a681c063dac008bda7229402d5593566031986df7b17b2bcd9340c606bb2c9630c955d8e4c06072dd1630fbbca6d26b6094675497368389ddb555958f3fdeb451fd0d7b354e2d5b708a91b7e0e8d4c547639cdc6e43b0ff1f4c0c77b350e8eb40bd9824f867f30cc9593641d6d969b67850357e630a6190f33fc2af74667c068fbfcf0b435b0d8523758b72cf01cbd32bdd7bea403e88b62078d1ca9ce61d1338ecfd527c2e46e9e907d6f1c74162fb02240db7c5e34ea4be761d6cbd11f0e55769dddf558fcd48f1cef0a8f28317fad914609af297b50f177b17e85c2c5f75259ca4039c32df2e05b949e673dbf5c05f2df3c671b022aa1f6fd6bc367eb79bfb37386e46bcfced65fb692948114f33fca3af36da33ad3c2c1adedc99f956b8ae437fe239f2e534517cd9b4a147d457584a92ff3a372dc941f9fa20944c91c4b7fa1bca17d613724ab38941dee46d8244a2ac698ae303f0c86cf0dc9c0384426c0590337286b0e6c0db13f1b842525eba40c43acb424b43957217db0c177eec825773f7147d36252424969cee8a162d998d9bdee3f27c49120fbeb8952bf746ef8819b9881e9e40bd43b3556c66d0255df4843b3b5b9513372d161e52bd558ecaa3828f558afc3a02dd9d674247ac20dc6c8fd3bff505615f6287f3079e08859eefc1b44c4223ef526989fb2b9170ee0026d57fd53340b13d5dc6589de76ec9c9348eb07bcaf881f72afdad5ce9984edf33059deb48335d8fc0ea88ea5739c41a8abf8779df7a88243f7448181a550b112ac2c25d293e3a5e501d3fc5701ae70e4623fab4551b50067fe8e2cc39e3c5d39575312b016e6975339ca6167d6f97ea61a9ea158b6edd62f2ac1e312f5ae573057287e4edb17d7a00a119ace4d982280f18a8fb2bb52859c66dd482de83de81e9", 0x1000) socketpair(0x0, 0xa, 0xfffffffe, &(0x7f00000000c0)={0xffffffffffffffff}) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f00000001c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000180)={0x24, 0x0, 0x400, 0x70bd26, 0x25dfdbfe, {{}, {}, {0xfffffffffffffd9d}}, ["", "", "", "", "", "", "", "", "", ""]}, 0xffffffffffffffdf}, 0x1, 0x0, 0x0, 0x44001}, 0x80) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r3, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) sendmsg$TIPC_CMD_GET_NETID(r3, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x1c, 0x0, 0x800, 0x70bd27, 0x25dfdbfe, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4080}, 0x40084) connect$l2tp(0xffffffffffffffff, &(0x7f0000000340)={0x2, 0x0, @remote}, 0x10) pipe2$watch_queue(&(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r6, &(0x7f0000000440)={&(0x7f0000000240), 0xc, &(0x7f0000000400)={&(0x7f00000003c0)=ANY=[@ANYBLOB="15a23385", @ANYRES16=r5, @ANYBLOB="0100000000000000000005000000"], 0x14}}, 0x0) getsockname$l2tp(r1, &(0x7f0000000600)={0x2, 0x0, @loopback}, &(0x7f0000000640)=0x10) sendmsg$L2TP_CMD_TUNNEL_GET(r4, &(0x7f00000005c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="000326bd01000000df250400000006001d000080000008001900ac1414aa0500120003000000"], 0x2c}}, 0x4000850) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000400)={&(0x7f0000000100)={0x34, 0x0, 0x8, 0x70bd2b, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x1}, @L2TP_ATTR_MTU={0x6, 0x1c, 0xe936}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}]}, 0x34}, 0x1, 0x0, 0x0, 0x2004810}, 0xd4) fcntl$getownex(r7, 0x10, &(0x7f0000000080)) write$tcp_congestion(r1, &(0x7f0000000480)='dctcp\x00', 0x6) 15:29:43 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={0xffffffffffffffff, r1, 0x2}, 0x10) 15:29:43 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) getsockname$l2tp(r0, &(0x7f0000000080)={0x2, 0x0, @loopback}, &(0x7f00000000c0)=0x10) (async) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 15:29:43 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r2, 0x233}, 0x1c}}, 0x20040804) (async) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r0, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x30, r2, 0x1, 0x70bd29, 0x25dfdbfe, {{}, {}, {0x14, 0x19, {0x1f, 0x1, 0x3}}}, [""]}, 0x30}, 0x1, 0x0, 0x0, 0x24000041}, 0x8000) (async) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000900}, 0xc, &(0x7f00000000c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="028bca00552d5ab9d4ec5f1d1c695a891e020c60d0700ce81b56f20322eefff0c797d1966d1b53a22c4e4cd86f8ac90d77b89b9d189fa81c78940f0fa6422e7f5c0600000000000020000000000000000000", @ANYBLOB="4088f2f610f7246385dac6a331e737b1bbaa08a01cbc64917903ea9f9272107300fd8eadadcc191a4e1c059eced390f4baa9ea0cc06be3cceac467d03b7c417339a6078eaa8cb804e565a63449143223497a20789fac59654ac866214f4f63f69cc5cdc80b55304d356a8f87dccb5f082b59a783dcb92378f32207eace75acdfab14cbdcda3b5669e20cc90c6fd333463af8ee02046733247e810797b8b5cf463f4a6919ccb3", @ANYBLOB="002228bd7000fcdbdf2501000000000000000107538c4b4100000018001700000017000089d96574683a697036746e6c3000"], 0x34}, 0x1, 0x0, 0x0, 0x4884}, 0x4) (async) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000004c0), r1) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r1, &(0x7f0000000580)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x30, r4, 0x4, 0x70bd2d, 0x25dfdbfb, {{}, {}, {0x14, 0x19, {0x101, 0x8, 0xbb4f, 0xf9}}}, [""]}, 0x30}, 0x1, 0x0, 0x0, 0x2c091}, 0x8000) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r6, &(0x7f0000000440)={&(0x7f0000000240), 0xc, &(0x7f0000000400)={&(0x7f0000000080)=ANY=[@ANYBLOB="141a952de7e88d2f0000813ee7d3bf4cd84c3b6c4cc01ea6c300", @ANYRES16=r5, @ANYBLOB="0100000000000000000005000000"], 0x14}}, 0x0) (async) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000740)={0xffffffffffffffff, 0xf, 0x0, 0x54, &(0x7f0000000700)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x6}, 0x20) (async) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000640)={&(0x7f0000000780)=ANY=[@ANYBLOB="4000ff8d5ae8ee34158e9e79e5", @ANYRES16=r5, @ANYBLOB="200029bd7000fedbdf250500000014001f00fc00000000000000000000000000000106000100783c000005001400020000000500220000000000"], 0x40}, 0x1, 0x0, 0x0, 0x840}, 0x4000) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r7, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r3) sendmsg$L2TP_CMD_NOOP(r7, &(0x7f0000000440)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="000300000000"], 0x24}}, 0x4000040) 15:29:43 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) sendmsg$TIPC_CMD_SET_NODE_ADDR(r1, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x4, 0x70bd27, 0x25dfdbfb, {{}, {}, {0x8, 0x11, 0x7fff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x480) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) r3 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) write$qrtrtun(r3, &(0x7f0000000080)="00009c8e0401ac07698b494740af7ca9c5000000010000003cdb3a01ffffffbcfebda09f1637993e9dc696759a4d6ddf55207bebc70e1c4c469ef5e15d6139f33f5d944a57f093c3692201fd9610fc8170cb55044ebb03c490776ff3cab89505236e7b0e4a10dee1036b9ac41b98c7a68e457b53f4abee70d386", 0x7a) 15:29:43 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={0xffffffffffffffff, r1, 0x2}, 0x10) 15:29:43 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0xffff6, 0x7c3840) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) write$qrtrtun(r1, &(0x7f0000000040)="9f4afef2d1e57b76993fa4fcd0c70e85abd6e2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x2a) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:43 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async, rerun: 32) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (rerun: 32) sendmsg$TIPC_CMD_SET_NODE_ADDR(r1, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x4, 0x70bd27, 0x25dfdbfb, {{}, {}, {0x8, 0x11, 0x7fff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x480) (async) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) (async) r3 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) (async) write$qrtrtun(r3, &(0x7f0000000080)="00009c8e0401ac07698b494740af7ca9c5000000010000003cdb3a01ffffffbcfebda09f1637993e9dc696759a4d6ddf55207bebc70e1c4c469ef5e15d6139f33f5d944a57f093c3692201fd9610fc8170cb55044ebb03c490776ff3cab89505236e7b0e4a10dee1036b9ac41b98c7a68e457b53f4abee70d386", 0x7a) 15:29:43 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) pipe2$watch_queue(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) write$qrtrtun(r1, &(0x7f0000000940)="41191301f7564a15c0d847fbe6fdb1c807a209bb2e690ff9947988fb8f312b08041d5c36decff7d3c9c22dc6c1dc3a504ded21cade479cd6f9610c9413db795868f085a9feac65d1027c7ad0085353858c0db0740c31c7a46f8de048d35c496c30166be34fe4e6da545597f3d23cabf7e41ee4b29b63d2d45573d1a46b6b4d0833b65820f053b2878a4be352fbda51d67f01db47ff458fce0c5ec6f0956344f93f453c77c629881124316e515cf2ee59a7ca983a804e2920c78aeb63658d6f899614ec64bec1f8bd2ded8d98b911c92292cd02003b692ea7e65962d32bc819b098f6c34d4121d39c9f286b0fa8fde1ad8d639839769da37e0a7ea8761ebf89caef05bcc61a2bbc61ae01a72297cd36e518dd20dea61a3826d5d9ee0e530426774bfd5ced4e25f93a1d9d9fcc3349f23b5cbca394676a5e4326392fc40cdcc228680bc7ae6ad316780e6edae0e0cba4d5843c33fd626770d57c7f8f2637fcf47d67d88352618b09dc667f4abe46a9c84c0f35c68ecf7ac045469b97a4cf25da2835689fc4e3f5e2b57ec1992edfdfe35ccb126cddf3eecb6bf5be7a19ca0d2e322f32c1e0a8298619b87d36039b229f50a5e370ef6f46801a84db7abb7dd81dfce3412cf9288016f64d1be0e6d221295e26aed0c32e62d6adc0f0023ab0707d995d3f0cf0367b3891f9e2b18e721b85fa510108e5177587f0d7fd6f10ee2ccc869e2ad783aae703fe80a6e41bced4d629bd4706263261dd5e5c5df24ff4355483444475d3da0e5261e98668195193142eac000f01f82bf57b791caf0ff3f5ad9c2a9d1ed5abb85d846113fe0d497fa67476766fa6a01381c87b37104a43fe08e5ef973e2b53ac7d31adc47b7623e8c4fc1f7193b2bb70859e55ef7adaf072b2cc696c6ba55ec74e8a07746158810a76271657327e0c7fcbdb178b55ad0a59384c4c51bb6b8958bfcde7708e826d1e93bb40e0a7ce126fcdf5a799c5095fe58ecf6611c7c0d35520d56f1cce4df828d0011bc7f4c85cfa556c6a1fc04b511f2a5d147fcec116e1ea61f8a443fe150247fc9b39870b36c54a45f0bfd246f2b614c4408d79cf0e9f87ab22464ecc02dc857450366557d1d308ca886b0949a93e5d6c3ea9acc5e72b1e0b4ce9f6ac61be58e7514745b03c08b539ba4b5a93e16b43ac24704e5122ccc794a3e42b580cd4a33a00c3d695734e3668030a891ccdd24a9679323c89d15c7430c9225aa7187ae421c20f76e4458cd3530b9cd2ce7a49600ffa7c5ee2d8b5aaa33bf4bbae24e3ad0e890c00d30fbc0a74c337386e344333de33dd059d5123f8d94af16b3579ae2ebc89804f1ed2fa2d3c4d7796c57e629cfa94c33208591b4c3475f2570cb328319d052c9f973b949b677006c09e73d2510669bb8cd8bd3fafd42e044d9f2b357bf66f815cc1b0e24cdf1f72be0d0c4434772f5c1a3035bcdf02c226c36e689106baa8b07ce9158fba0b879d02cba41fd969b67d308dd8e7ca55e66951dc6bd39d831a0f6cdb27bed9dffc4e24a61cde58b6275d387b2c759aaf1b6bdaccae666594ae2d5666c6a9bd9f9113f51a84d95a4165d746807c764db60ee72658f1a3fc07de7f586eeaafbbd18ebb724fdd6cfe286537e350f298edbdd973b624618e780d100a7d570dcd3024bfeb03aea4d17fd7aba7e2ab8b6c416c87c24581eddbb8a955a383a6b1d3eb73115a3caf3482931e54c7aba3ca502bdb00c8edbaae425fbc6b2876ee78dfbaa123efcc477e65f59b0971d1fd5e891ea2dbd15f41a8e9fa675d9c399958891bc75f83b157f86382c8472aece61a6fb0344fadf52b2c9fff7557d62a2ca002b2879b88302353f7606dcc6f71503f36642a2755ebfaf47521f430ab458d882e543474a6b5a3fc9530b203e9d083bc111fd1833f4d39a864daf3efae696e4176ba8a6feeb2cc82c32ba52228fc65064e55dfe5dfdff7f6094dab78ca2f17548440d5211831cf974e0f3ab18a44409a09ba07bb8468d30e36544f6fabe82058a8d1a7093306978fa53b9d7e5e5ba024d462d409eb431083470b809b823d55fac1d4447611df1254377131db912c54022504b4966c02542a18a3562ecaacf12f9ea33778d29767030e525a38ca0a4ea42382f595df9df12a2b737ea70a44e0ba69fee2da143f9485dbc82e4463398bbc506265b8cab92a05271f0b489649bfe047abfdabe673738ec89a943889de8448ec372779f395e44b859566996c07ace5da9ed530e8f45ecc457b8bafbd8303cc37028238c245e0d8788b9f335faa816508f13f44414c597ddddb094f09df9e2a20797db1325d1b5e897ed3569e1112f5c05adc7de7ab8417d0730328a85808ff1fda263f73f49ca334d22a4a1d656cff73e8b756e02b84b166ec7bada7261495f357ed13e4ffb5fef539eacbd4c42249e173f3e8fe06c7eade887158e203b9cc4778e32b9c69d0b6513e4fb134001704bef7927008bcdfc12841098e111a9f891c5c7daa2ef7f9f67c1c6364b522171cd44742e0998d42c2aa031f2689b5d04dfbd586a51f962d6f3d851ed1c709ea5fa7c474c0f47aeeac994574d3f43a14100c23acc698a022b6ed8406bcaf785764028d5a16463b134940209fd76b6a6635047d7aa68f299d48c7add927e956db8ce8fe6106ea193e445b40d3ca2046c4f0163c41ed396d78f97d5232e07a367fa1dda71406e255b012bff64b43c7ef50495aea823268e19ff939c4a4ae6e35e13654534fcdf416f032d3e6d5131aa1227e1f456cf6a319d4e88c59dc2a1615678b507ec7dcc6b18278299a5c12c73aca719ec159d3c8f5fcd13789003c87f9583e0d1c99fb5c6c011fc68cefdaf6749b20bfc5b317d8dbca161578b0b4763173475ac466b1b0c5869e321a9ac1bf5646ec7ea9512e23aa1189ce2b9fa263dfaf92223f4c978431eb64e16f61affd1c0c10635c5ae0c249a40750f0743e7fe669b2b3449b7f5d00a4310947bcd1c6fd1c7ae7f82339b437653fbdbfc7a91b4c24cf34e7578fe623ae7911f5f13c6175132cee4db72cc0141f666466896a13e0270c9c13e82760adfc4193118bbcbeff7e6cd90421089bc6a135a8258fb74a74d42be72f1b6a26c7aee575c474613271021839d78c1113d5ef69bd731a35be9c072b6f5e89ae43fc97b1c495a9e609b5408804cd2ff939e10f0bf7fdf1fb24d92f8bcb7b3e407f4d0dcc443bb2a99590f97718345c0df0f90f35f1f1d60d4063730e09761c93425d8d3002912558db8bc7669f47d74ab166c47bd81ce56e86e29f275f72924f34eb95ef113f8381a51dabf60a056be90154e83ca3312095b01421ca08f6cd629da20bcc48597e85581e6f850f31eec97656f7214d6cac72f3de19f1c229d8bdc7f6f91043dde5515eeb9a1fa5ba8c76251393ecfe2fc6b9464cd4bbf0630eaca6aec1b8acd8397ea427f1342f48da80c88364eac599ce3a34166381fa331b6743af10e25647fcfb21b0a9d9a862d6aa93c40f76924eeb5eb80dfdea179ade762b511a4aa9913e3b7b838c1d68b14bc31cbcf61504f675241d89571e3018d4114fe9f4cf014240b9ea742389754daea7221e474691e8ea20de76c64eca68015124e12be31cc704f1af62e19253766cbfad1646198adfbb3c6d421617e466239efb33dfed16342fada851533ee9b9465a4531bdcc78127b0b7bfd5bb913a301c8550274aec8930b17094b35e090bb0da63e67b92144f80ef4b7cc66ca4a75e29f8ffcf5293be72e6bc839ca979b1358fc68d880c83ce27f48310e7ebc5ff25210a81078745b5fdfc4d6535c38184a44d1f54ab512a82016b9640ddaa578cbc837816cb46d32816a953751904a791e6dd09fa9efcea11df018474580dec0fff1bdce423d216b848b4dd3cb3aec37cfc79e8b4ab87eb133fb511ba290293150d8ac7118fd89278fb334239cf53022512170d8f01f9cf491f98b2dbf9f0bb990b7d56ed103bc0a064a1c92e08fff2557791427134ae85636fdc38db68e50f0dd24afbc44c70aae33c5c4f2aecb1ae514605d7f0b3fd6eb082f5386d8dd1eba28f9c5a852fe01082bbb109b757474ed70b1f1c16538669f9ea14c7a7d5a3f56ad4f4f04cb98bbb26a50e9807e32051222bf93055378cd462156b54e68612a0a2d638ce8fdc89107c0632566dd0588c2cbdb5465904d1ca57cf48fd9f71e652ee6ade1730117fd6c27a66fd7d393ead666943e8e788e02dadef45e735143537452db35c799b932ab866f4f04e26526984c7617d1622e3b50323dd299a7872a50457b6d4d4d036457ebb19f790cd7c0720bd1a12fd502c223f5c9e74a871def643eb9641fe8d275e4f18d1a3cd798486d8f3b4b997e47950bf664022a90cba69a03cea466415ef47a9471784719d3f6013ca1406cb259cb012458e24d49ccfb33b926af4674da41192bc119c8aa62536c68cf1ce4ef9990eaf24b9a8762c33fdceec1d5d3ec48542da48f50af5b0fadb5c26cfc654be4229b6da6be2c9696176c36c0bbc7e4418e0176ceff06a2a64ae35088a8bea5ca40a483cbdf22c196192cc4933056d93e15b0b193fedb0ed7ae213b8cec482d225bf67a1c5d3b3d9edd5fb806233b83a1c9ea084abc973de8de66cc4e440e4761f6142bcfa05e829ec518eb5d1e2749d68a9a2ff61425f6df9f75941771b8035fab846ea416ac54b14f8b3a42520ee44335448e8a0139dbd1960dd20f580d0eb67493d409d560bdb558485f4c0a8ed6a0b31a974437ce647d027661a25aef1ec00f2775e68d1bd7420446dae81259693c805bb4597b7e427aef4c5429fea06611cfd212b6eed968b51be3233d3eeee8aba496340ede7b1661e9975603e8e91dd59f8b2a681c063dac008bda7229402d5593566031986df7b17b2bcd9340c606bb2c9630c955d8e4c06072dd1630fbbca6d26b6094675497368389ddb555958f3fdeb451fd0d7b354e2d5b708a91b7e0e8d4c547639cdc6e43b0ff1f4c0c77b350e8eb40bd9824f867f30cc9593641d6d969b67850357e630a6190f33fc2af74667c068fbfcf0b435b0d8523758b72cf01cbd32bdd7bea403e88b62078d1ca9ce61d1338ecfd527c2e46e9e907d6f1c74162fb02240db7c5e34ea4be761d6cbd11f0e55769dddf558fcd48f1cef0a8f28317fad914609af297b50f177b17e85c2c5f75259ca4039c32df2e05b949e673dbf5c05f2df3c671b022aa1f6fd6bc367eb79bfb37386e46bcfced65fb692948114f33fca3af36da33ad3c2c1adedc99f956b8ae437fe239f2e534517cd9b4a147d457584a92ff3a372dc941f9fa20944c91c4b7fa1bca17d613724ab38941dee46d8244a2ac698ae303f0c86cf0dc9c0384426c0590337286b0e6c0db13f1b842525eba40c43acb424b43957217db0c177eec825773f7147d36252424969cee8a162d998d9bdee3f27c49120fbeb8952bf746ef8819b9881e9e40bd43b3556c66d0255df4843b3b5b9513372d161e52bd558ecaa3828f558afc3a02dd9d674247ac20dc6c8fd3bff505615f6287f3079e08859eefc1b44c4223ef526989fb2b9170ee0026d57fd53340b13d5dc6589de76ec9c9348eb07bcaf881f72afdad5ce9984edf33059deb48335d8fc0ea88ea5739c41a8abf8779df7a88243f7448181a550b112ac2c25d293e3a5e501d3fc5701ae70e4623fab4551b50067fe8e2cc39e3c5d39575312b016e6975339ca6167d6f97ea61a9ea158b6edd62f2ac1e312f5ae573057287e4edb17d7a00a119ace4d982280f18a8fb2bb52859c66dd482de83de81e9", 0x1000) socketpair(0x0, 0xa, 0xfffffffe, &(0x7f00000000c0)={0xffffffffffffffff}) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f00000001c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000180)={0x24, 0x0, 0x400, 0x70bd26, 0x25dfdbfe, {{}, {}, {0xfffffffffffffd9d}}, ["", "", "", "", "", "", "", "", "", ""]}, 0xffffffffffffffdf}, 0x1, 0x0, 0x0, 0x44001}, 0x80) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r3, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async, rerun: 64) sendmsg$TIPC_CMD_GET_NETID(r3, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x1c, 0x0, 0x800, 0x70bd27, 0x25dfdbfe, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4080}, 0x40084) (rerun: 64) connect$l2tp(0xffffffffffffffff, &(0x7f0000000340)={0x2, 0x0, @remote}, 0x10) (async) pipe2$watch_queue(&(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r6, &(0x7f0000000440)={&(0x7f0000000240), 0xc, &(0x7f0000000400)={&(0x7f00000003c0)=ANY=[@ANYBLOB="15a23385", @ANYRES16=r5, @ANYBLOB="0100000000000000000005000000"], 0x14}}, 0x0) getsockname$l2tp(r1, &(0x7f0000000600)={0x2, 0x0, @loopback}, &(0x7f0000000640)=0x10) (async) sendmsg$L2TP_CMD_TUNNEL_GET(r4, &(0x7f00000005c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="000326bd01000000df250400000006001d000080000008001900ac1414aa0500120003000000"], 0x2c}}, 0x4000850) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000400)={&(0x7f0000000100)={0x34, 0x0, 0x8, 0x70bd2b, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x1}, @L2TP_ATTR_MTU={0x6, 0x1c, 0xe936}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}]}, 0x34}, 0x1, 0x0, 0x0, 0x2004810}, 0xd4) (async) fcntl$getownex(r7, 0x10, &(0x7f0000000080)) (async) write$tcp_congestion(r1, &(0x7f0000000480)='dctcp\x00', 0x6) 15:29:43 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x6, 0xb, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0xf0a, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x0, 0x2, 0x1, 0x7, 0x2, 0x50, 0xfffffffffffffff0}, @func={0x85, 0x0, 0x1, 0x0, 0x1}, @cb_func={0x18, 0x15, 0x4, 0x0, 0xfffffffffffffffc}, @btf_id={0x18, 0x1, 0x3, 0x0, 0x1}, @btf_id={0x18, 0x4, 0x3, 0x0, 0x1}]}, &(0x7f0000000100)='syzkaller\x00', 0x2, 0x8c, &(0x7f0000000140)=""/140, 0x41100, 0x3, '\x00', 0x0, 0x25, r0, 0x8, &(0x7f0000000200)={0x3, 0x1}, 0x8, 0x10, &(0x7f0000000240)={0x3, 0xa, 0x5, 0x4000}, 0x10}, 0x80) 15:29:43 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0xffff6, 0x7c3840) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) write$qrtrtun(r1, &(0x7f0000000040)="9f4afef2d1e57b76993fa4fcd0c70e85abd6e2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x2a) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) syz_open_dev$vcsa(&(0x7f0000000080), 0xffff6, 0x7c3840) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) write$qrtrtun(r1, &(0x7f0000000040)="9f4afef2d1e57b76993fa4fcd0c70e85abd6e2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x2a) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) 15:29:43 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={0xffffffffffffffff, r1, 0x2}, 0x10) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) pipe2$watch_queue(&(0x7f0000000080), 0x80) (async) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={0xffffffffffffffff, r1, 0x2}, 0x10) (async) 15:29:43 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000140), 0x80002) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$MRT(r0, 0x0, 0xd0, &(0x7f0000000100), &(0x7f0000000240)=0x4) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) r2 = openat$cgroup_ro(r1, &(0x7f0000000180)='cpuset.memory_pressure\x00', 0x0, 0x0) r3 = syz_open_dev$vcsa(&(0x7f0000000080), 0x7, 0x8a000) write$qrtrtun(r3, &(0x7f00000001c0)="5971e831cdac2bb965251b515040a22f488e7e505453e8e5e767e1aedbc37be404b681340f2a78f5c896a1bc0e84d7a2b7a501621255ff070000414c7664483c0005b99724ee9d043ed7b54f839e08ac4a9b20cac01cef33b804b058e837c03a6eefc0163d35f6afaac7bfde5de53a84ef00"/124, 0xca) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000300), r0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r1, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x402000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x1c, r4, 0x300, 0x70bd25, 0x25dfdbfe, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x44000) pipe2$watch_queue(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r5) ioctl$SIOCGETMIFCNT_IN6(r0, 0x89e0, &(0x7f0000000000)) openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) 15:29:43 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0xffff6, 0x7c3840) (async) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) write$qrtrtun(r1, &(0x7f0000000040)="9f4afef2d1e57b76993fa4fcd0c70e85abd6e2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x2a) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:43 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x6, 0xb, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0xf0a, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x0, 0x2, 0x1, 0x7, 0x2, 0x50, 0xfffffffffffffff0}, @func={0x85, 0x0, 0x1, 0x0, 0x1}, @cb_func={0x18, 0x15, 0x4, 0x0, 0xfffffffffffffffc}, @btf_id={0x18, 0x1, 0x3, 0x0, 0x1}, @btf_id={0x18, 0x4, 0x3, 0x0, 0x1}]}, &(0x7f0000000100)='syzkaller\x00', 0x2, 0x8c, &(0x7f0000000140)=""/140, 0x41100, 0x3, '\x00', 0x0, 0x25, r0, 0x8, &(0x7f0000000200)={0x3, 0x1}, 0x8, 0x10, &(0x7f0000000240)={0x3, 0xa, 0x5, 0x4000}, 0x10}, 0x80) 15:29:43 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) sendmsg$TIPC_CMD_SET_NODE_ADDR(r1, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x4, 0x70bd27, 0x25dfdbfb, {{}, {}, {0x8, 0x11, 0x7fff}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x480) (async) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) (async) r3 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) (async) write$qrtrtun(r3, &(0x7f0000000080)="00009c8e0401ac07698b494740af7ca9c5000000010000003cdb3a01ffffffbcfebda09f1637993e9dc696759a4d6ddf55207bebc70e1c4c469ef5e15d6139f33f5d944a57f093c3692201fd9610fc8170cb55044ebb03c490776ff3cab89505236e7b0e4a10dee1036b9ac41b98c7a68e457b53f4abee70d386", 0x7a) 15:29:43 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000140), 0x80002) (async, rerun: 64) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (rerun: 64) getsockopt$MRT(r0, 0x0, 0xd0, &(0x7f0000000100), &(0x7f0000000240)=0x4) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) r2 = openat$cgroup_ro(r1, &(0x7f0000000180)='cpuset.memory_pressure\x00', 0x0, 0x0) (async, rerun: 32) r3 = syz_open_dev$vcsa(&(0x7f0000000080), 0x7, 0x8a000) (rerun: 32) write$qrtrtun(r3, &(0x7f00000001c0)="5971e831cdac2bb965251b515040a22f488e7e505453e8e5e767e1aedbc37be404b681340f2a78f5c896a1bc0e84d7a2b7a501621255ff070000414c7664483c0005b99724ee9d043ed7b54f839e08ac4a9b20cac01cef33b804b058e837c03a6eefc0163d35f6afaac7bfde5de53a84ef00"/124, 0xca) (async, rerun: 64) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000300), r0) (rerun: 64) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r1, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x402000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x1c, r4, 0x300, 0x70bd25, 0x25dfdbfe, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x44000) pipe2$watch_queue(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r5) (async) ioctl$SIOCGETMIFCNT_IN6(r0, 0x89e0, &(0x7f0000000000)) (async, rerun: 64) openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) (rerun: 64) 15:29:43 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) pipe2$watch_queue(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) write$qrtrtun(r1, &(0x7f0000000940)="41191301f7564a15c0d847fbe6fdb1c807a209bb2e690ff9947988fb8f312b08041d5c36decff7d3c9c22dc6c1dc3a504ded21cade479cd6f9610c9413db795868f085a9feac65d1027c7ad0085353858c0db0740c31c7a46f8de048d35c496c30166be34fe4e6da545597f3d23cabf7e41ee4b29b63d2d45573d1a46b6b4d0833b65820f053b2878a4be352fbda51d67f01db47ff458fce0c5ec6f0956344f93f453c77c629881124316e515cf2ee59a7ca983a804e2920c78aeb63658d6f899614ec64bec1f8bd2ded8d98b911c92292cd02003b692ea7e65962d32bc819b098f6c34d4121d39c9f286b0fa8fde1ad8d639839769da37e0a7ea8761ebf89caef05bcc61a2bbc61ae01a72297cd36e518dd20dea61a3826d5d9ee0e530426774bfd5ced4e25f93a1d9d9fcc3349f23b5cbca394676a5e4326392fc40cdcc228680bc7ae6ad316780e6edae0e0cba4d5843c33fd626770d57c7f8f2637fcf47d67d88352618b09dc667f4abe46a9c84c0f35c68ecf7ac045469b97a4cf25da2835689fc4e3f5e2b57ec1992edfdfe35ccb126cddf3eecb6bf5be7a19ca0d2e322f32c1e0a8298619b87d36039b229f50a5e370ef6f46801a84db7abb7dd81dfce3412cf9288016f64d1be0e6d221295e26aed0c32e62d6adc0f0023ab0707d995d3f0cf0367b3891f9e2b18e721b85fa510108e5177587f0d7fd6f10ee2ccc869e2ad783aae703fe80a6e41bced4d629bd4706263261dd5e5c5df24ff4355483444475d3da0e5261e98668195193142eac000f01f82bf57b791caf0ff3f5ad9c2a9d1ed5abb85d846113fe0d497fa67476766fa6a01381c87b37104a43fe08e5ef973e2b53ac7d31adc47b7623e8c4fc1f7193b2bb70859e55ef7adaf072b2cc696c6ba55ec74e8a07746158810a76271657327e0c7fcbdb178b55ad0a59384c4c51bb6b8958bfcde7708e826d1e93bb40e0a7ce126fcdf5a799c5095fe58ecf6611c7c0d35520d56f1cce4df828d0011bc7f4c85cfa556c6a1fc04b511f2a5d147fcec116e1ea61f8a443fe150247fc9b39870b36c54a45f0bfd246f2b614c4408d79cf0e9f87ab22464ecc02dc857450366557d1d308ca886b0949a93e5d6c3ea9acc5e72b1e0b4ce9f6ac61be58e7514745b03c08b539ba4b5a93e16b43ac24704e5122ccc794a3e42b580cd4a33a00c3d695734e3668030a891ccdd24a9679323c89d15c7430c9225aa7187ae421c20f76e4458cd3530b9cd2ce7a49600ffa7c5ee2d8b5aaa33bf4bbae24e3ad0e890c00d30fbc0a74c337386e344333de33dd059d5123f8d94af16b3579ae2ebc89804f1ed2fa2d3c4d7796c57e629cfa94c33208591b4c3475f2570cb328319d052c9f973b949b677006c09e73d2510669bb8cd8bd3fafd42e044d9f2b357bf66f815cc1b0e24cdf1f72be0d0c4434772f5c1a3035bcdf02c226c36e689106baa8b07ce9158fba0b879d02cba41fd969b67d308dd8e7ca55e66951dc6bd39d831a0f6cdb27bed9dffc4e24a61cde58b6275d387b2c759aaf1b6bdaccae666594ae2d5666c6a9bd9f9113f51a84d95a4165d746807c764db60ee72658f1a3fc07de7f586eeaafbbd18ebb724fdd6cfe286537e350f298edbdd973b624618e780d100a7d570dcd3024bfeb03aea4d17fd7aba7e2ab8b6c416c87c24581eddbb8a955a383a6b1d3eb73115a3caf3482931e54c7aba3ca502bdb00c8edbaae425fbc6b2876ee78dfbaa123efcc477e65f59b0971d1fd5e891ea2dbd15f41a8e9fa675d9c399958891bc75f83b157f86382c8472aece61a6fb0344fadf52b2c9fff7557d62a2ca002b2879b88302353f7606dcc6f71503f36642a2755ebfaf47521f430ab458d882e543474a6b5a3fc9530b203e9d083bc111fd1833f4d39a864daf3efae696e4176ba8a6feeb2cc82c32ba52228fc65064e55dfe5dfdff7f6094dab78ca2f17548440d5211831cf974e0f3ab18a44409a09ba07bb8468d30e36544f6fabe82058a8d1a7093306978fa53b9d7e5e5ba024d462d409eb431083470b809b823d55fac1d4447611df1254377131db912c54022504b4966c02542a18a3562ecaacf12f9ea33778d29767030e525a38ca0a4ea42382f595df9df12a2b737ea70a44e0ba69fee2da143f9485dbc82e4463398bbc506265b8cab92a05271f0b489649bfe047abfdabe673738ec89a943889de8448ec372779f395e44b859566996c07ace5da9ed530e8f45ecc457b8bafbd8303cc37028238c245e0d8788b9f335faa816508f13f44414c597ddddb094f09df9e2a20797db1325d1b5e897ed3569e1112f5c05adc7de7ab8417d0730328a85808ff1fda263f73f49ca334d22a4a1d656cff73e8b756e02b84b166ec7bada7261495f357ed13e4ffb5fef539eacbd4c42249e173f3e8fe06c7eade887158e203b9cc4778e32b9c69d0b6513e4fb134001704bef7927008bcdfc12841098e111a9f891c5c7daa2ef7f9f67c1c6364b522171cd44742e0998d42c2aa031f2689b5d04dfbd586a51f962d6f3d851ed1c709ea5fa7c474c0f47aeeac994574d3f43a14100c23acc698a022b6ed8406bcaf785764028d5a16463b134940209fd76b6a6635047d7aa68f299d48c7add927e956db8ce8fe6106ea193e445b40d3ca2046c4f0163c41ed396d78f97d5232e07a367fa1dda71406e255b012bff64b43c7ef50495aea823268e19ff939c4a4ae6e35e13654534fcdf416f032d3e6d5131aa1227e1f456cf6a319d4e88c59dc2a1615678b507ec7dcc6b18278299a5c12c73aca719ec159d3c8f5fcd13789003c87f9583e0d1c99fb5c6c011fc68cefdaf6749b20bfc5b317d8dbca161578b0b4763173475ac466b1b0c5869e321a9ac1bf5646ec7ea9512e23aa1189ce2b9fa263dfaf92223f4c978431eb64e16f61affd1c0c10635c5ae0c249a40750f0743e7fe669b2b3449b7f5d00a4310947bcd1c6fd1c7ae7f82339b437653fbdbfc7a91b4c24cf34e7578fe623ae7911f5f13c6175132cee4db72cc0141f666466896a13e0270c9c13e82760adfc4193118bbcbeff7e6cd90421089bc6a135a8258fb74a74d42be72f1b6a26c7aee575c474613271021839d78c1113d5ef69bd731a35be9c072b6f5e89ae43fc97b1c495a9e609b5408804cd2ff939e10f0bf7fdf1fb24d92f8bcb7b3e407f4d0dcc443bb2a99590f97718345c0df0f90f35f1f1d60d4063730e09761c93425d8d3002912558db8bc7669f47d74ab166c47bd81ce56e86e29f275f72924f34eb95ef113f8381a51dabf60a056be90154e83ca3312095b01421ca08f6cd629da20bcc48597e85581e6f850f31eec97656f7214d6cac72f3de19f1c229d8bdc7f6f91043dde5515eeb9a1fa5ba8c76251393ecfe2fc6b9464cd4bbf0630eaca6aec1b8acd8397ea427f1342f48da80c88364eac599ce3a34166381fa331b6743af10e25647fcfb21b0a9d9a862d6aa93c40f76924eeb5eb80dfdea179ade762b511a4aa9913e3b7b838c1d68b14bc31cbcf61504f675241d89571e3018d4114fe9f4cf014240b9ea742389754daea7221e474691e8ea20de76c64eca68015124e12be31cc704f1af62e19253766cbfad1646198adfbb3c6d421617e466239efb33dfed16342fada851533ee9b9465a4531bdcc78127b0b7bfd5bb913a301c8550274aec8930b17094b35e090bb0da63e67b92144f80ef4b7cc66ca4a75e29f8ffcf5293be72e6bc839ca979b1358fc68d880c83ce27f48310e7ebc5ff25210a81078745b5fdfc4d6535c38184a44d1f54ab512a82016b9640ddaa578cbc837816cb46d32816a953751904a791e6dd09fa9efcea11df018474580dec0fff1bdce423d216b848b4dd3cb3aec37cfc79e8b4ab87eb133fb511ba290293150d8ac7118fd89278fb334239cf53022512170d8f01f9cf491f98b2dbf9f0bb990b7d56ed103bc0a064a1c92e08fff2557791427134ae85636fdc38db68e50f0dd24afbc44c70aae33c5c4f2aecb1ae514605d7f0b3fd6eb082f5386d8dd1eba28f9c5a852fe01082bbb109b757474ed70b1f1c16538669f9ea14c7a7d5a3f56ad4f4f04cb98bbb26a50e9807e32051222bf93055378cd462156b54e68612a0a2d638ce8fdc89107c0632566dd0588c2cbdb5465904d1ca57cf48fd9f71e652ee6ade1730117fd6c27a66fd7d393ead666943e8e788e02dadef45e735143537452db35c799b932ab866f4f04e26526984c7617d1622e3b50323dd299a7872a50457b6d4d4d036457ebb19f790cd7c0720bd1a12fd502c223f5c9e74a871def643eb9641fe8d275e4f18d1a3cd798486d8f3b4b997e47950bf664022a90cba69a03cea466415ef47a9471784719d3f6013ca1406cb259cb012458e24d49ccfb33b926af4674da41192bc119c8aa62536c68cf1ce4ef9990eaf24b9a8762c33fdceec1d5d3ec48542da48f50af5b0fadb5c26cfc654be4229b6da6be2c9696176c36c0bbc7e4418e0176ceff06a2a64ae35088a8bea5ca40a483cbdf22c196192cc4933056d93e15b0b193fedb0ed7ae213b8cec482d225bf67a1c5d3b3d9edd5fb806233b83a1c9ea084abc973de8de66cc4e440e4761f6142bcfa05e829ec518eb5d1e2749d68a9a2ff61425f6df9f75941771b8035fab846ea416ac54b14f8b3a42520ee44335448e8a0139dbd1960dd20f580d0eb67493d409d560bdb558485f4c0a8ed6a0b31a974437ce647d027661a25aef1ec00f2775e68d1bd7420446dae81259693c805bb4597b7e427aef4c5429fea06611cfd212b6eed968b51be3233d3eeee8aba496340ede7b1661e9975603e8e91dd59f8b2a681c063dac008bda7229402d5593566031986df7b17b2bcd9340c606bb2c9630c955d8e4c06072dd1630fbbca6d26b6094675497368389ddb555958f3fdeb451fd0d7b354e2d5b708a91b7e0e8d4c547639cdc6e43b0ff1f4c0c77b350e8eb40bd9824f867f30cc9593641d6d969b67850357e630a6190f33fc2af74667c068fbfcf0b435b0d8523758b72cf01cbd32bdd7bea403e88b62078d1ca9ce61d1338ecfd527c2e46e9e907d6f1c74162fb02240db7c5e34ea4be761d6cbd11f0e55769dddf558fcd48f1cef0a8f28317fad914609af297b50f177b17e85c2c5f75259ca4039c32df2e05b949e673dbf5c05f2df3c671b022aa1f6fd6bc367eb79bfb37386e46bcfced65fb692948114f33fca3af36da33ad3c2c1adedc99f956b8ae437fe239f2e534517cd9b4a147d457584a92ff3a372dc941f9fa20944c91c4b7fa1bca17d613724ab38941dee46d8244a2ac698ae303f0c86cf0dc9c0384426c0590337286b0e6c0db13f1b842525eba40c43acb424b43957217db0c177eec825773f7147d36252424969cee8a162d998d9bdee3f27c49120fbeb8952bf746ef8819b9881e9e40bd43b3556c66d0255df4843b3b5b9513372d161e52bd558ecaa3828f558afc3a02dd9d674247ac20dc6c8fd3bff505615f6287f3079e08859eefc1b44c4223ef526989fb2b9170ee0026d57fd53340b13d5dc6589de76ec9c9348eb07bcaf881f72afdad5ce9984edf33059deb48335d8fc0ea88ea5739c41a8abf8779df7a88243f7448181a550b112ac2c25d293e3a5e501d3fc5701ae70e4623fab4551b50067fe8e2cc39e3c5d39575312b016e6975339ca6167d6f97ea61a9ea158b6edd62f2ac1e312f5ae573057287e4edb17d7a00a119ace4d982280f18a8fb2bb52859c66dd482de83de81e9", 0x1000) (async) socketpair(0x0, 0xa, 0xfffffffe, &(0x7f00000000c0)={0xffffffffffffffff}) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f00000001c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000180)={0x24, 0x0, 0x400, 0x70bd26, 0x25dfdbfe, {{}, {}, {0xfffffffffffffd9d}}, ["", "", "", "", "", "", "", "", "", ""]}, 0xffffffffffffffdf}, 0x1, 0x0, 0x0, 0x44001}, 0x80) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r3, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) sendmsg$TIPC_CMD_GET_NETID(r3, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x1c, 0x0, 0x800, 0x70bd27, 0x25dfdbfe, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4080}, 0x40084) (async) connect$l2tp(0xffffffffffffffff, &(0x7f0000000340)={0x2, 0x0, @remote}, 0x10) (async) pipe2$watch_queue(&(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r6, &(0x7f0000000440)={&(0x7f0000000240), 0xc, &(0x7f0000000400)={&(0x7f00000003c0)=ANY=[@ANYBLOB="15a23385", @ANYRES16=r5, @ANYBLOB="0100000000000000000005000000"], 0x14}}, 0x0) (async) getsockname$l2tp(r1, &(0x7f0000000600)={0x2, 0x0, @loopback}, &(0x7f0000000640)=0x10) (async) sendmsg$L2TP_CMD_TUNNEL_GET(r4, &(0x7f00000005c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="000326bd01000000df250400000006001d000080000008001900ac1414aa0500120003000000"], 0x2c}}, 0x4000850) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000400)={&(0x7f0000000100)={0x34, 0x0, 0x8, 0x70bd2b, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x1}, @L2TP_ATTR_MTU={0x6, 0x1c, 0xe936}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}]}, 0x34}, 0x1, 0x0, 0x0, 0x2004810}, 0xd4) (async) fcntl$getownex(r7, 0x10, &(0x7f0000000080)) (async) write$tcp_congestion(r1, &(0x7f0000000480)='dctcp\x00', 0x6) 15:29:43 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r0, 0xc0505405, &(0x7f0000000080)={{0x0, 0x0, 0x6, 0x1, 0x7fff}, 0x1, 0x58c, 0x9}) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000100), 0x40040) ioctl$SNDRV_TIMER_IOCTL_STOP(r1, 0x54a1) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:43 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) getsockname$l2tp(r0, &(0x7f0000000080)={0x2, 0x0, @remote}, &(0x7f00000000c0)=0x10) socketpair(0x29, 0x800, 0x3, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) accept4$tipc(r1, 0x0, &(0x7f0000000140), 0x800) 15:29:43 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async, rerun: 32) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x6, 0xb, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0xf0a, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x0, 0x2, 0x1, 0x7, 0x2, 0x50, 0xfffffffffffffff0}, @func={0x85, 0x0, 0x1, 0x0, 0x1}, @cb_func={0x18, 0x15, 0x4, 0x0, 0xfffffffffffffffc}, @btf_id={0x18, 0x1, 0x3, 0x0, 0x1}, @btf_id={0x18, 0x4, 0x3, 0x0, 0x1}]}, &(0x7f0000000100)='syzkaller\x00', 0x2, 0x8c, &(0x7f0000000140)=""/140, 0x41100, 0x3, '\x00', 0x0, 0x25, r0, 0x8, &(0x7f0000000200)={0x3, 0x1}, 0x8, 0x10, &(0x7f0000000240)={0x3, 0xa, 0x5, 0x4000}, 0x10}, 0x80) (rerun: 32) 15:29:43 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000140), 0x80002) (async) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$MRT(r0, 0x0, 0xd0, &(0x7f0000000100), &(0x7f0000000240)=0x4) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) r2 = openat$cgroup_ro(r1, &(0x7f0000000180)='cpuset.memory_pressure\x00', 0x0, 0x0) (async) r3 = syz_open_dev$vcsa(&(0x7f0000000080), 0x7, 0x8a000) write$qrtrtun(r3, &(0x7f00000001c0)="5971e831cdac2bb965251b515040a22f488e7e505453e8e5e767e1aedbc37be404b681340f2a78f5c896a1bc0e84d7a2b7a501621255ff070000414c7664483c0005b99724ee9d043ed7b54f839e08ac4a9b20cac01cef33b804b058e837c03a6eefc0163d35f6afaac7bfde5de53a84ef00"/124, 0xca) (async) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000300), r0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r1, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x402000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x1c, r4, 0x300, 0x70bd25, 0x25dfdbfe, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x44000) (async) pipe2$watch_queue(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r5) (async) ioctl$SIOCGETMIFCNT_IN6(r0, 0x89e0, &(0x7f0000000000)) openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) 15:29:43 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r0, 0xc0505405, &(0x7f0000000080)={{0x0, 0x0, 0x6, 0x1, 0x7fff}, 0x1, 0x58c, 0x9}) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000100), 0x40040) ioctl$SNDRV_TIMER_IOCTL_STOP(r1, 0x54a1) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:43 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) getsockname$l2tp(r0, &(0x7f0000000080)={0x2, 0x0, @remote}, &(0x7f00000000c0)=0x10) socketpair(0x29, 0x800, 0x3, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) accept4$tipc(r1, 0x0, &(0x7f0000000140), 0x800) 15:29:43 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) syz_io_uring_setup(0xf17, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)) syz_io_uring_submit(r2, 0x0, &(0x7f0000000180)=@IORING_OP_WRITE_FIXED={0x5, 0x0, 0x0, @fd_index}, 0x8a86c60) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x100000a, 0x1010, r0, 0x10000000) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2000001, 0x10, r1, 0x10000000) syz_io_uring_submit(r2, r3, &(0x7f0000000340)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, r4, &(0x7f0000000200)=0x80, &(0x7f0000000280)=@ieee802154, 0x0, 0x80000}, 0x20) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r7, &(0x7f0000000440)={&(0x7f0000000240), 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x14, r6, 0x1}, 0x14}}, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r5, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="00082abd7000ffdbdf25060000000c00100000000000000000080003000000000006000100080000000c001000018000000008000005001496cbb42f47ee8eaa00060000000500050000000000"], 0x5c}, 0x1, 0x0, 0x0, 0x44024}, 0x24008801) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), r0) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:43 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000080)={{0xffffffffffffffff, 0x1, 0x0, 0x2, 0x8}, 0x29a, 0xffff}) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:43 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r0, 0xc0505405, &(0x7f0000000080)={{0x0, 0x0, 0x6, 0x1, 0x7fff}, 0x1, 0x58c, 0x9}) (async, rerun: 64) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000100), 0x40040) (rerun: 64) ioctl$SNDRV_TIMER_IOCTL_STOP(r1, 0x54a1) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:43 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) epoll_pwait(r1, &(0x7f0000000080)=[{}], 0x1, 0x5, &(0x7f00000000c0)={[0x5]}, 0x8) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x40) openat$cgroup_freezer_state(r1, &(0x7f0000000100), 0x2, 0x0) 15:29:43 executing program 5: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x10000000) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000080)="de8238d81830bbd7c7e55b8b9968efd8ea8671054c2f3b4914d098f73ea69a0b1eb5f995e478a3e854", 0x29) epoll_create1(0x0) 15:29:43 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) syz_io_uring_setup(0xf17, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)) syz_io_uring_submit(r2, 0x0, &(0x7f0000000180)=@IORING_OP_WRITE_FIXED={0x5, 0x0, 0x0, @fd_index}, 0x8a86c60) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x100000a, 0x1010, r0, 0x10000000) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2000001, 0x10, r1, 0x10000000) (async) syz_io_uring_submit(r2, r3, &(0x7f0000000340)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, r4, &(0x7f0000000200)=0x80, &(0x7f0000000280)=@ieee802154, 0x0, 0x80000}, 0x20) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r7, &(0x7f0000000440)={&(0x7f0000000240), 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x14, r6, 0x1}, 0x14}}, 0x0) (async) sendmsg$L2TP_CMD_SESSION_DELETE(r5, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="00082abd7000ffdbdf25060000000c00100000000000000000080003000000000006000100080000000c001000018000000008000005001496cbb42f47ee8eaa00060000000500050000000000"], 0x5c}, 0x1, 0x0, 0x0, 0x44024}, 0x24008801) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), r0) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:43 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) getsockname$l2tp(r0, &(0x7f0000000080)={0x2, 0x0, @remote}, &(0x7f00000000c0)=0x10) socketpair(0x29, 0x800, 0x3, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) accept4$tipc(r1, 0x0, &(0x7f0000000140), 0x800) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) getsockname$l2tp(r0, &(0x7f0000000080)={0x2, 0x0, @remote}, &(0x7f00000000c0)=0x10) (async) socketpair(0x29, 0x800, 0x3, &(0x7f0000000100)) (async) accept4$tipc(r1, 0x0, &(0x7f0000000140), 0x800) (async) 15:29:43 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) epoll_pwait(r1, &(0x7f0000000080)=[{}], 0x1, 0x5, &(0x7f00000000c0)={[0x5]}, 0x8) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x40) openat$cgroup_freezer_state(r1, &(0x7f0000000100), 0x2, 0x0) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) epoll_pwait(r1, &(0x7f0000000080)=[{}], 0x1, 0x5, &(0x7f00000000c0)={[0x5]}, 0x8) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x40) (async) openat$cgroup_freezer_state(r1, &(0x7f0000000100), 0x2, 0x0) (async) 15:29:43 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) socketpair(0x11, 0x1, 0x5, &(0x7f0000000080)={0xffffffffffffffff}) recvfrom$unix(r1, &(0x7f00000000c0)=""/190, 0xbe, 0x40014002, &(0x7f0000000180)=@file={0x0, './file0\x00'}, 0x6e) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:43 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000080)={{0xffffffffffffffff, 0x1, 0x0, 0x2, 0x8}, 0x29a, 0xffff}) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:43 executing program 5: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x10000000) (async) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000080)="de8238d81830bbd7c7e55b8b9968efd8ea8671054c2f3b4914d098f73ea69a0b1eb5f995e478a3e854", 0x29) (async) epoll_create1(0x0) 15:29:43 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) epoll_pwait(r1, &(0x7f0000000080)=[{}], 0x1, 0x5, &(0x7f00000000c0)={[0x5]}, 0x8) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x40) (async) openat$cgroup_freezer_state(r1, &(0x7f0000000100), 0x2, 0x0) 15:29:43 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) socketpair(0x11, 0x1, 0x5, &(0x7f0000000080)={0xffffffffffffffff}) recvfrom$unix(r1, &(0x7f00000000c0)=""/190, 0xbe, 0x40014002, &(0x7f0000000180)=@file={0x0, './file0\x00'}, 0x6e) (async, rerun: 64) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async, rerun: 64) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:43 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async, rerun: 64) syz_io_uring_setup(0xf17, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)) (rerun: 64) syz_io_uring_submit(r2, 0x0, &(0x7f0000000180)=@IORING_OP_WRITE_FIXED={0x5, 0x0, 0x0, @fd_index}, 0x8a86c60) (async) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x100000a, 0x1010, r0, 0x10000000) (async, rerun: 64) r4 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64) sendmsg$TIPC_CMD_SET_NETID(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async, rerun: 32) mmap$IORING_OFF_SQES(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2000001, 0x10, r1, 0x10000000) (async, rerun: 32) syz_io_uring_submit(r2, r3, &(0x7f0000000340)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, r4, &(0x7f0000000200)=0x80, &(0x7f0000000280)=@ieee802154, 0x0, 0x80000}, 0x20) (async, rerun: 32) r5 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r7, &(0x7f0000000440)={&(0x7f0000000240), 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x14, r6, 0x1}, 0x14}}, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r5, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="00082abd7000ffdbdf25060000000c00100000000000000000080003000000000006000100080000000c001000018000000008000005001496cbb42f47ee8eaa00060000000500050000000000"], 0x5c}, 0x1, 0x0, 0x0, 0x44024}, 0x24008801) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), r0) (async, rerun: 32) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (rerun: 32) 15:29:43 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) openat$cgroup_ro(r1, &(0x7f0000000080)='blkio.bfq.io_wait_time\x00', 0x0, 0x0) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:43 executing program 5: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async, rerun: 32) r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (rerun: 32) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x10000000) (async, rerun: 64) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000080)="de8238d81830bbd7c7e55b8b9968efd8ea8671054c2f3b4914d098f73ea69a0b1eb5f995e478a3e854", 0x29) (rerun: 64) epoll_create1(0x0) 15:29:43 executing program 3: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x10000000) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:43 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) socketpair(0x11, 0x1, 0x5, &(0x7f0000000080)={0xffffffffffffffff}) recvfrom$unix(r1, &(0x7f00000000c0)=""/190, 0xbe, 0x40014002, &(0x7f0000000180)=@file={0x0, './file0\x00'}, 0x6e) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:43 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000080)={{0xffffffffffffffff, 0x1, 0x0, 0x2, 0x8}, 0x29a, 0xffff}) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000080)={{0xffffffffffffffff, 0x1, 0x0, 0x2, 0x8}, 0x29a, 0xffff}) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) 15:29:43 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) openat$cgroup_ro(r1, &(0x7f0000000080)='blkio.bfq.io_wait_time\x00', 0x0, 0x0) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:43 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0xffffd, 0x4d2e43) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) sendmsg$TIPC_CMD_DISABLE_BEARER(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, 0x0, 0x1, 0x70bd25, 0x25dfdbfe, {{}, {}, {0x10, 0x13, @udp='udp:syz1\x00'}}, ["", "", "", "", "", ""]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) 15:29:43 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000080), &(0x7f00000000c0)=0x4) openat$cgroup_pressure(r0, &(0x7f0000000200)='cpu.pressure\x00', 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) r1 = openat$cgroup_ro(r0, &(0x7f0000000100)='blkio.bfq.io_service_bytes\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000140)={{0x1, 0x0, 0x80000001, 0x2, 0xb3e}}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f0000000880)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000240)=ANY=[@ANYBLOB="000000009b2aaf5fb2c992aac4cdd2bf999a9f40ff3145e5f325dc7743d64fcdbe8cee925ac327b95b10533a0200d98437ccdfad2173cd9330fa2f4cf4a7a2513766fb388422350e55f81031dc13be9b9924e735d4b405772886c3be", @ANYRES16=0x0, @ANYBLOB="0400000000000000000014000000"], 0x14}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000001c0)={'gretap0\x00', &(0x7f0000000240)=ANY=[]}) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f00000002c0), r2) sendmsg$NL802154_CMD_DEL_SEC_KEY(r2, &(0x7f0000000400)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x8c, r3, 0x100, 0x70bd25, 0x25dfdbfc, {}, [@NL802154_ATTR_SEC_KEY={0xc, 0x25, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0x3f}]}, @NL802154_ATTR_SEC_KEY={0x6c, 0x25, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_CMDS={0x24, 0x3, "66a48fbfb0a72652c783bdbe700c7860f479212399cdb0cef62f9bedda4e85be"}, @NL802154_KEY_ATTR_ID={0x28, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x2}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0xffffffff}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x100}, @NL802154_KEY_ID_ATTR_INDEX={0x5}]}, @NL802154_KEY_ATTR_BYTES={0x14, 0x4, "b76523784902b0e1d2f2035789340fbf"}, @NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0xff}]}]}, 0x8c}, 0x1, 0x0, 0x0, 0x20000800}, 0x800) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:43 executing program 3: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x10000000) (async, rerun: 64) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (rerun: 64) 15:29:43 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) socketpair(0x2c, 0x80000, 0x1, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$l2tp(r1, &(0x7f00000000c0)={0x2, 0x0, @private=0xa010102, 0x3}, 0x10) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) epoll_create1(0x80000) epoll_pwait(r0, &(0x7f0000000100)=[{}, {}, {}], 0x15555808, 0x1, &(0x7f0000000140)={[0x4]}, 0x8) 15:29:43 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) openat$cgroup_ro(r1, &(0x7f0000000080)='blkio.bfq.io_wait_time\x00', 0x0, 0x0) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) openat$cgroup_ro(r1, &(0x7f0000000080)='blkio.bfq.io_wait_time\x00', 0x0, 0x0) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) 15:29:43 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = syz_clone(0x80020a00, &(0x7f0000000080)="ba6ee3662df18472bd04a1e9a0ee4024ecb31ce1e65e6fff0fdb24440553", 0x1e, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140)="5223233404a70478beaca3dabc020ca64c1b9a79ff309cb09ace618270798c1b5faa820551b9875996f259b313d1a8337f951b37112532660ba2e19ba868cca4811193759d0ad3ae2a8abcbcfa040201b13fbc08857bb32b9ecab287a10d1de576b47e450f1b2c72ab7c93238a1780f10a3e568ad43c7273ec6cfae3a7") r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) r3 = openat$cgroup_ro(r0, &(0x7f00000001c0)='cpuacct.usage_all\x00', 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) kcmp$KCMP_EPOLL_TFD(r1, 0x0, 0x7, r2, &(0x7f0000000200)={r3, r4, 0x3f}) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:43 executing program 3: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x10000000) (async, rerun: 32) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (rerun: 32) 15:29:43 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0xffffd, 0x4d2e43) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) sendmsg$TIPC_CMD_DISABLE_BEARER(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, 0x0, 0x1, 0x70bd25, 0x25dfdbfe, {{}, {}, {0x10, 0x13, @udp='udp:syz1\x00'}}, ["", "", "", "", "", ""]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) 15:29:43 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000080), &(0x7f00000000c0)=0x4) (async, rerun: 64) openat$cgroup_pressure(r0, &(0x7f0000000200)='cpu.pressure\x00', 0x2, 0x0) (async, rerun: 64) socket$can_raw(0x1d, 0x3, 0x1) (async) r1 = openat$cgroup_ro(r0, &(0x7f0000000100)='blkio.bfq.io_service_bytes\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000140)={{0x1, 0x0, 0x80000001, 0x2, 0xb3e}}) (async, rerun: 32) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f0000000880)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000240)=ANY=[@ANYBLOB="000000009b2aaf5fb2c992aac4cdd2bf999a9f40ff3145e5f325dc7743d64fcdbe8cee925ac327b95b10533a0200d98437ccdfad2173cd9330fa2f4cf4a7a2513766fb388422350e55f81031dc13be9b9924e735d4b405772886c3be", @ANYRES16=0x0, @ANYBLOB="0400000000000000000014000000"], 0x14}}, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000001c0)={'gretap0\x00', &(0x7f0000000240)=ANY=[]}) (async) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f00000002c0), r2) sendmsg$NL802154_CMD_DEL_SEC_KEY(r2, &(0x7f0000000400)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x8c, r3, 0x100, 0x70bd25, 0x25dfdbfc, {}, [@NL802154_ATTR_SEC_KEY={0xc, 0x25, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0x3f}]}, @NL802154_ATTR_SEC_KEY={0x6c, 0x25, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_CMDS={0x24, 0x3, "66a48fbfb0a72652c783bdbe700c7860f479212399cdb0cef62f9bedda4e85be"}, @NL802154_KEY_ATTR_ID={0x28, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x2}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0xffffffff}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x100}, @NL802154_KEY_ID_ATTR_INDEX={0x5}]}, @NL802154_KEY_ATTR_BYTES={0x14, 0x4, "b76523784902b0e1d2f2035789340fbf"}, @NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0xff}]}]}, 0x8c}, 0x1, 0x0, 0x0, 0x20000800}, 0x800) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:43 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000080), &(0x7f00000000c0)=0x4) (async) openat$cgroup_pressure(r0, &(0x7f0000000200)='cpu.pressure\x00', 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) (async) r1 = openat$cgroup_ro(r0, &(0x7f0000000100)='blkio.bfq.io_service_bytes\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000140)={{0x1, 0x0, 0x80000001, 0x2, 0xb3e}}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f0000000880)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000240)=ANY=[@ANYBLOB="000000009b2aaf5fb2c992aac4cdd2bf999a9f40ff3145e5f325dc7743d64fcdbe8cee925ac327b95b10533a0200d98437ccdfad2173cd9330fa2f4cf4a7a2513766fb388422350e55f81031dc13be9b9924e735d4b405772886c3be", @ANYRES16=0x0, @ANYBLOB="0400000000000000000014000000"], 0x14}}, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000001c0)={'gretap0\x00', &(0x7f0000000240)=ANY=[]}) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f00000002c0), r2) sendmsg$NL802154_CMD_DEL_SEC_KEY(r2, &(0x7f0000000400)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x8c, r3, 0x100, 0x70bd25, 0x25dfdbfc, {}, [@NL802154_ATTR_SEC_KEY={0xc, 0x25, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0x3f}]}, @NL802154_ATTR_SEC_KEY={0x6c, 0x25, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_CMDS={0x24, 0x3, "66a48fbfb0a72652c783bdbe700c7860f479212399cdb0cef62f9bedda4e85be"}, @NL802154_KEY_ATTR_ID={0x28, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x2}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0xffffffff}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x100}, @NL802154_KEY_ID_ATTR_INDEX={0x5}]}, @NL802154_KEY_ATTR_BYTES={0x14, 0x4, "b76523784902b0e1d2f2035789340fbf"}, @NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0xff}]}]}, 0x8c}, 0x1, 0x0, 0x0, 0x20000800}, 0x800) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:43 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async, rerun: 64) socketpair(0x2c, 0x80000, 0x1, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 64) connect$l2tp(r1, &(0x7f00000000c0)={0x2, 0x0, @private=0xa010102, 0x3}, 0x10) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) epoll_create1(0x80000) (async, rerun: 64) epoll_pwait(r0, &(0x7f0000000100)=[{}, {}, {}], 0x15555808, 0x1, &(0x7f0000000140)={[0x4]}, 0x8) (rerun: 64) 15:29:43 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0xffffd, 0x4d2e43) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) sendmsg$TIPC_CMD_DISABLE_BEARER(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, 0x0, 0x1, 0x70bd25, 0x25dfdbfe, {{}, {}, {0x10, 0x13, @udp='udp:syz1\x00'}}, ["", "", "", "", "", ""]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) 15:29:43 executing program 3: sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x3c, 0x0, 0x400, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_MTU={0x6, 0x1c, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x3}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e24}]}, 0x34}, 0x1, 0x0, 0x0, 0x754c79bcc0cbf9ee}, 0x0) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x488c1) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:43 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = syz_clone(0x80020a00, &(0x7f0000000080)="ba6ee3662df18472bd04a1e9a0ee4024ecb31ce1e65e6fff0fdb24440553", 0x1e, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140)="5223233404a70478beaca3dabc020ca64c1b9a79ff309cb09ace618270798c1b5faa820551b9875996f259b313d1a8337f951b37112532660ba2e19ba868cca4811193759d0ad3ae2a8abcbcfa040201b13fbc08857bb32b9ecab287a10d1de576b47e450f1b2c72ab7c93238a1780f10a3e568ad43c7273ec6cfae3a7") r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) r3 = openat$cgroup_ro(r0, &(0x7f00000001c0)='cpuacct.usage_all\x00', 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) kcmp$KCMP_EPOLL_TFD(r1, 0x0, 0x7, r2, &(0x7f0000000200)={r3, r4, 0x3f}) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:43 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_DISABLE_BEARER(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, 0x0, 0x8, 0x70bd27, 0x25dfdbfb, {{}, {}, {0x10, 0x13, @udp='udp:syz1\x00'}}, ["", "", ""]}, 0x2c}, 0x1, 0x0, 0x0, 0xc0}, 0x20004840) pipe2$watch_queue(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r4, &(0x7f0000000440)={&(0x7f0000000240), 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x14, r3, 0x1}, 0x14}}, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r2, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x34, r3, 0x800, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x7}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x4}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000004}, 0x10) r5 = syz_open_dev$vcsa(&(0x7f00000002c0), 0xffffffffffffffff, 0x200) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r9, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000700)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000600)={0xec, r9, 0x200, 0x70bd2c, 0x25dfdbfc, {{}, {@void, @void, @void}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'veth0\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'veth1_to_batadv\x00'}, @mon_options=[@NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "9e1d137d02bcc328070bc4ab726d1c4f47afe7f35d1c7114"}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}, @NL80211_ATTR_MNTR_FLAGS={0x1c, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}]}, @NL80211_ATTR_MNTR_FLAGS={0x10, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}]}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "8d623db34ce242684651d24397da9713487ff7f89143511a"}], @NL80211_ATTR_IFTYPE={0x8}]}, 0xec}, 0x1, 0x0, 0x0, 0x8080}, 0x40014) sendmsg$L2TP_CMD_SESSION_CREATE(r7, &(0x7f0000000440)={&(0x7f0000000240), 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x14, r6, 0x1}, 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r5, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000380)={&(0x7f0000000480)={0x48, r6, 0x10, 0x70bd25, 0x25dfdbfe, {}, [@L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @mcast2}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x40}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:43 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(r1, 0x40046210, &(0x7f0000000080)) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000000c0)={0x2}) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:43 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = syz_clone(0x80020a00, &(0x7f0000000080)="ba6ee3662df18472bd04a1e9a0ee4024ecb31ce1e65e6fff0fdb24440553", 0x1e, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140)="5223233404a70478beaca3dabc020ca64c1b9a79ff309cb09ace618270798c1b5faa820551b9875996f259b313d1a8337f951b37112532660ba2e19ba868cca4811193759d0ad3ae2a8abcbcfa040201b13fbc08857bb32b9ecab287a10d1de576b47e450f1b2c72ab7c93238a1780f10a3e568ad43c7273ec6cfae3a7") (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) r3 = openat$cgroup_ro(r0, &(0x7f00000001c0)='cpuacct.usage_all\x00', 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) kcmp$KCMP_EPOLL_TFD(r1, 0x0, 0x7, r2, &(0x7f0000000200)={r3, r4, 0x3f}) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:43 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) socketpair(0x2c, 0x80000, 0x1, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$l2tp(r1, &(0x7f00000000c0)={0x2, 0x0, @private=0xa010102, 0x3}, 0x10) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) epoll_create1(0x80000) epoll_pwait(r0, &(0x7f0000000100)=[{}, {}, {}], 0x15555808, 0x1, &(0x7f0000000140)={[0x4]}, 0x8) 15:29:43 executing program 3: sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x3c, 0x0, 0x400, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_MTU={0x6, 0x1c, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x3}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e24}]}, 0x34}, 0x1, 0x0, 0x0, 0x754c79bcc0cbf9ee}, 0x0) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x488c1) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:43 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(r1, 0x40046210, &(0x7f0000000080)) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000000c0)={0x2}) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(r1, 0x40046210, &(0x7f0000000080)) (async) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000000c0)={0x2}) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) 15:29:43 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_DISABLE_BEARER(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, 0x0, 0x8, 0x70bd27, 0x25dfdbfb, {{}, {}, {0x10, 0x13, @udp='udp:syz1\x00'}}, ["", "", ""]}, 0x2c}, 0x1, 0x0, 0x0, 0xc0}, 0x20004840) (async) pipe2$watch_queue(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (async) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r4, &(0x7f0000000440)={&(0x7f0000000240), 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x14, r3, 0x1}, 0x14}}, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r2, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x34, r3, 0x800, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x7}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x4}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000004}, 0x10) (async) r5 = syz_open_dev$vcsa(&(0x7f00000002c0), 0xffffffffffffffff, 0x200) (async) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = socket$nl_generic(0x10, 0x3, 0x10) (async) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r9, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}}, 0x0) (async) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000700)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000600)={0xec, r9, 0x200, 0x70bd2c, 0x25dfdbfc, {{}, {@void, @void, @void}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'veth0\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'veth1_to_batadv\x00'}, @mon_options=[@NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "9e1d137d02bcc328070bc4ab726d1c4f47afe7f35d1c7114"}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}, @NL80211_ATTR_MNTR_FLAGS={0x1c, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}]}, @NL80211_ATTR_MNTR_FLAGS={0x10, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}]}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "8d623db34ce242684651d24397da9713487ff7f89143511a"}], @NL80211_ATTR_IFTYPE={0x8}]}, 0xec}, 0x1, 0x0, 0x0, 0x8080}, 0x40014) (async) sendmsg$L2TP_CMD_SESSION_CREATE(r7, &(0x7f0000000440)={&(0x7f0000000240), 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x14, r6, 0x1}, 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r5, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000380)={&(0x7f0000000480)={0x48, r6, 0x10, 0x70bd25, 0x25dfdbfe, {}, [@L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @mcast2}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x40}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:43 executing program 3: sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x3c, 0x0, 0x400, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_MTU={0x6, 0x1c, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x3}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e24}]}, 0x34}, 0x1, 0x0, 0x0, 0x754c79bcc0cbf9ee}, 0x0) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x488c1) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:43 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) r1 = openat$cgroup_ro(r0, &(0x7f0000000080)='memory.swap.events\x00', 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) r3 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000180), 0x80) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0xcc, 0x0, &(0x7f0000000340)=[@release={0x40046306, 0x1}, @increfs={0x40046304, 0x1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48, 0x18, &(0x7f00000000c0)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r2}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000140)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x6, 0x2, 0x2d}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r3}}, &(0x7f0000000240)={0x0, 0x20, 0x38}}, 0x1000}, @acquire_done, @dead_binder_done, @enter_looper], 0x79, 0x0, &(0x7f0000000280)="e6e1531381af01179ad0662c0e6f3ddad4fec6aa4d6fcd83779b524bc6141a64db58c21efa65a0db978eb9ec5eae176fe3f17c4c8a383b62a8e71cd1f6b85467ca50280a0c3e780500bf08dc897d9836053c615a1152d28b30bbacea1e0e34b688b8d556c54684807cb29c307463953b6eabac8dc4e81ff016"}) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:43 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000140), 0x20000) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000000c0)={r1, 0x0, 0x25, 0x8}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000100)) 15:29:43 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x80080000001000, 0x111000) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:43 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) r1 = openat$cgroup_ro(r0, &(0x7f0000000080)='memory.swap.events\x00', 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) r3 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000180), 0x80) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0xcc, 0x0, &(0x7f0000000340)=[@release={0x40046306, 0x1}, @increfs={0x40046304, 0x1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48, 0x18, &(0x7f00000000c0)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r2}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000140)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x6, 0x2, 0x2d}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r3}}, &(0x7f0000000240)={0x0, 0x20, 0x38}}, 0x1000}, @acquire_done, @dead_binder_done, @enter_looper], 0x79, 0x0, &(0x7f0000000280)="e6e1531381af01179ad0662c0e6f3ddad4fec6aa4d6fcd83779b524bc6141a64db58c21efa65a0db978eb9ec5eae176fe3f17c4c8a383b62a8e71cd1f6b85467ca50280a0c3e780500bf08dc897d9836053c615a1152d28b30bbacea1e0e34b688b8d556c54684807cb29c307463953b6eabac8dc4e81ff016"}) (async, rerun: 32) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (rerun: 32) 15:29:43 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_DISABLE_BEARER(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, 0x0, 0x8, 0x70bd27, 0x25dfdbfb, {{}, {}, {0x10, 0x13, @udp='udp:syz1\x00'}}, ["", "", ""]}, 0x2c}, 0x1, 0x0, 0x0, 0xc0}, 0x20004840) (async) pipe2$watch_queue(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (async) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r4, &(0x7f0000000440)={&(0x7f0000000240), 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x14, r3, 0x1}, 0x14}}, 0x0) (async) sendmsg$L2TP_CMD_SESSION_DELETE(r2, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x34, r3, 0x800, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x7}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x4}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000004}, 0x10) r5 = syz_open_dev$vcsa(&(0x7f00000002c0), 0xffffffffffffffff, 0x200) (async) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) (async) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r9, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000700)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000600)={0xec, r9, 0x200, 0x70bd2c, 0x25dfdbfc, {{}, {@void, @void, @void}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'veth0\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'veth1_to_batadv\x00'}, @mon_options=[@NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "9e1d137d02bcc328070bc4ab726d1c4f47afe7f35d1c7114"}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}, @NL80211_ATTR_MNTR_FLAGS={0x1c, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}]}, @NL80211_ATTR_MNTR_FLAGS={0x10, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}]}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "8d623db34ce242684651d24397da9713487ff7f89143511a"}], @NL80211_ATTR_IFTYPE={0x8}]}, 0xec}, 0x1, 0x0, 0x0, 0x8080}, 0x40014) (async) sendmsg$L2TP_CMD_SESSION_CREATE(r7, &(0x7f0000000440)={&(0x7f0000000240), 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x14, r6, 0x1}, 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r5, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000380)={&(0x7f0000000480)={0x48, r6, 0x10, 0x70bd25, 0x25dfdbfe, {}, [@L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @mcast2}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x40}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:43 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000140), 0x20000) (async) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000000c0)={r1, 0x0, 0x25, 0x8}, 0x10) (async) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) (async) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000100)) 15:29:43 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(r1, 0x40046210, &(0x7f0000000080)) (async) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000000c0)={0x2}) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:43 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x80080000001000, 0x111000) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:43 executing program 3: pipe2$watch_queue(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r1, 0x233}, 0x1c}}, 0x0) sendmsg$TIPC_CMD_SHOW_STATS(r0, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x840000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r1, 0x4, 0x70bd27, 0x25dfdbff, {}, ["", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x2000c000}, 0x80d0) r3 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r4 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x482) write$qrtrtun(r4, &(0x7f0000000080)="da187713657d686943e28ff9f26bebd34e424aa2ed2ed719a0e678bf3c5c374aa7b80b04516b0205a4b9802953b4875dd32706ee37225127e17e4401091d00bf655d9f29af0e39ecb2620e6959895ca6dfccbb6e5280f2fde66e62d44229866065bed9ed7f40a484f41a175c6031c48e30acc1565ac21c967b8d6e83325c36106ad9255e8b895da7f7e416ad7954d35e106468e362d2266e2c8888fdfd5b12ce9142db8427e815c0bfb0b71c3d80abba26926070fc2c6ea5549e42c40a5a819ecb3fb2e163b77ea75df95ac8ffce59e8a06e8dcb704c75fca440d12f113c2044ea12c47bb755", 0xe6) write$qrtrtun(r3, &(0x7f0000000300)="9f", 0x1) 15:29:43 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) r1 = openat$cgroup_ro(r0, &(0x7f0000000080)='memory.swap.events\x00', 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) r3 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000180), 0x80) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0xcc, 0x0, &(0x7f0000000340)=[@release={0x40046306, 0x1}, @increfs={0x40046304, 0x1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48, 0x18, &(0x7f00000000c0)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r2}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000140)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x6, 0x2, 0x2d}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r3}}, &(0x7f0000000240)={0x0, 0x20, 0x38}}, 0x1000}, @acquire_done, @dead_binder_done, @enter_looper], 0x79, 0x0, &(0x7f0000000280)="e6e1531381af01179ad0662c0e6f3ddad4fec6aa4d6fcd83779b524bc6141a64db58c21efa65a0db978eb9ec5eae176fe3f17c4c8a383b62a8e71cd1f6b85467ca50280a0c3e780500bf08dc897d9836053c615a1152d28b30bbacea1e0e34b688b8d556c54684807cb29c307463953b6eabac8dc4e81ff016"}) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:43 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) sendmsg$NL80211_CMD_SET_COALESCE(r0, &(0x7f0000000100)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000100}, 0xc, &(0x7f00000000c0)={&(0x7f0000000340)={0x2dc, 0x0, 0x100, 0x70bd27, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x1000, 0x1a}}}}, [@NL80211_ATTR_COALESCE_RULE_PKT_PATTERN={0x1c4, 0x3, 0x0, 0x1, [{0x68, 0x0, 0x0, 0x1, @NL80211_PKTPAT_PATTERN={0x63, 0x2, "3bd474cb994c461f277177d351fb7afbaedc7351b6de453fe241db77e1e6035d891de344f95037fa303cfb851879cc84b4488e412c0827dba68ad94cff10267c2b66f384779082848e5fe2dfb629dce6d55e11c277edaf54f062c1e3441053"}}, {0x68, 0x0, 0x0, 0x1, @NL80211_PKTPAT_PATTERN={0x61, 0x2, "a43b18caeba707a7e4260c248b18dd83cd87025154b126ef4915cee6eb710b8d14d45ee1731045e39c8be0e068e96c56fd4ed15cdab0bd1e4df2a89216d3f2c33e59ade23b883f05cccfa2f9efad7b95ee4d7fc92a7c4d3e865f1ca1c2"}}, {0xf0, 0x0, 0x0, 0x1, @NL80211_PKTPAT_MASK={0xec, 0x1, "50d965f53b971d102709e9373a24983bdcaea55cec18ece39aa932974a2440168835adbd8dc3ad4bc60a0eb9cdf0186342fd03df412f3f7f9891b619a02f284dbb0dc935aebe058419978d30557494b7eaf22c3c3eb77955fb58bce5fe9ea0e8f2c808fc8bff9340001fee8d596c99d1fbf96e2128bc602d555037dd0d327a3cc298594a532052c932601042e3c5da22d044ce951057ea9d925a0a2493d11058a1c315e3e9021f96b77ec45001490789a1b08aa65d3f9ce21953d0d5e2c9fb1b11cf94322e915da40ee5b8b5202615a19556082aed1e93b4ccaebf439fa4a0728a54319672a08ba7"}}]}, @NL80211_ATTR_COALESCE_RULE_PKT_PATTERN={0xe8, 0x3, 0x0, 0x1, [{0xe4, 0x0, 0x0, 0x1, @NL80211_PKTPAT_MASK={0xdd, 0x1, "6f642c61727c10d7c1784994ea62bed6e0fd02ea004a4d6e9acf9651c5413b5e4284b2fe8d8cb111fc85c481fb67d7d6d2d0c76cb2417f02797128e4af8f0c8b91fa4e695576b4dfe76ea4ef6f303889eae069713c814d91d453959a6b58793c86132fc92175bb3fd8fa3b658324c2981b36b73e3042a6cce0e17efb1994b64eda6e6b3184997b38e97661af655d92205261e2e5fd79793cba129cfd6dce16ed6d99e95ad1881535c1541e7f2141e7c7362fdc749be59c75b714b52be1f927e3535690e7bbc0d619c3d30d56f918e78947c4bdc0deaa22e2d9"}}]}, @NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0xff}, @NL80211_ATTR_COALESCE_RULE_CONDITION={0x8, 0x2, 0x1}]}, 0x2dc}, 0x1, 0x0, 0x0, 0x48085}, 0x40) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:43 executing program 3: pipe2$watch_queue(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r1, 0x233}, 0x1c}}, 0x0) sendmsg$TIPC_CMD_SHOW_STATS(r0, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x840000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r1, 0x4, 0x70bd27, 0x25dfdbff, {}, ["", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x2000c000}, 0x80d0) r3 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r4 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x482) write$qrtrtun(r4, &(0x7f0000000080)="da187713657d686943e28ff9f26bebd34e424aa2ed2ed719a0e678bf3c5c374aa7b80b04516b0205a4b9802953b4875dd32706ee37225127e17e4401091d00bf655d9f29af0e39ecb2620e6959895ca6dfccbb6e5280f2fde66e62d44229866065bed9ed7f40a484f41a175c6031c48e30acc1565ac21c967b8d6e83325c36106ad9255e8b895da7f7e416ad7954d35e106468e362d2266e2c8888fdfd5b12ce9142db8427e815c0bfb0b71c3d80abba26926070fc2c6ea5549e42c40a5a819ecb3fb2e163b77ea75df95ac8ffce59e8a06e8dcb704c75fca440d12f113c2044ea12c47bb755", 0xe6) write$qrtrtun(r3, &(0x7f0000000300)="9f", 0x1) pipe2$watch_queue(&(0x7f0000000180), 0x80) (async) syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$TIPC_CMD_SHOW_STATS(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r1, 0x233}, 0x1c}}, 0x0) (async) sendmsg$TIPC_CMD_SHOW_STATS(r0, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x840000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r1, 0x4, 0x70bd27, 0x25dfdbff, {}, ["", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x2000c000}, 0x80d0) (async) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x482) (async) write$qrtrtun(r4, &(0x7f0000000080)="da187713657d686943e28ff9f26bebd34e424aa2ed2ed719a0e678bf3c5c374aa7b80b04516b0205a4b9802953b4875dd32706ee37225127e17e4401091d00bf655d9f29af0e39ecb2620e6959895ca6dfccbb6e5280f2fde66e62d44229866065bed9ed7f40a484f41a175c6031c48e30acc1565ac21c967b8d6e83325c36106ad9255e8b895da7f7e416ad7954d35e106468e362d2266e2c8888fdfd5b12ce9142db8427e815c0bfb0b71c3d80abba26926070fc2c6ea5549e42c40a5a819ecb3fb2e163b77ea75df95ac8ffce59e8a06e8dcb704c75fca440d12f113c2044ea12c47bb755", 0xe6) (async) write$qrtrtun(r3, &(0x7f0000000300)="9f", 0x1) (async) 15:29:43 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) sendmsg$NL80211_CMD_SET_COALESCE(r0, &(0x7f0000000100)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000100}, 0xc, &(0x7f00000000c0)={&(0x7f0000000340)={0x2dc, 0x0, 0x100, 0x70bd27, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x1000, 0x1a}}}}, [@NL80211_ATTR_COALESCE_RULE_PKT_PATTERN={0x1c4, 0x3, 0x0, 0x1, [{0x68, 0x0, 0x0, 0x1, @NL80211_PKTPAT_PATTERN={0x63, 0x2, "3bd474cb994c461f277177d351fb7afbaedc7351b6de453fe241db77e1e6035d891de344f95037fa303cfb851879cc84b4488e412c0827dba68ad94cff10267c2b66f384779082848e5fe2dfb629dce6d55e11c277edaf54f062c1e3441053"}}, {0x68, 0x0, 0x0, 0x1, @NL80211_PKTPAT_PATTERN={0x61, 0x2, "a43b18caeba707a7e4260c248b18dd83cd87025154b126ef4915cee6eb710b8d14d45ee1731045e39c8be0e068e96c56fd4ed15cdab0bd1e4df2a89216d3f2c33e59ade23b883f05cccfa2f9efad7b95ee4d7fc92a7c4d3e865f1ca1c2"}}, {0xf0, 0x0, 0x0, 0x1, @NL80211_PKTPAT_MASK={0xec, 0x1, "50d965f53b971d102709e9373a24983bdcaea55cec18ece39aa932974a2440168835adbd8dc3ad4bc60a0eb9cdf0186342fd03df412f3f7f9891b619a02f284dbb0dc935aebe058419978d30557494b7eaf22c3c3eb77955fb58bce5fe9ea0e8f2c808fc8bff9340001fee8d596c99d1fbf96e2128bc602d555037dd0d327a3cc298594a532052c932601042e3c5da22d044ce951057ea9d925a0a2493d11058a1c315e3e9021f96b77ec45001490789a1b08aa65d3f9ce21953d0d5e2c9fb1b11cf94322e915da40ee5b8b5202615a19556082aed1e93b4ccaebf439fa4a0728a54319672a08ba7"}}]}, @NL80211_ATTR_COALESCE_RULE_PKT_PATTERN={0xe8, 0x3, 0x0, 0x1, [{0xe4, 0x0, 0x0, 0x1, @NL80211_PKTPAT_MASK={0xdd, 0x1, "6f642c61727c10d7c1784994ea62bed6e0fd02ea004a4d6e9acf9651c5413b5e4284b2fe8d8cb111fc85c481fb67d7d6d2d0c76cb2417f02797128e4af8f0c8b91fa4e695576b4dfe76ea4ef6f303889eae069713c814d91d453959a6b58793c86132fc92175bb3fd8fa3b658324c2981b36b73e3042a6cce0e17efb1994b64eda6e6b3184997b38e97661af655d92205261e2e5fd79793cba129cfd6dce16ed6d99e95ad1881535c1541e7f2141e7c7362fdc749be59c75b714b52be1f927e3535690e7bbc0d619c3d30d56f918e78947c4bdc0deaa22e2d9"}}]}, @NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0xff}, @NL80211_ATTR_COALESCE_RULE_CONDITION={0x8, 0x2, 0x1}]}, 0x2dc}, 0x1, 0x0, 0x0, 0x48085}, 0x40) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:43 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000140), 0x20000) (async) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000000c0)={r1, 0x0, 0x25, 0x8}, 0x10) (async) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000100)) 15:29:43 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x80080000001000, 0x111000) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) syz_open_dev$vcsa(&(0x7f0000000040), 0x80080000001000, 0x111000) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) 15:29:43 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x5, 0x4c2dc0) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) fcntl$getownex(r0, 0x10, &(0x7f0000000080)) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:43 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r1, &(0x7f0000000880)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x14, 0x0, 0x4}, 0x14}}, 0x0) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), 0xffffffffffffffff) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f00000002c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000000000)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_KEY(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)={0x24, r4, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_SEC_KEY={0x8, 0x25, 0x0, 0x1, [@NL802154_KEY_ATTR_ID={0x4}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}]}, 0x24}}, 0x0) sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x54, r2, 0x20, 0x70bd25, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_MAX_BE={0x5, 0x10, 0x80}, @NL802154_ATTR_MAX_BE={0x5}, @NL802154_ATTR_MIN_BE={0x5, 0x11, 0x80}, @NL802154_ATTR_MAX_BE={0x5}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_MIN_BE={0x5, 0x11, 0x2}, @NL802154_ATTR_MAX_BE={0x5, 0x10, 0x1}]}, 0x54}, 0x1, 0x0, 0x0, 0x10}, 0x0) 15:29:43 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x5, 0x4c2dc0) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) fcntl$getownex(r0, 0x10, &(0x7f0000000080)) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:43 executing program 3: pipe2$watch_queue(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r1, 0x233}, 0x1c}}, 0x0) sendmsg$TIPC_CMD_SHOW_STATS(r0, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x840000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r1, 0x4, 0x70bd27, 0x25dfdbff, {}, ["", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x2000c000}, 0x80d0) (async) r3 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) r4 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x482) write$qrtrtun(r4, &(0x7f0000000080)="da187713657d686943e28ff9f26bebd34e424aa2ed2ed719a0e678bf3c5c374aa7b80b04516b0205a4b9802953b4875dd32706ee37225127e17e4401091d00bf655d9f29af0e39ecb2620e6959895ca6dfccbb6e5280f2fde66e62d44229866065bed9ed7f40a484f41a175c6031c48e30acc1565ac21c967b8d6e83325c36106ad9255e8b895da7f7e416ad7954d35e106468e362d2266e2c8888fdfd5b12ce9142db8427e815c0bfb0b71c3d80abba26926070fc2c6ea5549e42c40a5a819ecb3fb2e163b77ea75df95ac8ffce59e8a06e8dcb704c75fca440d12f113c2044ea12c47bb755", 0xe6) write$qrtrtun(r3, &(0x7f0000000300)="9f", 0x1) 15:29:43 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1000000, 0x1010, r0, 0x8000000) 15:29:43 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = inotify_init1(0x0) inotify_add_watch(r1, &(0x7f0000000080)='./file0\x00', 0x680) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:43 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) sendmsg$NL80211_CMD_SET_COALESCE(r0, &(0x7f0000000100)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000100}, 0xc, &(0x7f00000000c0)={&(0x7f0000000340)={0x2dc, 0x0, 0x100, 0x70bd27, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x1000, 0x1a}}}}, [@NL80211_ATTR_COALESCE_RULE_PKT_PATTERN={0x1c4, 0x3, 0x0, 0x1, [{0x68, 0x0, 0x0, 0x1, @NL80211_PKTPAT_PATTERN={0x63, 0x2, "3bd474cb994c461f277177d351fb7afbaedc7351b6de453fe241db77e1e6035d891de344f95037fa303cfb851879cc84b4488e412c0827dba68ad94cff10267c2b66f384779082848e5fe2dfb629dce6d55e11c277edaf54f062c1e3441053"}}, {0x68, 0x0, 0x0, 0x1, @NL80211_PKTPAT_PATTERN={0x61, 0x2, "a43b18caeba707a7e4260c248b18dd83cd87025154b126ef4915cee6eb710b8d14d45ee1731045e39c8be0e068e96c56fd4ed15cdab0bd1e4df2a89216d3f2c33e59ade23b883f05cccfa2f9efad7b95ee4d7fc92a7c4d3e865f1ca1c2"}}, {0xf0, 0x0, 0x0, 0x1, @NL80211_PKTPAT_MASK={0xec, 0x1, "50d965f53b971d102709e9373a24983bdcaea55cec18ece39aa932974a2440168835adbd8dc3ad4bc60a0eb9cdf0186342fd03df412f3f7f9891b619a02f284dbb0dc935aebe058419978d30557494b7eaf22c3c3eb77955fb58bce5fe9ea0e8f2c808fc8bff9340001fee8d596c99d1fbf96e2128bc602d555037dd0d327a3cc298594a532052c932601042e3c5da22d044ce951057ea9d925a0a2493d11058a1c315e3e9021f96b77ec45001490789a1b08aa65d3f9ce21953d0d5e2c9fb1b11cf94322e915da40ee5b8b5202615a19556082aed1e93b4ccaebf439fa4a0728a54319672a08ba7"}}]}, @NL80211_ATTR_COALESCE_RULE_PKT_PATTERN={0xe8, 0x3, 0x0, 0x1, [{0xe4, 0x0, 0x0, 0x1, @NL80211_PKTPAT_MASK={0xdd, 0x1, "6f642c61727c10d7c1784994ea62bed6e0fd02ea004a4d6e9acf9651c5413b5e4284b2fe8d8cb111fc85c481fb67d7d6d2d0c76cb2417f02797128e4af8f0c8b91fa4e695576b4dfe76ea4ef6f303889eae069713c814d91d453959a6b58793c86132fc92175bb3fd8fa3b658324c2981b36b73e3042a6cce0e17efb1994b64eda6e6b3184997b38e97661af655d92205261e2e5fd79793cba129cfd6dce16ed6d99e95ad1881535c1541e7f2141e7c7362fdc749be59c75b714b52be1f927e3535690e7bbc0d619c3d30d56f918e78947c4bdc0deaa22e2d9"}}]}, @NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0xff}, @NL80211_ATTR_COALESCE_RULE_CONDITION={0x8, 0x2, 0x1}]}, 0x2dc}, 0x1, 0x0, 0x0, 0x48085}, 0x40) (async, rerun: 32) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async, rerun: 32) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:43 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r1, &(0x7f0000000880)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x14, 0x0, 0x4}, 0x14}}, 0x0) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), 0xffffffffffffffff) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f00000002c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000000000)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_KEY(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)={0x24, r4, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_SEC_KEY={0x8, 0x25, 0x0, 0x1, [@NL802154_KEY_ATTR_ID={0x4}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}]}, 0x24}}, 0x0) sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x54, r2, 0x20, 0x70bd25, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_MAX_BE={0x5, 0x10, 0x80}, @NL802154_ATTR_MAX_BE={0x5}, @NL802154_ATTR_MIN_BE={0x5, 0x11, 0x80}, @NL802154_ATTR_MAX_BE={0x5}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_MIN_BE={0x5, 0x11, 0x2}, @NL802154_ATTR_MAX_BE={0x5, 0x10, 0x1}]}, 0x54}, 0x1, 0x0, 0x0, 0x10}, 0x0) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r1, &(0x7f0000000880)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x14, 0x0, 0x4}, 0x14}}, 0x0) (async) syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), 0xffffffffffffffff) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f00000002c0), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000000000)={'wpan0\x00'}) (async) sendmsg$NL802154_CMD_DEL_SEC_KEY(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)={0x24, r4, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_SEC_KEY={0x8, 0x25, 0x0, 0x1, [@NL802154_KEY_ATTR_ID={0x4}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}]}, 0x24}}, 0x0) (async) sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x54, r2, 0x20, 0x70bd25, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_MAX_BE={0x5, 0x10, 0x80}, @NL802154_ATTR_MAX_BE={0x5}, @NL802154_ATTR_MIN_BE={0x5, 0x11, 0x80}, @NL802154_ATTR_MAX_BE={0x5}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_MIN_BE={0x5, 0x11, 0x2}, @NL802154_ATTR_MAX_BE={0x5, 0x10, 0x1}]}, 0x54}, 0x1, 0x0, 0x0, 0x10}, 0x0) (async) 15:29:43 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = inotify_init1(0x0) inotify_add_watch(r1, &(0x7f0000000080)='./file0\x00', 0x680) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) inotify_init1(0x0) (async) inotify_add_watch(r1, &(0x7f0000000080)='./file0\x00', 0x680) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) 15:29:43 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async, rerun: 32) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1000000, 0x1010, r0, 0x8000000) (rerun: 32) 15:29:43 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x58, 0x0, &(0x7f0000000200)=[@increfs_done={0x40106308, 0x2}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x50, 0x18, &(0x7f0000001340)=ANY=[@ANYBLOB="8561646600000000080000000000000002000000000000004000100000000000852a64660000000067220faebfeed7d4d0ea8287cf10bf97034f8b32da8d2a5d75937c13d550faf91dbb3239a7692dd0a5b283cdc63702f633079e7d061e038872c78406e947e8274cf2993794b7a6aec301fb7d0dc11ce7402b52f8341b697132f06ac7b6c4f1573a3398ebe82353fcdcb0f41d49fc790d9940588d5a43ed18cf7a2e3585954798ad772288d8fa1ee12d68dd2c9e3919b6d9cf68aa61b5", @ANYRES32=r0, @ANYBLOB="000000000000000000000000852a646600000000", @ANYRES32=r0, @ANYBLOB='\x00'/12], &(0x7f0000000000)={0x0, 0x20, 0x38}}}], 0x1000, 0x0, &(0x7f0000000340)="7a79815fc6870a2be480b91d55fc0d88663fd059158a83f04bd93dbbe4198e8d3846947dc90c050cd030a43c3872b8fbb4e60481caa0cd33722f7612ad2963b7a156bb561cce8c6c708574ae53c5cbaed9fea776b375dd057ebd0271420be66eb406c84c4bf1f0deeee2553a0de77a89b96fa5094b6fcfd414f85d15ffd8d66c7cbd1fe07478fb7823960d77918ec583fbe68242c61612b6f61865cd3c3a7fb3345536274fcd58d2046b4571fd49a92c9fde590a5e9affd3a9308ceca399c366bc2546d7bf279c957448160af48e428bfd9aa1f3b8cccfb68f5e5b774fa994d10936e6d4c05975c2b6a8769a9150b370743b284b8b07413f7571ba2db821d197254dcd27ec1b27dc07186cc9c2b32507c62bb13e722b2d9fd7d656129de66c8275c837af00dfc48c3bfd14add0fc8b15c4431dd0a7242cc9c90a50c67c80370eb7e85a886f0c812dbbf3767470bc4284bf11be8d93a33b01db58cd4048a0dbf1b83f128aeba09392fbe241971bfadbccdbc0425d6bcb4c5779da2cc3eb19906e73b3311afde69f883002e48a0b6ade48b8115ba3854f5fc7869836183dba0505954634cda8b7518a3c2a249f383b0c22330c827c641b2bd052720d60b74db5f4a623788faa30e0ad722bf82c876a3756dca774ee73f1f3b18dada4987e87105869028ccc8f6c1e8749ed0825745d8247cffdd770c2ccd72a8ea0fda0767595f9e5aee1daae42383fe5a0d102cbe0771227bba8605c4d155819718a20feeb5744d7f4dd47e53be8d4c856d9ebd235976d917f559afaf65c91155e6dedd8da632b534e937eafb81f339118defc5f724afe24b5107fc285d6f0c1ed2a174c5ee2bdfd417085159ece20819475233c55294231899828156e90df6c389e26b1aa871413703d0c6a71d81c881e176435a41444547735fbbaca1912b7a61591b36e217f9e7468787212bbcf4cfa4789de0869df033cbce84385bdcf483f9c67aa1faac128fc58cd6e55f91ab3a7ad1b4832d76f634c2cc4ff7a05f5a6d040f7045dd7b414fb88e8676e6917479a243527440b0b3eeb4552e3a12314a0aeba445ff311b69d0525273e1b9edc95d312faea20a135d83fb94075ad16e170718c749c8e4734386d926788f9e38aa1307b7faf417755df78e79514b5f2783224ce29956706a1a3785416f370b812398bf8ff3e8b4bd7677b991f85f1f895a44b46971e3009704bf2dcfc9aea61de092db7eccb7266a9e9af7fe2b0423ea6f6d8a61209a9d89f0b69389907d9faccdd81e66f223cbf4c583040e530963aa127d9e593e46db2cc2daf00a5083cf8d4052d1b854ef6f3e1905d01fc1bad1397281a3b8f2abafa221f16c7a788d718b8b28ad6b86186ec86816b59c499baac73f5df6a9934d8a04a2295672aaa9e0235f88a5a4b61e3a590c5709e0d38c635efaf7db361f02c49a05173b9ed0a342c603fc54ef3806b1544c31f828a426aecf04fa334ca48a014485851ce6470565b890c689e14dfd4e523dbac5c05587bab713745c8fa06bf9ae0576b447702333d3c653b49428717aed59f7be817e2cb9a46b2362c6e74d385308649554761bd30dd35764d11789643302bf353394ab0427b4f934eb6d823b73d9ec6f6651e981607fcd0c47948a117691f6104338f636b102a4b6ebe4a8668129aecaeef9d50cacbba06d545062f6bd7823d2ec22adf2dbac2304568e430b3f02200e2169be9ce952c9d3d78e454fd2babb73edc1519b784f151b08862e99afff6bf77c43571d735920c439f3d491df4c2589122f4c3b0badb0d1c0dba836243042ee81020f49682eaf6079269590c4cdd0d5bfd72c704759fdc2cf8122a2d3e401bedf0df3c84a097fdbe7cfc200f78958515cdde754b01594d60a371b788f91f6395c373c292f20c5c7aef3e12cbd9cc9cbe28192548ddea1f80a83698cd4cdbc5a2263381a7301ac531178e16095e703f89cbf5789fa04ec2eae9a0bfca7b9ebe5bdb322d3be4abca12fdf7507896b5865c0b1b1111492bcbf959e04e42bbe17377f7a34775a59b224aac4a955ecf8e330b34e195e56f17019ef475109fb7ca5e3ac9ad8cbd36e8791d10da4bda9ca0a2e39259d990c56dd3b04621bcf40895e35045b610e59505d7c1d3c42235f32f36a4a85b6f12ff0e78a0280df0164aa4c2fd9a5eed97b5e7f7936a03ad64f3a0062a03be348bbe9c2686324c637c2c62a4b5e3d58b80b7ff76948e7ffeb1aeaa9adf87ab8cb0797f0297f3549d6b320efcb0bf6be1ab448cb398c28616474e69be71cd8aa9b24170c0be6b1c87b31c4c8689c85c468688a3381301144cdd906b5d4fe5901f71f7d34e8f7ab7a35e62af3ea3fa215002ac09ecd6cabd86e3a628fac3b456dd9f732973c519bd9231d001fafd5f3f584d7685740d81708e24e136c98b5ac23e8e28dbc891be80d0c6e419e47a6df211731be66412168ab941cbab1d98847af0070cc9362ff533918878639607012b70e08d95324cf9e7392613699916e0a922200fe074960b592c35cfdfde2641f8263bcd05e3bda75779c89888d28528798ca75ae52d5f789bb79e86f4821dc5ed8dc9b85cd99e6a87498f27e3a181cafc8d107209affef67719fda76d225f15f882c14286c3a2d43c71922d8aa01ea5831c9b8751a9c15345e85a4c7c51cf92c1212c9d38785227c529d4902aa784fc9061bb2564cf31252c418b1eac594e2e2115bf09f492ca8b9ac61cf3e8c50c82706c525bf9698f47814680030abdbe3777e9d0abcfa463032c886bfe6cc023178587363896061d441a3edb00a7d8f0bedb6a6ea8ed0ddf20d4892e3624a2af6fe591b2c1ddd04eb3d65534df8907f9cbb2b5d4b2d7dc342746ac283efec0a222123cb90b588f8b2c472af40787e191ba271fc7bc312a20e0a0b7fcc402ea1208d7de9652cea3d733b7f73192f7c29c32b437c28fd4023e3ac375543f28d715769e7d52378b0d20c0277b52250b34e738dbe122164aca82c219ac0d2dde11caba840b81cfbb27ecafc553bc36f0883a7d921bd1837ee414c501aadcfa52a6558ec64de0c9c3beab9f8b41553735df8b59881119ba9cf85eb024ddef35b88ce0f9bad18e3f0b8c851f2906f82af0988478631bb0df0f912c155ec894eac17c8b49e1292a416b8d0f7f8bdfa5b884f689805d0b0fd971a9073190f7cf475df6bd81de4c6242f67d8897c333ebde74c79dd0c0e73dbbaeb39b0c3abafb5dda4dbb4fa95128fd269cf6f1b9787c2939fc20e17b60b23f806610fbbb6c0b2ad1123b54f8b648a385c3e9a0b1669b15a87d5704194bf97cb7e1ba62ecf8c2dcb090461622bb448cc504f871cc4cedb8d530d840e67f0ae769d70607fa4e8fbbbf2214905afcf1028ae0d5dcef4f7bec0b0553c3e1c0d887b378ce43288eec440975b0b4093975b7b0de5daf7ca031d07d706c421b8f053ca2622933e81b6939d9b7aa87e79883226a9aefd5ca21845d5717a1d97c7b141502ad61c290bb3383ca0e3d0794fea20288d1e471feb815113c910e4d6a0dc763babdb5d5a86070cf5f09f319e1193174a9a2ce34731c157ba0ac24df969d5657d4c009235de027d3a381490d3d124336253dfb1c53babe061b988432387afcf8a1899f22792576e8ea5c13a568b19848459daa2a3a966cb203c2d116be675e36b064e3be2adf9cbfb857ec3d96cc0cd64d069491b721d84be3a95bf8ccf66e1b68fa2b3f1ef48aec787853eb7ca08a6276f4044e31ee55169c50dc3cb021b9232daac17693ec137ed71e0d2ba17713a62b8aac853a5920e406a5a764ebcbc949baee192025d0df5aa792e60ac06dc7914ac22351ae3b40746dc0f0866909aeceeded5d0882d84e626f22d226e4fe4acf3cee5d26154df1230c058bd022668221e79c96e61cdbb368b8911fd59b4bd68b22665c4117fe98a6afea637b2bfad4cd6c0753f2116251ce0881a5dfb125dd62e35ae03229560a176b28f9ad29eef153c851535ae5e7a48083a6e2665c63bc6785b1092b011eddfbdf73dc71b0788b09f14dce3b2109ddcaa9c143af6321aa55b338fba7f215be11875528ad25d387ba8ae812ce4cb37eb2989ff90449f5f394b75eebe5b79a1ec4e89859ce4b2edf0bc887f0bfbb3d182729d7a4d4f3f8c53ee6174b72dd2e01bbfb2f2326769af3ca87e6ed997efc36d1744dbcc9202f578f4eb260e56c1388b58a80d2cd89ca54306851ca1d9f3df7ff9682514a825a0c39aec3c94c57fdc45a67c2e5b3e6bc85fd480a3286b40291fa99bdb99509981d3200444c13864eab31d824d43a65a18879ed4c99455c8037715d59724a14ae1d3e675cdc1e1496c0a9e5aa5b215ac53adf10441c71ed5cd9d526a9308daccbf07a24adc35213faf9e01191f44d7423c776253b86b28b72ee3d04d38cbe8ae2ec34acc081425737847e76cda0d94db9787e16bc5b598719e96192d16365c0690aadf8850465890ab9994b1dd2317e46ed941e5780650b2d830820fb3ec280e37725a873b12a5627f01ce9faee633c512e75a3c9d675527aeeba12e86db9f2837040d01c77a4ba56481a7acf4589c08e4bc0897af27edaf7ff012ddd6c4f6d142dcb256c9ffc0cf554934f73bf016c3b7d3ae470395c386a7b9c7975ee862afa62b088f5906de0d5e698a04021a561d3e2d721196471e465a853c4bf2e94a72c32d23c119d48819cf5a5314ee0dc54c37c0a2cc4645ef663f82fcbb8d03f20a59576ce6d6b32bede80e6dab27953f32eedd817ba93e02dc662b17130678f984baeeadd827c9db023189d28674eb7b95eb0593bffb392a4a9058d001bad51ff2a1b5bd9f6ee85b09130548a8c7e8c54b2bcd3fe4cdfea4d2d8a3c402d832e953aae734527838283e829627bfd6cee3b0bed697277aed33333f299dd2ca95184e6a6e2ae9f70c88b108c760f3b95928d7a3efb28e3eac3573908e0b974d48f7eb323031f745fa919f8bbe79a86acb77d4d20f652152c5b39251c7d6bf447b2fa317a63522fe2178b3a2676cb9c9b64211dc4ea96758e0e6a16a65ae55c0a42d5b962308a82ffd1846d1a33d3978cb85efc5d9a23072f3d86789c8b288398623660fc2bcdf511bc5cbbbe60f2b16cb7fca5a2de8101f31f3450d819a3934783eb1161ed1c63ce192ed9f83bd5466bcc3120c49c3676c8d81ee89576f79ab26366d69d17b5181ec8286552eb375b3d0717390a2b9ff567dbe18a6656feba192b58452ce080c19ff2e4460e9bce357bf7525db1d3aeccd90ff571262d3608bcf7d1283f992af3b9060ab8b268677e06f70bfc65bd9e0af8f7e274721f4772a155fb982737812d4874ce11d354fe8ca653d66b48415aa0d96bd79c00dce3d8492c9bf572c869034082822a4105785a58840429a71d2d28a535917af4395e38568ee8925d95060e1a4864b231212a2be5cad12079ebaa7d00d9c8836e47113fe6f9cd8cc88207c3033b32da0becfee784059eb49be09b07524a27d85737d5e03896b15e562bd3116ed4f51be8795ac539a856cee9820680d5b27fd62cbcfa04da13f863f301aed4bf4975138dc6c4d7760626e3e1c9dc1a77152c21941ea3079b5dacacb0d9990a2825ba62704108770d0c59451d439b14a1ccb947f780cc35c5134301478f562a6a8a320d0f4e9585c0755581817b99dd865eaf1046b28414d0062126583eb38d8fa88913c9fcabc6fff507b76b2683601796a1594e138181ba3b8e84de8e69de235d5400ff7cd950c78437885ee44018d774b674c41f3222abdc6aab0b56bc9df131451df004"}) pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(r1, 0x40046210, &(0x7f0000000140)=0x1) socket$l2tp(0x2, 0x2, 0x73) r2 = syz_open_dev$vcsa(&(0x7f00000001c0), 0x84e, 0x200000) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r0) 15:29:43 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x5, 0x4c2dc0) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) fcntl$getownex(r0, 0x10, &(0x7f0000000080)) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) syz_open_dev$vcsa(&(0x7f0000000040), 0x5, 0x4c2dc0) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) fcntl$getownex(r0, 0x10, &(0x7f0000000080)) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) 15:29:43 executing program 1: pselect6(0x40, &(0x7f0000000280)={0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, &(0x7f0000001100)={0x4}, &(0x7f0000000340)={0x0, 0x989680}, 0x0) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x4, 0xa841) sendto$l2tp(r0, &(0x7f0000001100), 0x0, 0x20008004, &(0x7f0000001140)={0x2, 0x0, @local}, 0x10) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000010c0)={0x1c, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="05630fa9c94c000010400300"/26], 0x1000, 0x0, &(0x7f00000000c0)="90a6f0974dae1d19015b9a537bb5a9e0c2703dae7bb5dfead67b66e6e369172bb8a758649aa07879eb528a939c2b74658ea68dd2a0eaf399fe9da8a18a751f66331b8d1c728730778a26fdaaecab464bbb60f9601c3288985a99843c5daadcbe276df9bb2453757f74152c70eabfcd7c7721d548b69c14f59debdc9d1e9cbaf18888a90a6f554039df28606ff920365600c672d7029d9e13e1a551373c57b75608f149fe55c4f1ca0b8040d85c235e7674920dd8560ca0b8cfcc3eca809ab8fdc5d84aa64e56d142cce08641611536bb5ccac4b557155d99f4eb0489ff4c0dd5a8e6458696c008720cad3bcafe73c7390d9d2bf860646e02b9c6ac0257a6c9988d0d62b1f7404cb935963d0ffa1075f23ccb05321b00acaba5b26d96d93f36a4479a46107f4222922b557ddf570b4ec6bbc432e95ee80acef0a0327102401be395c62f77b2095c2f1a4c2f7cf520108bbead581330a15051ec4566d5a52711ca707df81596d471b9da0066651ddba6f652debbd4298f85fa18f04d16e74b6e32da0a4227a99982126e162897afbb9a27c09f7616a359af11c1f55d22c3189f5898e78da806de1239f97d1a094bf282985030d49d55e6abad8ae29904ac6a79578f5b1b559c14cc7f62f1ae18ec18d8ed857c7e6d8677f315dd61b7d632e980ebd6492fcff960d26f1a1bcfb97d3f71151c88a552f89b7b8868dd81be78e941fc0749111d45485e5877882b35ebc0397251d6b7aa9d82560b196157bceead4352985e6e4de1f5b0f80b8e3e2e4f7d52aa494288efd51347e7f24f0f0798cf00021844c06bf7ee25c0a2317f8ea6af6b6a7066c16dd96bf4a5fe9077a9a0211ba032ae44a5c24ebb51ad8699e18b4e08d43aad2c74ca76bf473441e649ce35075e9daa425575a209714da283ea415bb0fcd967dce2129c3280b017b8b30ccf21ce434dbce89dd4d03937be9f4acd0a645ab99147aadb8f776cd37dba77b428b0aa0549ebf9f0cb6520c2b75384c379e7f17965a4d2f2b109696a3f8ecdb4a70a60762f87edc3c6b0d33e3ed0b1f7693f80b14820326d9773b3146c530b10349679066687fa16ea668609a9b5dde1d660b58e15226829e5012e24b553acd0a3bdff4a9c7d06006fc522eca0a3b8d124699f1c5d14c6623e8fa4e30f173d7a5c53fa908ec81eb0de8554952e1a0d7b5f080da0443c21d065f1df874f33d7346f48f878d218b8ae25252a3c3b9f71b91614586c37e15fa56ef961031a1c7321c1f24f6e81bdabb6ec09ea9cb1213e551cfbc223d094a13e7f70f9117f14862b5d3f46c308de8fec6ecb4dcddf94aed31c5ae07b9b61ec8aed25bd7f9d944471dfd4d4d8b1a6de7f4c48526d3ae2d8535a1e0388c11d158876c67d1010cd3ad031acc1fbbb8d4d6b74c3778093d63d884fcfca00ec452a4772d871c89b6093ca97c1d7673ff0271180d16c312f769ffe93cde6aadb03dde1c297f069a2ad62485a2eef11aa6abf7cf564641fd2cd40c4a890437cc80a047df484a383a376d5a151103fe94c2c0d2634ada9c0b2c8957dec71708335e1c1ba2b66ee3116ec92f7bd5c1057b16182692fbe6867b3841f986ee299cf2f7cb63b04313f8c93f88e1efd68acb6db84c254556604ef42486bf1736b3b92f77192befed4fc3aacb9b90d551f1407e43c8b90633f132a910ebb3696c8afad8476b8fbe014cadd448935d0eebd8c8fbf40233a453ed243197f1f9279b30f82042571553e937c935383b10d5ab9bcaecb1792b791e7132094fa0f95802d8528d89d9fea9df5738f3946e30daa1d1218bcd5e3fe17ac0f3068e62e9d2ef27a68afe9ccb688eda5e9eba62ac7ae3dd32f95d4f4a846e259a7bc2770dc2f4ca754b57c5c71855fcfa3aea082e7ce09067303b6cdca2ec7c3e153556e3fe1d2c187097e9aa599e8c21513bed9ca146678d60b30f7ab20b26f97e7f4ce685773eb2579198b686b5de31ebb5f54c2556d2d364c367d2500271edf2f4ccab3889c8509caa1e600e3fa4a130780c3c8446efcca5b15217044526a2a54b935191663bf5844050df18143c6635e68432b7e8f4082c53d24dd200b50067db6434be44629c4701ee59234a742ed608ca0e085c921903fafdc5e5e292f2eb492d8ce081ddc8c436d5511288bf993341a256dd5c7f18e0768890db6ebc25323e71900678a98ae7aa95fd124d52cadc4ad580d7203ca2c0f8e6918ffdb5adfccc3fa84e6b1c6944dab5c6a6fc4f36975f7f7a188f04863e103e8d035fddf627aec28d1b79909f3b92dfd40a2a0905e42e71f0501b83a007830901a760519f18cb3bc6c97fa1053d9e812b942111b1244493c29964785958f399581cccf7db5ecfb23fd5399e9f54050b472aaa3abc15604ee1cc3c786d136d8c71bae8dbbfcdc9dfeb03ab5f232ab1cd04cd732838017e6b1f37626ba71bac66f3cb0eaaa7ae77e00b10d185e70fe7c78290f6097e4fe0cd540b490fd054832733bf938968436cc7d144cc15c1802d26dda335a64dce76ea02eee1d25c1c9cefeb9513cb68aa2f051bc3584747504bf636a2280c807dc58b708bdf41a58ee9de3a510f718452ce340d2c18185ce5280e3a8ab7c6eae637ed1553ea26092acdf62ee5282e48863848d78cf0e19210080ed86c6a98c18a85df9d3efc9b1c6c89c2c15edb2d0f94470844ef77b21eaea44e719081cef0597b67a6aaa6b2aa627cd90589c9bb9d83ab4256b753e9b3b12ebaa1be09c732b566ee2f1065a0cecac0e1be23a6d85ff16c444cfee854f8f50d17e610370a3cebbb5671216b28bfd63a3c7f0fe47c96b75e54f0867614b348a452eda99930866d93c40561e3a4faba67ca278512d3fc630c9bf5ddc399ac8a62f335736434c9e04fa94c283488cb72e2343b12d9d85b8951d88b692ad7569c7d6c07ffc189f14f3e51bcf4b75063ab2299d8476738646bd1fa49b4fe7b88a76d430184c52e479d1cdc4c59ce212c57e2edf42d1dbaa23403c4dda731b2fa30001f18b794b1619a389f1623fc09c20898a8ea37188fcaf00c25e615e87772b6f286d50ea195f95a69c7ef751c1a83178545de6f462fbbcc9923b611c71ff77518438001d8f052ecf3156ae5cbda17d3ffabcdf18c0ffed177e40998a104dc519a94ebe82caccc7e636ca45882986c8c0e0ebf4671d612f817722fe0c260565e5755c0a011a5a0eb5b10ee64fecf7da6e20c6fbaa1649f461fd3994f007308ffc5aee4d1cfcef96cb1fe58325630ad1a06e4ae1e4f140293b02aacf77757b37d3ff6f1ae4b11e9c9f4610ffdc4c1f2f2f36127169a7928793f49629e8aae605b62b52ace40d578552925f582c4cec01bcea102950e3d71a454fe21087f8fb1497ec09129c35b79292e06a3bf798dcf872febb42c72fd6b80af44527e7b336a0dfedf5b024398fd908b7ca1b5578df66c952cd7d47035f8c78e66e3f79d790fab25cfc086263115e3b9ae779047d04ab56b4738b83021869b35ca925bc75dea2fe2c808288a4d9a84b10522f633cd6166246bf3c7053c311386b84c1c1aa13700da7f9f4115622f9e5fce2cd6937cc2d3376cef9a6baf294c3da1d8425eb2809c6183ba7971d429f6244ee40eefdf4dc9e173d28baa1fb065a0feed40975f25aa21ecf4e5188c0fbdfa215c0810272deda9bf06e62ae1c9382ef4f77602881aa755e11ac04710d6bc3d44bb56337558c8258a4a3da23d4884e12f03c91c7149330ef41466c9d82dc15da11655913af2a38db9e36af21ee4db01b97fde96c02a3ce337db75a6744c99d25c3909ceeede8c97c716b23ab7f4df8ac5219030e02563bf96a1ad02c7d30593dac0a228c9d0e29919ecde30d87529b88745a94332004ad473fecd6991cbbf2a5bfe9e65895682d8cd0f10b8554d96aa971b0b7db68453ecf96aa55d0e86aaeb662d68369db8bc46a8eee570c13eb8b215dff3f69ae1eb26c76eb89abe9c2c619897942c669670383f85468970b591ea3de79503cc20e86edd6bff38769e23c255576fd8f3eb33b8e13366bb3b7427302a122e78768575337a6f289bcbcd14491d69f645703efca3c59bbc34d666e68fd683bbd94c751e770a5c0a0cab99fa73495159f9b98b5017bd12638acc7bedfbfa988dad44b8329a8f682e7cdbe8e94c01a7449089c32dae0a4e75feceed7bd344eab3a83f3a4141c2955797b30d2df57047f65f00fbf414c22bbfda747c2803c4d33031ea035fb32a33a039ba01a3305c36bf3702c9202698a071cac5226af37cca69c1cf97555223df42b9b5e5d9134c5c728974231980c4ddeaeb45c61501cf6dbae14648de7c173f151686b4f85739a617c431505d225f7f9eda1149d1f6f3e45ee21696794840681f8423f576a70d241b62652255446294713b798a14dc1e6162010004b5b3582258d8dac9d3e55cf0b59b3b59bce21304cac7b517fac6115fb8a8c61ca0806e4f1d805edc8b2573d5738b1706569249960629cd114af96089e8a92f63ad4d0c923aff8a8a661f4802b8b4db3261f191658300361417ee3387b9ccbb21190eb8da8596c58b1ab09e9b2e2900f76fcb8c004794d047fe4d09496467a8340af82938f597f845c9d91a1a747b349d9109969535cf1e85036ca02acd8f514fac58020e46e6176ef4b72c869948a05c2f1c78e61a0abe85609e34dc9d52bee7e2b03261e0a2be5b69efc2719674b238e1e868e57ffd9ba06d7face2e959d47c34d1212cd93095c0642de58259e848996f4647612074d1ca901dc208a1d1e6c91f5ebf07f17fc214658af976a80fc9cc5b6e923da32a07938be9c540f7507d26707440cbaf8963e179935db57c2f3f3654e015a4c88e45f0b6c91d18e93fbbff6523fe48ce7cb7e0d39040d062ec94531c9e80635d6673a1ba8021667b3f3a5065ec60b9f15edd4a5d254829cd39fbb7d4de9a650f6bfdbc1af1444a646a9e2f7e7a27860ce33ecabb47ae53332df3085bc80a9cb3b203e631c471a7c7c92377281061b50211b807c10513e4cb47427eedb6a6880d15c3934249a1e03ec882e19df1b1d07dcd07dc8ae0e63b3b9e5ea2fca4ebf24c652ee66f2ec302b3708801ec1c2c092f29ff3ee0c9b65c19fc12f4a2cd7192f7ae5300b3e0f85f54197f9dfb93259a2ad65abadddc6a448215f50049d42c99f34745d71634e8b457ee48984862adb75429defffac59fed1528a0da48cfe3efa5b0d335d87d87aca782b5b87e95483538fc73bca7b3fd287b5e620143c7c87f743806ccbcf201b2e172e15a0674b0d94c283057970780e6f1b688f73288f12b81b666c8107e7500d293469c48331da7f55e4888e19ed6b7d58b60f4c1b8003dafc9f489b41bd1970c5281a055586a459c4e4c79f579c73a6c92fb8578c975f4c53825cfe5f49ccdb186786b8d96813c1ec290ee53d0d4c0193fcfe2bd19f209654e050629843a5aa2e3d259ab25edd18a44aae8cf8949377de80e190b72a161d84daef29b80f473eb7b4bcf5cb4dbc8890f0d57b7e06781a7f465aeba74793f94d96bcb4912b907a730fdd7b08c361d4ca1a2bfc6e8b67f391a273a80a1481da4efda4c7f97a88946e9a4e5ab69fccd104b814763ce0fd194e02c24fec5f668aa1ab703ca79bc9f0a6217715ff2dfb9ff464c7c47b678b9b2ab3f3cb8a8a253f343cbcc416c5878377edcf96b734490a4f5a7e06b6e33f12011d99b7c5de7e6363b4eff41fea7bff7817ad628cff0deba67bad82a04fc347390b5ae3ed5cbb7ac0feff6fa16e03269a6e35161d9837743928282f53e2e6a07ad3e4"}) 15:29:43 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = inotify_init1(0x0) inotify_add_watch(r1, &(0x7f0000000080)='./file0\x00', 0x680) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) inotify_init1(0x0) (async) inotify_add_watch(r1, &(0x7f0000000080)='./file0\x00', 0x680) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) 15:29:43 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1000000, 0x1010, r0, 0x8000000) 15:29:43 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r1, &(0x7f0000000880)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x14, 0x0, 0x4}, 0x14}}, 0x0) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), 0xffffffffffffffff) (async, rerun: 64) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f00000002c0), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000000000)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_KEY(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)={0x24, r4, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_SEC_KEY={0x8, 0x25, 0x0, 0x1, [@NL802154_KEY_ATTR_ID={0x4}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}]}, 0x24}}, 0x0) sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x54, r2, 0x20, 0x70bd25, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_MAX_BE={0x5, 0x10, 0x80}, @NL802154_ATTR_MAX_BE={0x5}, @NL802154_ATTR_MIN_BE={0x5, 0x11, 0x80}, @NL802154_ATTR_MAX_BE={0x5}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_MIN_BE={0x5, 0x11, 0x2}, @NL802154_ATTR_MAX_BE={0x5, 0x10, 0x1}]}, 0x54}, 0x1, 0x0, 0x0, 0x10}, 0x0) 15:29:43 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) fcntl$getownex(r0, 0x10, &(0x7f0000000080)) 15:29:43 executing program 1: pselect6(0x40, &(0x7f0000000280)={0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, &(0x7f0000001100)={0x4}, &(0x7f0000000340)={0x0, 0x989680}, 0x0) (async) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x4, 0xa841) sendto$l2tp(r0, &(0x7f0000001100), 0x0, 0x20008004, &(0x7f0000001140)={0x2, 0x0, @local}, 0x10) (async, rerun: 32) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async, rerun: 32) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000010c0)={0x1c, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="05630fa9c94c000010400300"/26], 0x1000, 0x0, &(0x7f00000000c0)="90a6f0974dae1d19015b9a537bb5a9e0c2703dae7bb5dfead67b66e6e369172bb8a758649aa07879eb528a939c2b74658ea68dd2a0eaf399fe9da8a18a751f66331b8d1c728730778a26fdaaecab464bbb60f9601c3288985a99843c5daadcbe276df9bb2453757f74152c70eabfcd7c7721d548b69c14f59debdc9d1e9cbaf18888a90a6f554039df28606ff920365600c672d7029d9e13e1a551373c57b75608f149fe55c4f1ca0b8040d85c235e7674920dd8560ca0b8cfcc3eca809ab8fdc5d84aa64e56d142cce08641611536bb5ccac4b557155d99f4eb0489ff4c0dd5a8e6458696c008720cad3bcafe73c7390d9d2bf860646e02b9c6ac0257a6c9988d0d62b1f7404cb935963d0ffa1075f23ccb05321b00acaba5b26d96d93f36a4479a46107f4222922b557ddf570b4ec6bbc432e95ee80acef0a0327102401be395c62f77b2095c2f1a4c2f7cf520108bbead581330a15051ec4566d5a52711ca707df81596d471b9da0066651ddba6f652debbd4298f85fa18f04d16e74b6e32da0a4227a99982126e162897afbb9a27c09f7616a359af11c1f55d22c3189f5898e78da806de1239f97d1a094bf282985030d49d55e6abad8ae29904ac6a79578f5b1b559c14cc7f62f1ae18ec18d8ed857c7e6d8677f315dd61b7d632e980ebd6492fcff960d26f1a1bcfb97d3f71151c88a552f89b7b8868dd81be78e941fc0749111d45485e5877882b35ebc0397251d6b7aa9d82560b196157bceead4352985e6e4de1f5b0f80b8e3e2e4f7d52aa494288efd51347e7f24f0f0798cf00021844c06bf7ee25c0a2317f8ea6af6b6a7066c16dd96bf4a5fe9077a9a0211ba032ae44a5c24ebb51ad8699e18b4e08d43aad2c74ca76bf473441e649ce35075e9daa425575a209714da283ea415bb0fcd967dce2129c3280b017b8b30ccf21ce434dbce89dd4d03937be9f4acd0a645ab99147aadb8f776cd37dba77b428b0aa0549ebf9f0cb6520c2b75384c379e7f17965a4d2f2b109696a3f8ecdb4a70a60762f87edc3c6b0d33e3ed0b1f7693f80b14820326d9773b3146c530b10349679066687fa16ea668609a9b5dde1d660b58e15226829e5012e24b553acd0a3bdff4a9c7d06006fc522eca0a3b8d124699f1c5d14c6623e8fa4e30f173d7a5c53fa908ec81eb0de8554952e1a0d7b5f080da0443c21d065f1df874f33d7346f48f878d218b8ae25252a3c3b9f71b91614586c37e15fa56ef961031a1c7321c1f24f6e81bdabb6ec09ea9cb1213e551cfbc223d094a13e7f70f9117f14862b5d3f46c308de8fec6ecb4dcddf94aed31c5ae07b9b61ec8aed25bd7f9d944471dfd4d4d8b1a6de7f4c48526d3ae2d8535a1e0388c11d158876c67d1010cd3ad031acc1fbbb8d4d6b74c3778093d63d884fcfca00ec452a4772d871c89b6093ca97c1d7673ff0271180d16c312f769ffe93cde6aadb03dde1c297f069a2ad62485a2eef11aa6abf7cf564641fd2cd40c4a890437cc80a047df484a383a376d5a151103fe94c2c0d2634ada9c0b2c8957dec71708335e1c1ba2b66ee3116ec92f7bd5c1057b16182692fbe6867b3841f986ee299cf2f7cb63b04313f8c93f88e1efd68acb6db84c254556604ef42486bf1736b3b92f77192befed4fc3aacb9b90d551f1407e43c8b90633f132a910ebb3696c8afad8476b8fbe014cadd448935d0eebd8c8fbf40233a453ed243197f1f9279b30f82042571553e937c935383b10d5ab9bcaecb1792b791e7132094fa0f95802d8528d89d9fea9df5738f3946e30daa1d1218bcd5e3fe17ac0f3068e62e9d2ef27a68afe9ccb688eda5e9eba62ac7ae3dd32f95d4f4a846e259a7bc2770dc2f4ca754b57c5c71855fcfa3aea082e7ce09067303b6cdca2ec7c3e153556e3fe1d2c187097e9aa599e8c21513bed9ca146678d60b30f7ab20b26f97e7f4ce685773eb2579198b686b5de31ebb5f54c2556d2d364c367d2500271edf2f4ccab3889c8509caa1e600e3fa4a130780c3c8446efcca5b15217044526a2a54b935191663bf5844050df18143c6635e68432b7e8f4082c53d24dd200b50067db6434be44629c4701ee59234a742ed608ca0e085c921903fafdc5e5e292f2eb492d8ce081ddc8c436d5511288bf993341a256dd5c7f18e0768890db6ebc25323e71900678a98ae7aa95fd124d52cadc4ad580d7203ca2c0f8e6918ffdb5adfccc3fa84e6b1c6944dab5c6a6fc4f36975f7f7a188f04863e103e8d035fddf627aec28d1b79909f3b92dfd40a2a0905e42e71f0501b83a007830901a760519f18cb3bc6c97fa1053d9e812b942111b1244493c29964785958f399581cccf7db5ecfb23fd5399e9f54050b472aaa3abc15604ee1cc3c786d136d8c71bae8dbbfcdc9dfeb03ab5f232ab1cd04cd732838017e6b1f37626ba71bac66f3cb0eaaa7ae77e00b10d185e70fe7c78290f6097e4fe0cd540b490fd054832733bf938968436cc7d144cc15c1802d26dda335a64dce76ea02eee1d25c1c9cefeb9513cb68aa2f051bc3584747504bf636a2280c807dc58b708bdf41a58ee9de3a510f718452ce340d2c18185ce5280e3a8ab7c6eae637ed1553ea26092acdf62ee5282e48863848d78cf0e19210080ed86c6a98c18a85df9d3efc9b1c6c89c2c15edb2d0f94470844ef77b21eaea44e719081cef0597b67a6aaa6b2aa627cd90589c9bb9d83ab4256b753e9b3b12ebaa1be09c732b566ee2f1065a0cecac0e1be23a6d85ff16c444cfee854f8f50d17e610370a3cebbb5671216b28bfd63a3c7f0fe47c96b75e54f0867614b348a452eda99930866d93c40561e3a4faba67ca278512d3fc630c9bf5ddc399ac8a62f335736434c9e04fa94c283488cb72e2343b12d9d85b8951d88b692ad7569c7d6c07ffc189f14f3e51bcf4b75063ab2299d8476738646bd1fa49b4fe7b88a76d430184c52e479d1cdc4c59ce212c57e2edf42d1dbaa23403c4dda731b2fa30001f18b794b1619a389f1623fc09c20898a8ea37188fcaf00c25e615e87772b6f286d50ea195f95a69c7ef751c1a83178545de6f462fbbcc9923b611c71ff77518438001d8f052ecf3156ae5cbda17d3ffabcdf18c0ffed177e40998a104dc519a94ebe82caccc7e636ca45882986c8c0e0ebf4671d612f817722fe0c260565e5755c0a011a5a0eb5b10ee64fecf7da6e20c6fbaa1649f461fd3994f007308ffc5aee4d1cfcef96cb1fe58325630ad1a06e4ae1e4f140293b02aacf77757b37d3ff6f1ae4b11e9c9f4610ffdc4c1f2f2f36127169a7928793f49629e8aae605b62b52ace40d578552925f582c4cec01bcea102950e3d71a454fe21087f8fb1497ec09129c35b79292e06a3bf798dcf872febb42c72fd6b80af44527e7b336a0dfedf5b024398fd908b7ca1b5578df66c952cd7d47035f8c78e66e3f79d790fab25cfc086263115e3b9ae779047d04ab56b4738b83021869b35ca925bc75dea2fe2c808288a4d9a84b10522f633cd6166246bf3c7053c311386b84c1c1aa13700da7f9f4115622f9e5fce2cd6937cc2d3376cef9a6baf294c3da1d8425eb2809c6183ba7971d429f6244ee40eefdf4dc9e173d28baa1fb065a0feed40975f25aa21ecf4e5188c0fbdfa215c0810272deda9bf06e62ae1c9382ef4f77602881aa755e11ac04710d6bc3d44bb56337558c8258a4a3da23d4884e12f03c91c7149330ef41466c9d82dc15da11655913af2a38db9e36af21ee4db01b97fde96c02a3ce337db75a6744c99d25c3909ceeede8c97c716b23ab7f4df8ac5219030e02563bf96a1ad02c7d30593dac0a228c9d0e29919ecde30d87529b88745a94332004ad473fecd6991cbbf2a5bfe9e65895682d8cd0f10b8554d96aa971b0b7db68453ecf96aa55d0e86aaeb662d68369db8bc46a8eee570c13eb8b215dff3f69ae1eb26c76eb89abe9c2c619897942c669670383f85468970b591ea3de79503cc20e86edd6bff38769e23c255576fd8f3eb33b8e13366bb3b7427302a122e78768575337a6f289bcbcd14491d69f645703efca3c59bbc34d666e68fd683bbd94c751e770a5c0a0cab99fa73495159f9b98b5017bd12638acc7bedfbfa988dad44b8329a8f682e7cdbe8e94c01a7449089c32dae0a4e75feceed7bd344eab3a83f3a4141c2955797b30d2df57047f65f00fbf414c22bbfda747c2803c4d33031ea035fb32a33a039ba01a3305c36bf3702c9202698a071cac5226af37cca69c1cf97555223df42b9b5e5d9134c5c728974231980c4ddeaeb45c61501cf6dbae14648de7c173f151686b4f85739a617c431505d225f7f9eda1149d1f6f3e45ee21696794840681f8423f576a70d241b62652255446294713b798a14dc1e6162010004b5b3582258d8dac9d3e55cf0b59b3b59bce21304cac7b517fac6115fb8a8c61ca0806e4f1d805edc8b2573d5738b1706569249960629cd114af96089e8a92f63ad4d0c923aff8a8a661f4802b8b4db3261f191658300361417ee3387b9ccbb21190eb8da8596c58b1ab09e9b2e2900f76fcb8c004794d047fe4d09496467a8340af82938f597f845c9d91a1a747b349d9109969535cf1e85036ca02acd8f514fac58020e46e6176ef4b72c869948a05c2f1c78e61a0abe85609e34dc9d52bee7e2b03261e0a2be5b69efc2719674b238e1e868e57ffd9ba06d7face2e959d47c34d1212cd93095c0642de58259e848996f4647612074d1ca901dc208a1d1e6c91f5ebf07f17fc214658af976a80fc9cc5b6e923da32a07938be9c540f7507d26707440cbaf8963e179935db57c2f3f3654e015a4c88e45f0b6c91d18e93fbbff6523fe48ce7cb7e0d39040d062ec94531c9e80635d6673a1ba8021667b3f3a5065ec60b9f15edd4a5d254829cd39fbb7d4de9a650f6bfdbc1af1444a646a9e2f7e7a27860ce33ecabb47ae53332df3085bc80a9cb3b203e631c471a7c7c92377281061b50211b807c10513e4cb47427eedb6a6880d15c3934249a1e03ec882e19df1b1d07dcd07dc8ae0e63b3b9e5ea2fca4ebf24c652ee66f2ec302b3708801ec1c2c092f29ff3ee0c9b65c19fc12f4a2cd7192f7ae5300b3e0f85f54197f9dfb93259a2ad65abadddc6a448215f50049d42c99f34745d71634e8b457ee48984862adb75429defffac59fed1528a0da48cfe3efa5b0d335d87d87aca782b5b87e95483538fc73bca7b3fd287b5e620143c7c87f743806ccbcf201b2e172e15a0674b0d94c283057970780e6f1b688f73288f12b81b666c8107e7500d293469c48331da7f55e4888e19ed6b7d58b60f4c1b8003dafc9f489b41bd1970c5281a055586a459c4e4c79f579c73a6c92fb8578c975f4c53825cfe5f49ccdb186786b8d96813c1ec290ee53d0d4c0193fcfe2bd19f209654e050629843a5aa2e3d259ab25edd18a44aae8cf8949377de80e190b72a161d84daef29b80f473eb7b4bcf5cb4dbc8890f0d57b7e06781a7f465aeba74793f94d96bcb4912b907a730fdd7b08c361d4ca1a2bfc6e8b67f391a273a80a1481da4efda4c7f97a88946e9a4e5ab69fccd104b814763ce0fd194e02c24fec5f668aa1ab703ca79bc9f0a6217715ff2dfb9ff464c7c47b678b9b2ab3f3cb8a8a253f343cbcc416c5878377edcf96b734490a4f5a7e06b6e33f12011d99b7c5de7e6363b4eff41fea7bff7817ad628cff0deba67bad82a04fc347390b5ae3ed5cbb7ac0feff6fa16e03269a6e35161d9837743928282f53e2e6a07ad3e4"}) 15:29:43 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x58, 0x0, &(0x7f0000000200)=[@increfs_done={0x40106308, 0x2}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x50, 0x18, &(0x7f0000001340)=ANY=[@ANYBLOB="8561646600000000080000000000000002000000000000004000100000000000852a64660000000067220faebfeed7d4d0ea8287cf10bf97034f8b32da8d2a5d75937c13d550faf91dbb3239a7692dd0a5b283cdc63702f633079e7d061e038872c78406e947e8274cf2993794b7a6aec301fb7d0dc11ce7402b52f8341b697132f06ac7b6c4f1573a3398ebe82353fcdcb0f41d49fc790d9940588d5a43ed18cf7a2e3585954798ad772288d8fa1ee12d68dd2c9e3919b6d9cf68aa61b5", @ANYRES32=r0, @ANYBLOB="000000000000000000000000852a646600000000", @ANYRES32=r0, @ANYBLOB='\x00'/12], &(0x7f0000000000)={0x0, 0x20, 0x38}}}], 0x1000, 0x0, &(0x7f0000000340)="7a79815fc6870a2be480b91d55fc0d88663fd059158a83f04bd93dbbe4198e8d3846947dc90c050cd030a43c3872b8fbb4e60481caa0cd33722f7612ad2963b7a156bb561cce8c6c708574ae53c5cbaed9fea776b375dd057ebd0271420be66eb406c84c4bf1f0deeee2553a0de77a89b96fa5094b6fcfd414f85d15ffd8d66c7cbd1fe07478fb7823960d77918ec583fbe68242c61612b6f61865cd3c3a7fb3345536274fcd58d2046b4571fd49a92c9fde590a5e9affd3a9308ceca399c366bc2546d7bf279c957448160af48e428bfd9aa1f3b8cccfb68f5e5b774fa994d10936e6d4c05975c2b6a8769a9150b370743b284b8b07413f7571ba2db821d197254dcd27ec1b27dc07186cc9c2b32507c62bb13e722b2d9fd7d656129de66c8275c837af00dfc48c3bfd14add0fc8b15c4431dd0a7242cc9c90a50c67c80370eb7e85a886f0c812dbbf3767470bc4284bf11be8d93a33b01db58cd4048a0dbf1b83f128aeba09392fbe241971bfadbccdbc0425d6bcb4c5779da2cc3eb19906e73b3311afde69f883002e48a0b6ade48b8115ba3854f5fc7869836183dba0505954634cda8b7518a3c2a249f383b0c22330c827c641b2bd052720d60b74db5f4a623788faa30e0ad722bf82c876a3756dca774ee73f1f3b18dada4987e87105869028ccc8f6c1e8749ed0825745d8247cffdd770c2ccd72a8ea0fda0767595f9e5aee1daae42383fe5a0d102cbe0771227bba8605c4d155819718a20feeb5744d7f4dd47e53be8d4c856d9ebd235976d917f559afaf65c91155e6dedd8da632b534e937eafb81f339118defc5f724afe24b5107fc285d6f0c1ed2a174c5ee2bdfd417085159ece20819475233c55294231899828156e90df6c389e26b1aa871413703d0c6a71d81c881e176435a41444547735fbbaca1912b7a61591b36e217f9e7468787212bbcf4cfa4789de0869df033cbce84385bdcf483f9c67aa1faac128fc58cd6e55f91ab3a7ad1b4832d76f634c2cc4ff7a05f5a6d040f7045dd7b414fb88e8676e6917479a243527440b0b3eeb4552e3a12314a0aeba445ff311b69d0525273e1b9edc95d312faea20a135d83fb94075ad16e170718c749c8e4734386d926788f9e38aa1307b7faf417755df78e79514b5f2783224ce29956706a1a3785416f370b812398bf8ff3e8b4bd7677b991f85f1f895a44b46971e3009704bf2dcfc9aea61de092db7eccb7266a9e9af7fe2b0423ea6f6d8a61209a9d89f0b69389907d9faccdd81e66f223cbf4c583040e530963aa127d9e593e46db2cc2daf00a5083cf8d4052d1b854ef6f3e1905d01fc1bad1397281a3b8f2abafa221f16c7a788d718b8b28ad6b86186ec86816b59c499baac73f5df6a9934d8a04a2295672aaa9e0235f88a5a4b61e3a590c5709e0d38c635efaf7db361f02c49a05173b9ed0a342c603fc54ef3806b1544c31f828a426aecf04fa334ca48a014485851ce6470565b890c689e14dfd4e523dbac5c05587bab713745c8fa06bf9ae0576b447702333d3c653b49428717aed59f7be817e2cb9a46b2362c6e74d385308649554761bd30dd35764d11789643302bf353394ab0427b4f934eb6d823b73d9ec6f6651e981607fcd0c47948a117691f6104338f636b102a4b6ebe4a8668129aecaeef9d50cacbba06d545062f6bd7823d2ec22adf2dbac2304568e430b3f02200e2169be9ce952c9d3d78e454fd2babb73edc1519b784f151b08862e99afff6bf77c43571d735920c439f3d491df4c2589122f4c3b0badb0d1c0dba836243042ee81020f49682eaf6079269590c4cdd0d5bfd72c704759fdc2cf8122a2d3e401bedf0df3c84a097fdbe7cfc200f78958515cdde754b01594d60a371b788f91f6395c373c292f20c5c7aef3e12cbd9cc9cbe28192548ddea1f80a83698cd4cdbc5a2263381a7301ac531178e16095e703f89cbf5789fa04ec2eae9a0bfca7b9ebe5bdb322d3be4abca12fdf7507896b5865c0b1b1111492bcbf959e04e42bbe17377f7a34775a59b224aac4a955ecf8e330b34e195e56f17019ef475109fb7ca5e3ac9ad8cbd36e8791d10da4bda9ca0a2e39259d990c56dd3b04621bcf40895e35045b610e59505d7c1d3c42235f32f36a4a85b6f12ff0e78a0280df0164aa4c2fd9a5eed97b5e7f7936a03ad64f3a0062a03be348bbe9c2686324c637c2c62a4b5e3d58b80b7ff76948e7ffeb1aeaa9adf87ab8cb0797f0297f3549d6b320efcb0bf6be1ab448cb398c28616474e69be71cd8aa9b24170c0be6b1c87b31c4c8689c85c468688a3381301144cdd906b5d4fe5901f71f7d34e8f7ab7a35e62af3ea3fa215002ac09ecd6cabd86e3a628fac3b456dd9f732973c519bd9231d001fafd5f3f584d7685740d81708e24e136c98b5ac23e8e28dbc891be80d0c6e419e47a6df211731be66412168ab941cbab1d98847af0070cc9362ff533918878639607012b70e08d95324cf9e7392613699916e0a922200fe074960b592c35cfdfde2641f8263bcd05e3bda75779c89888d28528798ca75ae52d5f789bb79e86f4821dc5ed8dc9b85cd99e6a87498f27e3a181cafc8d107209affef67719fda76d225f15f882c14286c3a2d43c71922d8aa01ea5831c9b8751a9c15345e85a4c7c51cf92c1212c9d38785227c529d4902aa784fc9061bb2564cf31252c418b1eac594e2e2115bf09f492ca8b9ac61cf3e8c50c82706c525bf9698f47814680030abdbe3777e9d0abcfa463032c886bfe6cc023178587363896061d441a3edb00a7d8f0bedb6a6ea8ed0ddf20d4892e3624a2af6fe591b2c1ddd04eb3d65534df8907f9cbb2b5d4b2d7dc342746ac283efec0a222123cb90b588f8b2c472af40787e191ba271fc7bc312a20e0a0b7fcc402ea1208d7de9652cea3d733b7f73192f7c29c32b437c28fd4023e3ac375543f28d715769e7d52378b0d20c0277b52250b34e738dbe122164aca82c219ac0d2dde11caba840b81cfbb27ecafc553bc36f0883a7d921bd1837ee414c501aadcfa52a6558ec64de0c9c3beab9f8b41553735df8b59881119ba9cf85eb024ddef35b88ce0f9bad18e3f0b8c851f2906f82af0988478631bb0df0f912c155ec894eac17c8b49e1292a416b8d0f7f8bdfa5b884f689805d0b0fd971a9073190f7cf475df6bd81de4c6242f67d8897c333ebde74c79dd0c0e73dbbaeb39b0c3abafb5dda4dbb4fa95128fd269cf6f1b9787c2939fc20e17b60b23f806610fbbb6c0b2ad1123b54f8b648a385c3e9a0b1669b15a87d5704194bf97cb7e1ba62ecf8c2dcb090461622bb448cc504f871cc4cedb8d530d840e67f0ae769d70607fa4e8fbbbf2214905afcf1028ae0d5dcef4f7bec0b0553c3e1c0d887b378ce43288eec440975b0b4093975b7b0de5daf7ca031d07d706c421b8f053ca2622933e81b6939d9b7aa87e79883226a9aefd5ca21845d5717a1d97c7b141502ad61c290bb3383ca0e3d0794fea20288d1e471feb815113c910e4d6a0dc763babdb5d5a86070cf5f09f319e1193174a9a2ce34731c157ba0ac24df969d5657d4c009235de027d3a381490d3d124336253dfb1c53babe061b988432387afcf8a1899f22792576e8ea5c13a568b19848459daa2a3a966cb203c2d116be675e36b064e3be2adf9cbfb857ec3d96cc0cd64d069491b721d84be3a95bf8ccf66e1b68fa2b3f1ef48aec787853eb7ca08a6276f4044e31ee55169c50dc3cb021b9232daac17693ec137ed71e0d2ba17713a62b8aac853a5920e406a5a764ebcbc949baee192025d0df5aa792e60ac06dc7914ac22351ae3b40746dc0f0866909aeceeded5d0882d84e626f22d226e4fe4acf3cee5d26154df1230c058bd022668221e79c96e61cdbb368b8911fd59b4bd68b22665c4117fe98a6afea637b2bfad4cd6c0753f2116251ce0881a5dfb125dd62e35ae03229560a176b28f9ad29eef153c851535ae5e7a48083a6e2665c63bc6785b1092b011eddfbdf73dc71b0788b09f14dce3b2109ddcaa9c143af6321aa55b338fba7f215be11875528ad25d387ba8ae812ce4cb37eb2989ff90449f5f394b75eebe5b79a1ec4e89859ce4b2edf0bc887f0bfbb3d182729d7a4d4f3f8c53ee6174b72dd2e01bbfb2f2326769af3ca87e6ed997efc36d1744dbcc9202f578f4eb260e56c1388b58a80d2cd89ca54306851ca1d9f3df7ff9682514a825a0c39aec3c94c57fdc45a67c2e5b3e6bc85fd480a3286b40291fa99bdb99509981d3200444c13864eab31d824d43a65a18879ed4c99455c8037715d59724a14ae1d3e675cdc1e1496c0a9e5aa5b215ac53adf10441c71ed5cd9d526a9308daccbf07a24adc35213faf9e01191f44d7423c776253b86b28b72ee3d04d38cbe8ae2ec34acc081425737847e76cda0d94db9787e16bc5b598719e96192d16365c0690aadf8850465890ab9994b1dd2317e46ed941e5780650b2d830820fb3ec280e37725a873b12a5627f01ce9faee633c512e75a3c9d675527aeeba12e86db9f2837040d01c77a4ba56481a7acf4589c08e4bc0897af27edaf7ff012ddd6c4f6d142dcb256c9ffc0cf554934f73bf016c3b7d3ae470395c386a7b9c7975ee862afa62b088f5906de0d5e698a04021a561d3e2d721196471e465a853c4bf2e94a72c32d23c119d48819cf5a5314ee0dc54c37c0a2cc4645ef663f82fcbb8d03f20a59576ce6d6b32bede80e6dab27953f32eedd817ba93e02dc662b17130678f984baeeadd827c9db023189d28674eb7b95eb0593bffb392a4a9058d001bad51ff2a1b5bd9f6ee85b09130548a8c7e8c54b2bcd3fe4cdfea4d2d8a3c402d832e953aae734527838283e829627bfd6cee3b0bed697277aed33333f299dd2ca95184e6a6e2ae9f70c88b108c760f3b95928d7a3efb28e3eac3573908e0b974d48f7eb323031f745fa919f8bbe79a86acb77d4d20f652152c5b39251c7d6bf447b2fa317a63522fe2178b3a2676cb9c9b64211dc4ea96758e0e6a16a65ae55c0a42d5b962308a82ffd1846d1a33d3978cb85efc5d9a23072f3d86789c8b288398623660fc2bcdf511bc5cbbbe60f2b16cb7fca5a2de8101f31f3450d819a3934783eb1161ed1c63ce192ed9f83bd5466bcc3120c49c3676c8d81ee89576f79ab26366d69d17b5181ec8286552eb375b3d0717390a2b9ff567dbe18a6656feba192b58452ce080c19ff2e4460e9bce357bf7525db1d3aeccd90ff571262d3608bcf7d1283f992af3b9060ab8b268677e06f70bfc65bd9e0af8f7e274721f4772a155fb982737812d4874ce11d354fe8ca653d66b48415aa0d96bd79c00dce3d8492c9bf572c869034082822a4105785a58840429a71d2d28a535917af4395e38568ee8925d95060e1a4864b231212a2be5cad12079ebaa7d00d9c8836e47113fe6f9cd8cc88207c3033b32da0becfee784059eb49be09b07524a27d85737d5e03896b15e562bd3116ed4f51be8795ac539a856cee9820680d5b27fd62cbcfa04da13f863f301aed4bf4975138dc6c4d7760626e3e1c9dc1a77152c21941ea3079b5dacacb0d9990a2825ba62704108770d0c59451d439b14a1ccb947f780cc35c5134301478f562a6a8a320d0f4e9585c0755581817b99dd865eaf1046b28414d0062126583eb38d8fa88913c9fcabc6fff507b76b2683601796a1594e138181ba3b8e84de8e69de235d5400ff7cd950c78437885ee44018d774b674c41f3222abdc6aab0b56bc9df131451df004"}) (async) pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(r1, 0x40046210, &(0x7f0000000140)=0x1) (async) socket$l2tp(0x2, 0x2, 0x73) r2 = syz_open_dev$vcsa(&(0x7f00000001c0), 0x84e, 0x200000) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r0) 15:29:43 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xd380ff, 0x1aa41) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:43 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async, rerun: 64) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async, rerun: 64) fcntl$getownex(r0, 0x10, &(0x7f0000000080)) 15:29:43 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:43 executing program 1: pselect6(0x40, &(0x7f0000000280)={0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, &(0x7f0000001100)={0x4}, &(0x7f0000000340)={0x0, 0x989680}, 0x0) (async) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x4, 0xa841) sendto$l2tp(r0, &(0x7f0000001100), 0x0, 0x20008004, &(0x7f0000001140)={0x2, 0x0, @local}, 0x10) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000010c0)={0x1c, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="05630fa9c94c000010400300"/26], 0x1000, 0x0, &(0x7f00000000c0)="90a6f0974dae1d19015b9a537bb5a9e0c2703dae7bb5dfead67b66e6e369172bb8a758649aa07879eb528a939c2b74658ea68dd2a0eaf399fe9da8a18a751f66331b8d1c728730778a26fdaaecab464bbb60f9601c3288985a99843c5daadcbe276df9bb2453757f74152c70eabfcd7c7721d548b69c14f59debdc9d1e9cbaf18888a90a6f554039df28606ff920365600c672d7029d9e13e1a551373c57b75608f149fe55c4f1ca0b8040d85c235e7674920dd8560ca0b8cfcc3eca809ab8fdc5d84aa64e56d142cce08641611536bb5ccac4b557155d99f4eb0489ff4c0dd5a8e6458696c008720cad3bcafe73c7390d9d2bf860646e02b9c6ac0257a6c9988d0d62b1f7404cb935963d0ffa1075f23ccb05321b00acaba5b26d96d93f36a4479a46107f4222922b557ddf570b4ec6bbc432e95ee80acef0a0327102401be395c62f77b2095c2f1a4c2f7cf520108bbead581330a15051ec4566d5a52711ca707df81596d471b9da0066651ddba6f652debbd4298f85fa18f04d16e74b6e32da0a4227a99982126e162897afbb9a27c09f7616a359af11c1f55d22c3189f5898e78da806de1239f97d1a094bf282985030d49d55e6abad8ae29904ac6a79578f5b1b559c14cc7f62f1ae18ec18d8ed857c7e6d8677f315dd61b7d632e980ebd6492fcff960d26f1a1bcfb97d3f71151c88a552f89b7b8868dd81be78e941fc0749111d45485e5877882b35ebc0397251d6b7aa9d82560b196157bceead4352985e6e4de1f5b0f80b8e3e2e4f7d52aa494288efd51347e7f24f0f0798cf00021844c06bf7ee25c0a2317f8ea6af6b6a7066c16dd96bf4a5fe9077a9a0211ba032ae44a5c24ebb51ad8699e18b4e08d43aad2c74ca76bf473441e649ce35075e9daa425575a209714da283ea415bb0fcd967dce2129c3280b017b8b30ccf21ce434dbce89dd4d03937be9f4acd0a645ab99147aadb8f776cd37dba77b428b0aa0549ebf9f0cb6520c2b75384c379e7f17965a4d2f2b109696a3f8ecdb4a70a60762f87edc3c6b0d33e3ed0b1f7693f80b14820326d9773b3146c530b10349679066687fa16ea668609a9b5dde1d660b58e15226829e5012e24b553acd0a3bdff4a9c7d06006fc522eca0a3b8d124699f1c5d14c6623e8fa4e30f173d7a5c53fa908ec81eb0de8554952e1a0d7b5f080da0443c21d065f1df874f33d7346f48f878d218b8ae25252a3c3b9f71b91614586c37e15fa56ef961031a1c7321c1f24f6e81bdabb6ec09ea9cb1213e551cfbc223d094a13e7f70f9117f14862b5d3f46c308de8fec6ecb4dcddf94aed31c5ae07b9b61ec8aed25bd7f9d944471dfd4d4d8b1a6de7f4c48526d3ae2d8535a1e0388c11d158876c67d1010cd3ad031acc1fbbb8d4d6b74c3778093d63d884fcfca00ec452a4772d871c89b6093ca97c1d7673ff0271180d16c312f769ffe93cde6aadb03dde1c297f069a2ad62485a2eef11aa6abf7cf564641fd2cd40c4a890437cc80a047df484a383a376d5a151103fe94c2c0d2634ada9c0b2c8957dec71708335e1c1ba2b66ee3116ec92f7bd5c1057b16182692fbe6867b3841f986ee299cf2f7cb63b04313f8c93f88e1efd68acb6db84c254556604ef42486bf1736b3b92f77192befed4fc3aacb9b90d551f1407e43c8b90633f132a910ebb3696c8afad8476b8fbe014cadd448935d0eebd8c8fbf40233a453ed243197f1f9279b30f82042571553e937c935383b10d5ab9bcaecb1792b791e7132094fa0f95802d8528d89d9fea9df5738f3946e30daa1d1218bcd5e3fe17ac0f3068e62e9d2ef27a68afe9ccb688eda5e9eba62ac7ae3dd32f95d4f4a846e259a7bc2770dc2f4ca754b57c5c71855fcfa3aea082e7ce09067303b6cdca2ec7c3e153556e3fe1d2c187097e9aa599e8c21513bed9ca146678d60b30f7ab20b26f97e7f4ce685773eb2579198b686b5de31ebb5f54c2556d2d364c367d2500271edf2f4ccab3889c8509caa1e600e3fa4a130780c3c8446efcca5b15217044526a2a54b935191663bf5844050df18143c6635e68432b7e8f4082c53d24dd200b50067db6434be44629c4701ee59234a742ed608ca0e085c921903fafdc5e5e292f2eb492d8ce081ddc8c436d5511288bf993341a256dd5c7f18e0768890db6ebc25323e71900678a98ae7aa95fd124d52cadc4ad580d7203ca2c0f8e6918ffdb5adfccc3fa84e6b1c6944dab5c6a6fc4f36975f7f7a188f04863e103e8d035fddf627aec28d1b79909f3b92dfd40a2a0905e42e71f0501b83a007830901a760519f18cb3bc6c97fa1053d9e812b942111b1244493c29964785958f399581cccf7db5ecfb23fd5399e9f54050b472aaa3abc15604ee1cc3c786d136d8c71bae8dbbfcdc9dfeb03ab5f232ab1cd04cd732838017e6b1f37626ba71bac66f3cb0eaaa7ae77e00b10d185e70fe7c78290f6097e4fe0cd540b490fd054832733bf938968436cc7d144cc15c1802d26dda335a64dce76ea02eee1d25c1c9cefeb9513cb68aa2f051bc3584747504bf636a2280c807dc58b708bdf41a58ee9de3a510f718452ce340d2c18185ce5280e3a8ab7c6eae637ed1553ea26092acdf62ee5282e48863848d78cf0e19210080ed86c6a98c18a85df9d3efc9b1c6c89c2c15edb2d0f94470844ef77b21eaea44e719081cef0597b67a6aaa6b2aa627cd90589c9bb9d83ab4256b753e9b3b12ebaa1be09c732b566ee2f1065a0cecac0e1be23a6d85ff16c444cfee854f8f50d17e610370a3cebbb5671216b28bfd63a3c7f0fe47c96b75e54f0867614b348a452eda99930866d93c40561e3a4faba67ca278512d3fc630c9bf5ddc399ac8a62f335736434c9e04fa94c283488cb72e2343b12d9d85b8951d88b692ad7569c7d6c07ffc189f14f3e51bcf4b75063ab2299d8476738646bd1fa49b4fe7b88a76d430184c52e479d1cdc4c59ce212c57e2edf42d1dbaa23403c4dda731b2fa30001f18b794b1619a389f1623fc09c20898a8ea37188fcaf00c25e615e87772b6f286d50ea195f95a69c7ef751c1a83178545de6f462fbbcc9923b611c71ff77518438001d8f052ecf3156ae5cbda17d3ffabcdf18c0ffed177e40998a104dc519a94ebe82caccc7e636ca45882986c8c0e0ebf4671d612f817722fe0c260565e5755c0a011a5a0eb5b10ee64fecf7da6e20c6fbaa1649f461fd3994f007308ffc5aee4d1cfcef96cb1fe58325630ad1a06e4ae1e4f140293b02aacf77757b37d3ff6f1ae4b11e9c9f4610ffdc4c1f2f2f36127169a7928793f49629e8aae605b62b52ace40d578552925f582c4cec01bcea102950e3d71a454fe21087f8fb1497ec09129c35b79292e06a3bf798dcf872febb42c72fd6b80af44527e7b336a0dfedf5b024398fd908b7ca1b5578df66c952cd7d47035f8c78e66e3f79d790fab25cfc086263115e3b9ae779047d04ab56b4738b83021869b35ca925bc75dea2fe2c808288a4d9a84b10522f633cd6166246bf3c7053c311386b84c1c1aa13700da7f9f4115622f9e5fce2cd6937cc2d3376cef9a6baf294c3da1d8425eb2809c6183ba7971d429f6244ee40eefdf4dc9e173d28baa1fb065a0feed40975f25aa21ecf4e5188c0fbdfa215c0810272deda9bf06e62ae1c9382ef4f77602881aa755e11ac04710d6bc3d44bb56337558c8258a4a3da23d4884e12f03c91c7149330ef41466c9d82dc15da11655913af2a38db9e36af21ee4db01b97fde96c02a3ce337db75a6744c99d25c3909ceeede8c97c716b23ab7f4df8ac5219030e02563bf96a1ad02c7d30593dac0a228c9d0e29919ecde30d87529b88745a94332004ad473fecd6991cbbf2a5bfe9e65895682d8cd0f10b8554d96aa971b0b7db68453ecf96aa55d0e86aaeb662d68369db8bc46a8eee570c13eb8b215dff3f69ae1eb26c76eb89abe9c2c619897942c669670383f85468970b591ea3de79503cc20e86edd6bff38769e23c255576fd8f3eb33b8e13366bb3b7427302a122e78768575337a6f289bcbcd14491d69f645703efca3c59bbc34d666e68fd683bbd94c751e770a5c0a0cab99fa73495159f9b98b5017bd12638acc7bedfbfa988dad44b8329a8f682e7cdbe8e94c01a7449089c32dae0a4e75feceed7bd344eab3a83f3a4141c2955797b30d2df57047f65f00fbf414c22bbfda747c2803c4d33031ea035fb32a33a039ba01a3305c36bf3702c9202698a071cac5226af37cca69c1cf97555223df42b9b5e5d9134c5c728974231980c4ddeaeb45c61501cf6dbae14648de7c173f151686b4f85739a617c431505d225f7f9eda1149d1f6f3e45ee21696794840681f8423f576a70d241b62652255446294713b798a14dc1e6162010004b5b3582258d8dac9d3e55cf0b59b3b59bce21304cac7b517fac6115fb8a8c61ca0806e4f1d805edc8b2573d5738b1706569249960629cd114af96089e8a92f63ad4d0c923aff8a8a661f4802b8b4db3261f191658300361417ee3387b9ccbb21190eb8da8596c58b1ab09e9b2e2900f76fcb8c004794d047fe4d09496467a8340af82938f597f845c9d91a1a747b349d9109969535cf1e85036ca02acd8f514fac58020e46e6176ef4b72c869948a05c2f1c78e61a0abe85609e34dc9d52bee7e2b03261e0a2be5b69efc2719674b238e1e868e57ffd9ba06d7face2e959d47c34d1212cd93095c0642de58259e848996f4647612074d1ca901dc208a1d1e6c91f5ebf07f17fc214658af976a80fc9cc5b6e923da32a07938be9c540f7507d26707440cbaf8963e179935db57c2f3f3654e015a4c88e45f0b6c91d18e93fbbff6523fe48ce7cb7e0d39040d062ec94531c9e80635d6673a1ba8021667b3f3a5065ec60b9f15edd4a5d254829cd39fbb7d4de9a650f6bfdbc1af1444a646a9e2f7e7a27860ce33ecabb47ae53332df3085bc80a9cb3b203e631c471a7c7c92377281061b50211b807c10513e4cb47427eedb6a6880d15c3934249a1e03ec882e19df1b1d07dcd07dc8ae0e63b3b9e5ea2fca4ebf24c652ee66f2ec302b3708801ec1c2c092f29ff3ee0c9b65c19fc12f4a2cd7192f7ae5300b3e0f85f54197f9dfb93259a2ad65abadddc6a448215f50049d42c99f34745d71634e8b457ee48984862adb75429defffac59fed1528a0da48cfe3efa5b0d335d87d87aca782b5b87e95483538fc73bca7b3fd287b5e620143c7c87f743806ccbcf201b2e172e15a0674b0d94c283057970780e6f1b688f73288f12b81b666c8107e7500d293469c48331da7f55e4888e19ed6b7d58b60f4c1b8003dafc9f489b41bd1970c5281a055586a459c4e4c79f579c73a6c92fb8578c975f4c53825cfe5f49ccdb186786b8d96813c1ec290ee53d0d4c0193fcfe2bd19f209654e050629843a5aa2e3d259ab25edd18a44aae8cf8949377de80e190b72a161d84daef29b80f473eb7b4bcf5cb4dbc8890f0d57b7e06781a7f465aeba74793f94d96bcb4912b907a730fdd7b08c361d4ca1a2bfc6e8b67f391a273a80a1481da4efda4c7f97a88946e9a4e5ab69fccd104b814763ce0fd194e02c24fec5f668aa1ab703ca79bc9f0a6217715ff2dfb9ff464c7c47b678b9b2ab3f3cb8a8a253f343cbcc416c5878377edcf96b734490a4f5a7e06b6e33f12011d99b7c5de7e6363b4eff41fea7bff7817ad628cff0deba67bad82a04fc347390b5ae3ed5cbb7ac0feff6fa16e03269a6e35161d9837743928282f53e2e6a07ad3e4"}) 15:29:43 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xd380ff, 0x1aa41) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:43 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x58, 0x0, &(0x7f0000000200)=[@increfs_done={0x40106308, 0x2}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x50, 0x18, &(0x7f0000001340)=ANY=[@ANYBLOB="8561646600000000080000000000000002000000000000004000100000000000852a64660000000067220faebfeed7d4d0ea8287cf10bf97034f8b32da8d2a5d75937c13d550faf91dbb3239a7692dd0a5b283cdc63702f633079e7d061e038872c78406e947e8274cf2993794b7a6aec301fb7d0dc11ce7402b52f8341b697132f06ac7b6c4f1573a3398ebe82353fcdcb0f41d49fc790d9940588d5a43ed18cf7a2e3585954798ad772288d8fa1ee12d68dd2c9e3919b6d9cf68aa61b5", @ANYRES32=r0, @ANYBLOB="000000000000000000000000852a646600000000", @ANYRES32=r0, @ANYBLOB='\x00'/12], &(0x7f0000000000)={0x0, 0x20, 0x38}}}], 0x1000, 0x0, &(0x7f0000000340)="7a79815fc6870a2be480b91d55fc0d88663fd059158a83f04bd93dbbe4198e8d3846947dc90c050cd030a43c3872b8fbb4e60481caa0cd33722f7612ad2963b7a156bb561cce8c6c708574ae53c5cbaed9fea776b375dd057ebd0271420be66eb406c84c4bf1f0deeee2553a0de77a89b96fa5094b6fcfd414f85d15ffd8d66c7cbd1fe07478fb7823960d77918ec583fbe68242c61612b6f61865cd3c3a7fb3345536274fcd58d2046b4571fd49a92c9fde590a5e9affd3a9308ceca399c366bc2546d7bf279c957448160af48e428bfd9aa1f3b8cccfb68f5e5b774fa994d10936e6d4c05975c2b6a8769a9150b370743b284b8b07413f7571ba2db821d197254dcd27ec1b27dc07186cc9c2b32507c62bb13e722b2d9fd7d656129de66c8275c837af00dfc48c3bfd14add0fc8b15c4431dd0a7242cc9c90a50c67c80370eb7e85a886f0c812dbbf3767470bc4284bf11be8d93a33b01db58cd4048a0dbf1b83f128aeba09392fbe241971bfadbccdbc0425d6bcb4c5779da2cc3eb19906e73b3311afde69f883002e48a0b6ade48b8115ba3854f5fc7869836183dba0505954634cda8b7518a3c2a249f383b0c22330c827c641b2bd052720d60b74db5f4a623788faa30e0ad722bf82c876a3756dca774ee73f1f3b18dada4987e87105869028ccc8f6c1e8749ed0825745d8247cffdd770c2ccd72a8ea0fda0767595f9e5aee1daae42383fe5a0d102cbe0771227bba8605c4d155819718a20feeb5744d7f4dd47e53be8d4c856d9ebd235976d917f559afaf65c91155e6dedd8da632b534e937eafb81f339118defc5f724afe24b5107fc285d6f0c1ed2a174c5ee2bdfd417085159ece20819475233c55294231899828156e90df6c389e26b1aa871413703d0c6a71d81c881e176435a41444547735fbbaca1912b7a61591b36e217f9e7468787212bbcf4cfa4789de0869df033cbce84385bdcf483f9c67aa1faac128fc58cd6e55f91ab3a7ad1b4832d76f634c2cc4ff7a05f5a6d040f7045dd7b414fb88e8676e6917479a243527440b0b3eeb4552e3a12314a0aeba445ff311b69d0525273e1b9edc95d312faea20a135d83fb94075ad16e170718c749c8e4734386d926788f9e38aa1307b7faf417755df78e79514b5f2783224ce29956706a1a3785416f370b812398bf8ff3e8b4bd7677b991f85f1f895a44b46971e3009704bf2dcfc9aea61de092db7eccb7266a9e9af7fe2b0423ea6f6d8a61209a9d89f0b69389907d9faccdd81e66f223cbf4c583040e530963aa127d9e593e46db2cc2daf00a5083cf8d4052d1b854ef6f3e1905d01fc1bad1397281a3b8f2abafa221f16c7a788d718b8b28ad6b86186ec86816b59c499baac73f5df6a9934d8a04a2295672aaa9e0235f88a5a4b61e3a590c5709e0d38c635efaf7db361f02c49a05173b9ed0a342c603fc54ef3806b1544c31f828a426aecf04fa334ca48a014485851ce6470565b890c689e14dfd4e523dbac5c05587bab713745c8fa06bf9ae0576b447702333d3c653b49428717aed59f7be817e2cb9a46b2362c6e74d385308649554761bd30dd35764d11789643302bf353394ab0427b4f934eb6d823b73d9ec6f6651e981607fcd0c47948a117691f6104338f636b102a4b6ebe4a8668129aecaeef9d50cacbba06d545062f6bd7823d2ec22adf2dbac2304568e430b3f02200e2169be9ce952c9d3d78e454fd2babb73edc1519b784f151b08862e99afff6bf77c43571d735920c439f3d491df4c2589122f4c3b0badb0d1c0dba836243042ee81020f49682eaf6079269590c4cdd0d5bfd72c704759fdc2cf8122a2d3e401bedf0df3c84a097fdbe7cfc200f78958515cdde754b01594d60a371b788f91f6395c373c292f20c5c7aef3e12cbd9cc9cbe28192548ddea1f80a83698cd4cdbc5a2263381a7301ac531178e16095e703f89cbf5789fa04ec2eae9a0bfca7b9ebe5bdb322d3be4abca12fdf7507896b5865c0b1b1111492bcbf959e04e42bbe17377f7a34775a59b224aac4a955ecf8e330b34e195e56f17019ef475109fb7ca5e3ac9ad8cbd36e8791d10da4bda9ca0a2e39259d990c56dd3b04621bcf40895e35045b610e59505d7c1d3c42235f32f36a4a85b6f12ff0e78a0280df0164aa4c2fd9a5eed97b5e7f7936a03ad64f3a0062a03be348bbe9c2686324c637c2c62a4b5e3d58b80b7ff76948e7ffeb1aeaa9adf87ab8cb0797f0297f3549d6b320efcb0bf6be1ab448cb398c28616474e69be71cd8aa9b24170c0be6b1c87b31c4c8689c85c468688a3381301144cdd906b5d4fe5901f71f7d34e8f7ab7a35e62af3ea3fa215002ac09ecd6cabd86e3a628fac3b456dd9f732973c519bd9231d001fafd5f3f584d7685740d81708e24e136c98b5ac23e8e28dbc891be80d0c6e419e47a6df211731be66412168ab941cbab1d98847af0070cc9362ff533918878639607012b70e08d95324cf9e7392613699916e0a922200fe074960b592c35cfdfde2641f8263bcd05e3bda75779c89888d28528798ca75ae52d5f789bb79e86f4821dc5ed8dc9b85cd99e6a87498f27e3a181cafc8d107209affef67719fda76d225f15f882c14286c3a2d43c71922d8aa01ea5831c9b8751a9c15345e85a4c7c51cf92c1212c9d38785227c529d4902aa784fc9061bb2564cf31252c418b1eac594e2e2115bf09f492ca8b9ac61cf3e8c50c82706c525bf9698f47814680030abdbe3777e9d0abcfa463032c886bfe6cc023178587363896061d441a3edb00a7d8f0bedb6a6ea8ed0ddf20d4892e3624a2af6fe591b2c1ddd04eb3d65534df8907f9cbb2b5d4b2d7dc342746ac283efec0a222123cb90b588f8b2c472af40787e191ba271fc7bc312a20e0a0b7fcc402ea1208d7de9652cea3d733b7f73192f7c29c32b437c28fd4023e3ac375543f28d715769e7d52378b0d20c0277b52250b34e738dbe122164aca82c219ac0d2dde11caba840b81cfbb27ecafc553bc36f0883a7d921bd1837ee414c501aadcfa52a6558ec64de0c9c3beab9f8b41553735df8b59881119ba9cf85eb024ddef35b88ce0f9bad18e3f0b8c851f2906f82af0988478631bb0df0f912c155ec894eac17c8b49e1292a416b8d0f7f8bdfa5b884f689805d0b0fd971a9073190f7cf475df6bd81de4c6242f67d8897c333ebde74c79dd0c0e73dbbaeb39b0c3abafb5dda4dbb4fa95128fd269cf6f1b9787c2939fc20e17b60b23f806610fbbb6c0b2ad1123b54f8b648a385c3e9a0b1669b15a87d5704194bf97cb7e1ba62ecf8c2dcb090461622bb448cc504f871cc4cedb8d530d840e67f0ae769d70607fa4e8fbbbf2214905afcf1028ae0d5dcef4f7bec0b0553c3e1c0d887b378ce43288eec440975b0b4093975b7b0de5daf7ca031d07d706c421b8f053ca2622933e81b6939d9b7aa87e79883226a9aefd5ca21845d5717a1d97c7b141502ad61c290bb3383ca0e3d0794fea20288d1e471feb815113c910e4d6a0dc763babdb5d5a86070cf5f09f319e1193174a9a2ce34731c157ba0ac24df969d5657d4c009235de027d3a381490d3d124336253dfb1c53babe061b988432387afcf8a1899f22792576e8ea5c13a568b19848459daa2a3a966cb203c2d116be675e36b064e3be2adf9cbfb857ec3d96cc0cd64d069491b721d84be3a95bf8ccf66e1b68fa2b3f1ef48aec787853eb7ca08a6276f4044e31ee55169c50dc3cb021b9232daac17693ec137ed71e0d2ba17713a62b8aac853a5920e406a5a764ebcbc949baee192025d0df5aa792e60ac06dc7914ac22351ae3b40746dc0f0866909aeceeded5d0882d84e626f22d226e4fe4acf3cee5d26154df1230c058bd022668221e79c96e61cdbb368b8911fd59b4bd68b22665c4117fe98a6afea637b2bfad4cd6c0753f2116251ce0881a5dfb125dd62e35ae03229560a176b28f9ad29eef153c851535ae5e7a48083a6e2665c63bc6785b1092b011eddfbdf73dc71b0788b09f14dce3b2109ddcaa9c143af6321aa55b338fba7f215be11875528ad25d387ba8ae812ce4cb37eb2989ff90449f5f394b75eebe5b79a1ec4e89859ce4b2edf0bc887f0bfbb3d182729d7a4d4f3f8c53ee6174b72dd2e01bbfb2f2326769af3ca87e6ed997efc36d1744dbcc9202f578f4eb260e56c1388b58a80d2cd89ca54306851ca1d9f3df7ff9682514a825a0c39aec3c94c57fdc45a67c2e5b3e6bc85fd480a3286b40291fa99bdb99509981d3200444c13864eab31d824d43a65a18879ed4c99455c8037715d59724a14ae1d3e675cdc1e1496c0a9e5aa5b215ac53adf10441c71ed5cd9d526a9308daccbf07a24adc35213faf9e01191f44d7423c776253b86b28b72ee3d04d38cbe8ae2ec34acc081425737847e76cda0d94db9787e16bc5b598719e96192d16365c0690aadf8850465890ab9994b1dd2317e46ed941e5780650b2d830820fb3ec280e37725a873b12a5627f01ce9faee633c512e75a3c9d675527aeeba12e86db9f2837040d01c77a4ba56481a7acf4589c08e4bc0897af27edaf7ff012ddd6c4f6d142dcb256c9ffc0cf554934f73bf016c3b7d3ae470395c386a7b9c7975ee862afa62b088f5906de0d5e698a04021a561d3e2d721196471e465a853c4bf2e94a72c32d23c119d48819cf5a5314ee0dc54c37c0a2cc4645ef663f82fcbb8d03f20a59576ce6d6b32bede80e6dab27953f32eedd817ba93e02dc662b17130678f984baeeadd827c9db023189d28674eb7b95eb0593bffb392a4a9058d001bad51ff2a1b5bd9f6ee85b09130548a8c7e8c54b2bcd3fe4cdfea4d2d8a3c402d832e953aae734527838283e829627bfd6cee3b0bed697277aed33333f299dd2ca95184e6a6e2ae9f70c88b108c760f3b95928d7a3efb28e3eac3573908e0b974d48f7eb323031f745fa919f8bbe79a86acb77d4d20f652152c5b39251c7d6bf447b2fa317a63522fe2178b3a2676cb9c9b64211dc4ea96758e0e6a16a65ae55c0a42d5b962308a82ffd1846d1a33d3978cb85efc5d9a23072f3d86789c8b288398623660fc2bcdf511bc5cbbbe60f2b16cb7fca5a2de8101f31f3450d819a3934783eb1161ed1c63ce192ed9f83bd5466bcc3120c49c3676c8d81ee89576f79ab26366d69d17b5181ec8286552eb375b3d0717390a2b9ff567dbe18a6656feba192b58452ce080c19ff2e4460e9bce357bf7525db1d3aeccd90ff571262d3608bcf7d1283f992af3b9060ab8b268677e06f70bfc65bd9e0af8f7e274721f4772a155fb982737812d4874ce11d354fe8ca653d66b48415aa0d96bd79c00dce3d8492c9bf572c869034082822a4105785a58840429a71d2d28a535917af4395e38568ee8925d95060e1a4864b231212a2be5cad12079ebaa7d00d9c8836e47113fe6f9cd8cc88207c3033b32da0becfee784059eb49be09b07524a27d85737d5e03896b15e562bd3116ed4f51be8795ac539a856cee9820680d5b27fd62cbcfa04da13f863f301aed4bf4975138dc6c4d7760626e3e1c9dc1a77152c21941ea3079b5dacacb0d9990a2825ba62704108770d0c59451d439b14a1ccb947f780cc35c5134301478f562a6a8a320d0f4e9585c0755581817b99dd865eaf1046b28414d0062126583eb38d8fa88913c9fcabc6fff507b76b2683601796a1594e138181ba3b8e84de8e69de235d5400ff7cd950c78437885ee44018d774b674c41f3222abdc6aab0b56bc9df131451df004"}) (async, rerun: 64) pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (rerun: 64) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(r1, 0x40046210, &(0x7f0000000140)=0x1) (async) socket$l2tp(0x2, 0x2, 0x73) (async) r2 = syz_open_dev$vcsa(&(0x7f00000001c0), 0x84e, 0x200000) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r0) 15:29:43 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:43 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) fcntl$getownex(r0, 0x10, &(0x7f0000000080)) 15:29:43 executing program 5: ioctl$SIOCGETSGCNT(0xffffffffffffffff, 0x89e1, &(0x7f0000000000)={@local, @dev={0xac, 0x14, 0x14, 0x2e}}) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) 15:29:43 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xd380ff, 0x1aa41) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:43 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0x200000000ffffc, 0x412241) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) r1 = openat$cgroup_ro(r0, &(0x7f0000000040)='blkio.bfq.time\x00', 0x0, 0x0) r2 = inotify_add_watch(r0, &(0x7f00000000c0)='./file0\x00', 0x188) inotify_rm_watch(r1, r2) 15:29:43 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async, rerun: 32) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (rerun: 32) 15:29:43 executing program 0: syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000100), 0xffffffffffffffff) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x947b243cb22f6a57, 0x8010, r1, 0x10000000) getsockopt$MRT(r1, 0x0, 0xce, &(0x7f0000000080), &(0x7f00000000c0)=0x4) 15:29:43 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_DISABLE_BEARER(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x30, r2, 0x400, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x13, @l2={'eth', 0x3a, 'macvlan0\x00'}}}, ["", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x4}, 0x0) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:43 executing program 5: ioctl$SIOCGETSGCNT(0xffffffffffffffff, 0x89e1, &(0x7f0000000000)={@local, @dev={0xac, 0x14, 0x14, 0x2e}}) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) ioctl$SIOCGETSGCNT(0xffffffffffffffff, 0x89e1, &(0x7f0000000000)={@local, @dev={0xac, 0x14, 0x14, 0x2e}}) (async) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) 15:29:43 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (async) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_DISABLE_BEARER(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x30, r2, 0x400, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x13, @l2={'eth', 0x3a, 'macvlan0\x00'}}}, ["", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x4}, 0x0) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:43 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0x200000000ffffc, 0x412241) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) r1 = openat$cgroup_ro(r0, &(0x7f0000000040)='blkio.bfq.time\x00', 0x0, 0x0) r2 = inotify_add_watch(r0, &(0x7f00000000c0)='./file0\x00', 0x188) inotify_rm_watch(r1, r2) syz_open_dev$vcsa(&(0x7f0000000080), 0x200000000ffffc, 0x412241) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) openat$cgroup_ro(r0, &(0x7f0000000040)='blkio.bfq.time\x00', 0x0, 0x0) (async) inotify_add_watch(r0, &(0x7f00000000c0)='./file0\x00', 0x188) (async) inotify_rm_watch(r1, r2) (async) 15:29:43 executing program 4: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r0, &(0x7f0000000480)={&(0x7f00000002c0), 0xc, &(0x7f0000000440)={&(0x7f0000000500)=ANY=[@ANYBLOB="29257495e06bd478a4ed4f2b60fd42dc34d639413fbdead4c9d1d21e5cc0d47d8a2b89296663c8afd691a684c3a836439afda40dfc6b436c480b6126a1", @ANYRES16=r1, @ANYBLOB="4e072dbd7000fddbdf250400000005000100000000002700070073797374656d5f753a6f626a6563745f723a7570647077645f657865635f743a73300000080005007f0000011b0007002f7573722f7362696e2f637570732d62726f7773656400001400060076657468315f766c616e0000000000002a00070073797374656d5f753a6f626a6563745f723a7075626c69635f636f6e74656e745f743a73300000003200070073797374656d5f753a6f626a6563745f723a73797374656d645f6c6f67696e645f7661725f72756e5f743a7330000000140002000000000000000000000000000000000108000400ffffffff08000400ac141416"], 0x100}, 0x1, 0x0, 0x0, 0x894}, 0x20000090) r2 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) syz_io_uring_setup(0x5a38, &(0x7f0000000080)={0x0, 0xcbee, 0x20, 0x2, 0x140, 0x0, r2}, &(0x7f0000ffa000/0x5000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)) r4 = syz_io_uring_setup(0x176f, &(0x7f0000000080)={0x0, 0x2000, 0x0, 0x1}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f00000004c0), &(0x7f0000000140)) syz_io_uring_setup(0x176f, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x3}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000006, 0x12, r4, 0x10000000) syz_io_uring_submit(r5, r6, &(0x7f0000000040)=@IORING_OP_MADVISE={0x19, 0x0, 0x0, 0x0, 0x0, &(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x0) io_uring_setup(0x1e73, &(0x7f0000000240)={0x0, 0xa806, 0x2, 0x2, 0x368}) syz_io_uring_submit(r3, r6, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE={0xc, 0x0, 0x0, 0x0, 0x0, 0x12345}, 0x9) r7 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r7, 0x10000000) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r8 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r8, 0x10000000) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(r8, 0x40046210, &(0x7f00000001c0)) r9 = syz_open_dev$tty1(0xc, 0x4, 0x1) fcntl$getownex(r9, 0x10, &(0x7f0000000200)) 15:29:43 executing program 0: syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000100), 0xffffffffffffffff) (async) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async, rerun: 32) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async, rerun: 32) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x947b243cb22f6a57, 0x8010, r1, 0x10000000) (async) getsockopt$MRT(r1, 0x0, 0xce, &(0x7f0000000080), &(0x7f00000000c0)=0x4) 15:29:43 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) openat$cgroup_int(r1, &(0x7f0000000080)='cgroup.max.depth\x00', 0x2, 0x0) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:43 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0x200000000ffffc, 0x412241) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) r1 = openat$cgroup_ro(r0, &(0x7f0000000040)='blkio.bfq.time\x00', 0x0, 0x0) r2 = inotify_add_watch(r0, &(0x7f00000000c0)='./file0\x00', 0x188) inotify_rm_watch(r1, r2) syz_open_dev$vcsa(&(0x7f0000000080), 0x200000000ffffc, 0x412241) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) openat$cgroup_ro(r0, &(0x7f0000000040)='blkio.bfq.time\x00', 0x0, 0x0) (async) inotify_add_watch(r0, &(0x7f00000000c0)='./file0\x00', 0x188) (async) inotify_rm_watch(r1, r2) (async) 15:29:43 executing program 5: ioctl$SIOCGETSGCNT(0xffffffffffffffff, 0x89e1, &(0x7f0000000000)={@local, @dev={0xac, 0x14, 0x14, 0x2e}}) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) 15:29:43 executing program 4: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r0, &(0x7f0000000480)={&(0x7f00000002c0), 0xc, &(0x7f0000000440)={&(0x7f0000000500)=ANY=[@ANYBLOB="29257495e06bd478a4ed4f2b60fd42dc34d639413fbdead4c9d1d21e5cc0d47d8a2b89296663c8afd691a684c3a836439afda40dfc6b436c480b6126a1", @ANYRES16=r1, @ANYBLOB="4e072dbd7000fddbdf250400000005000100000000002700070073797374656d5f753a6f626a6563745f723a7570647077645f657865635f743a73300000080005007f0000011b0007002f7573722f7362696e2f637570732d62726f7773656400001400060076657468315f766c616e0000000000002a00070073797374656d5f753a6f626a6563745f723a7075626c69635f636f6e74656e745f743a73300000003200070073797374656d5f753a6f626a6563745f723a73797374656d645f6c6f67696e645f7661725f72756e5f743a7330000000140002000000000000000000000000000000000108000400ffffffff08000400ac141416"], 0x100}, 0x1, 0x0, 0x0, 0x894}, 0x20000090) (async) r2 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) syz_io_uring_setup(0x5a38, &(0x7f0000000080)={0x0, 0xcbee, 0x20, 0x2, 0x140, 0x0, r2}, &(0x7f0000ffa000/0x5000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)) (async) r4 = syz_io_uring_setup(0x176f, &(0x7f0000000080)={0x0, 0x2000, 0x0, 0x1}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f00000004c0), &(0x7f0000000140)) (async) syz_io_uring_setup(0x176f, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x3}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000006, 0x12, r4, 0x10000000) syz_io_uring_submit(r5, r6, &(0x7f0000000040)=@IORING_OP_MADVISE={0x19, 0x0, 0x0, 0x0, 0x0, &(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x0) (async) io_uring_setup(0x1e73, &(0x7f0000000240)={0x0, 0xa806, 0x2, 0x2, 0x368}) (async) syz_io_uring_submit(r3, r6, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE={0xc, 0x0, 0x0, 0x0, 0x0, 0x12345}, 0x9) (async) r7 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r7, 0x10000000) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r8 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r8, 0x10000000) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(r8, 0x40046210, &(0x7f00000001c0)) r9 = syz_open_dev$tty1(0xc, 0x4, 0x1) fcntl$getownex(r9, 0x10, &(0x7f0000000200)) 15:29:43 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_DISABLE_BEARER(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x30, r2, 0x400, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x13, @l2={'eth', 0x3a, 'macvlan0\x00'}}}, ["", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x4}, 0x0) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) pipe2$watch_queue(&(0x7f0000000000), 0x80) (async) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) (async) sendmsg$TIPC_CMD_DISABLE_BEARER(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x30, r2, 0x400, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x13, @l2={'eth', 0x3a, 'macvlan0\x00'}}}, ["", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x4}, 0x0) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) 15:29:43 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) setsockopt$MRT_FLUSH(r1, 0x0, 0xd4, &(0x7f0000000080)=0x3, 0x4) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:43 executing program 0: syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000100), 0xffffffffffffffff) (async) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x947b243cb22f6a57, 0x8010, r1, 0x10000000) (async) getsockopt$MRT(r1, 0x0, 0xce, &(0x7f0000000080), &(0x7f00000000c0)=0x4) 15:29:43 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) openat$cgroup_int(r1, &(0x7f0000000080)='cgroup.max.depth\x00', 0x2, 0x0) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) openat$cgroup_int(r1, &(0x7f0000000080)='cgroup.max.depth\x00', 0x2, 0x0) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) 15:29:43 executing program 4: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r0, &(0x7f0000000480)={&(0x7f00000002c0), 0xc, &(0x7f0000000440)={&(0x7f0000000500)=ANY=[@ANYBLOB="29257495e06bd478a4ed4f2b60fd42dc34d639413fbdead4c9d1d21e5cc0d47d8a2b89296663c8afd691a684c3a836439afda40dfc6b436c480b6126a1", @ANYRES16=r1, @ANYBLOB="4e072dbd7000fddbdf250400000005000100000000002700070073797374656d5f753a6f626a6563745f723a7570647077645f657865635f743a73300000080005007f0000011b0007002f7573722f7362696e2f637570732d62726f7773656400001400060076657468315f766c616e0000000000002a00070073797374656d5f753a6f626a6563745f723a7075626c69635f636f6e74656e745f743a73300000003200070073797374656d5f753a6f626a6563745f723a73797374656d645f6c6f67696e645f7661725f72756e5f743a7330000000140002000000000000000000000000000000000108000400ffffffff08000400ac141416"], 0x100}, 0x1, 0x0, 0x0, 0x894}, 0x20000090) r2 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) syz_io_uring_setup(0x5a38, &(0x7f0000000080)={0x0, 0xcbee, 0x20, 0x2, 0x140, 0x0, r2}, &(0x7f0000ffa000/0x5000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)) r4 = syz_io_uring_setup(0x176f, &(0x7f0000000080)={0x0, 0x2000, 0x0, 0x1}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f00000004c0), &(0x7f0000000140)) syz_io_uring_setup(0x176f, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x3}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000006, 0x12, r4, 0x10000000) syz_io_uring_submit(r5, r6, &(0x7f0000000040)=@IORING_OP_MADVISE={0x19, 0x0, 0x0, 0x0, 0x0, &(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x0) io_uring_setup(0x1e73, &(0x7f0000000240)={0x0, 0xa806, 0x2, 0x2, 0x368}) syz_io_uring_submit(r3, r6, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE={0xc, 0x0, 0x0, 0x0, 0x0, 0x12345}, 0x9) r7 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r7, 0x10000000) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r8 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r8, 0x10000000) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(r8, 0x40046210, &(0x7f00000001c0)) r9 = syz_open_dev$tty1(0xc, 0x4, 0x1) fcntl$getownex(r9, 0x10, &(0x7f0000000200)) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000300), 0xffffffffffffffff) (async) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r0, &(0x7f0000000480)={&(0x7f00000002c0), 0xc, &(0x7f0000000440)={&(0x7f0000000500)=ANY=[@ANYBLOB="29257495e06bd478a4ed4f2b60fd42dc34d639413fbdead4c9d1d21e5cc0d47d8a2b89296663c8afd691a684c3a836439afda40dfc6b436c480b6126a1", @ANYRES16=r1, @ANYBLOB="4e072dbd7000fddbdf250400000005000100000000002700070073797374656d5f753a6f626a6563745f723a7570647077645f657865635f743a73300000080005007f0000011b0007002f7573722f7362696e2f637570732d62726f7773656400001400060076657468315f766c616e0000000000002a00070073797374656d5f753a6f626a6563745f723a7075626c69635f636f6e74656e745f743a73300000003200070073797374656d5f753a6f626a6563745f723a73797374656d645f6c6f67696e645f7661725f72756e5f743a7330000000140002000000000000000000000000000000000108000400ffffffff08000400ac141416"], 0x100}, 0x1, 0x0, 0x0, 0x894}, 0x20000090) (async) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) syz_io_uring_setup(0x5a38, &(0x7f0000000080)={0x0, 0xcbee, 0x20, 0x2, 0x140, 0x0, r2}, &(0x7f0000ffa000/0x5000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) (async) syz_io_uring_setup(0x176f, &(0x7f0000000080)={0x0, 0x2000, 0x0, 0x1}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f00000004c0), &(0x7f0000000140)) (async) syz_io_uring_setup(0x176f, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x3}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000140)) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000006, 0x12, r4, 0x10000000) (async) syz_io_uring_submit(r5, r6, &(0x7f0000000040)=@IORING_OP_MADVISE={0x19, 0x0, 0x0, 0x0, 0x0, &(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x0) (async) io_uring_setup(0x1e73, &(0x7f0000000240)={0x0, 0xa806, 0x2, 0x2, 0x368}) (async) syz_io_uring_submit(r3, r6, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE={0xc, 0x0, 0x0, 0x0, 0x0, 0x12345}, 0x9) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r7, 0x10000000) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r8, 0x10000000) (async) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(r8, 0x40046210, &(0x7f00000001c0)) (async) syz_open_dev$tty1(0xc, 0x4, 0x1) (async) fcntl$getownex(r9, 0x10, &(0x7f0000000200)) (async) 15:29:43 executing program 3: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x10000000) write$qrtrtun(r0, &(0x7f0000000140)="d1a04bfa5927094c51c568789b008e49f80b2ebb76520ccdd2d0581f9f85a91f11b25200ec025d4023d4a331733fc4d1c975353a9e4664a90d43d430c1530e10bc0ee0cfaeb8c4cd1f26dec9c4ba450b9d1a2ff3bb663add320e1c37f15e1fe66eb3e8fff9cd4a7efaa2270d760b517fe757e16fca5706f9d16942133277e116ae559e5c40cd2d2cf11e0753a0b65c98caffb54f399fa99d211cb89ef603f54d6c162cc2870000d7379ec87847f27039f8497b927845dde5384d9af17aef1329d4f0bd4bfb4bf6caad615be63f461cc063224cbcee2de23be01c5a0ac67b433f0cd53b47afd1c3048fd95b50573d112a620a29893bb6d8a6170eb5311adc7b6429e19dbc52dfefaf444022181f23df792dbab6b650b606c33abdef06cf921e9d2d5a96c0c6a1f6f9550544c4ac5dd5cdbb4d40e7abe5b30ba36d6687730c0d1cceedf028235d567f66302a4237a063910f50366aacf1ce468517d33f04c3c634b6eeeeb23f8d3f10216e3bb0e1497568442eead4cfe6424a993e4176f121d77ad4f35860c10c34ef05b25d97a878da8cb00a82f510ebef893bb1874c44a56eb181b2b07f8ff247ef7502d1ad402917d583fe9879c8c1caf8812f331149ef9ab11de7491716b0d6f57a27bf05c9dd844937d2a9a720cbdb4c6e", 0x1d9) 15:29:43 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) r1 = openat$cgroup_ro(r0, &(0x7f0000000080)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) 15:29:43 executing program 0: pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f0000000740)) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x7c, 0x0, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x9a}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x80}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @local}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x4}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x5}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @remote}]}, 0x7c}, 0x1, 0x0, 0x0, 0x40000}, 0x8041) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r2, &(0x7f0000000080)={0x40002010}) r3 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) ioctl$BINDER_CTL_ADD(r3, 0xc1086201, &(0x7f00000004c0)={'custom0\x00'}) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000001500)={0xffffffffffffffff, 0x26, 0x0, 0x0, 0x0}, 0x20) write$qrtrtun(r1, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0xfffffffe, {{}, {}, {0x8, 0x2, 0x4}}}, 0x24}}, 0x20008010) sendmsg$L2TP_CMD_NOOP(r4, &(0x7f00000006c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)=ANY=[@ANYBLOB="80040000", @ANYRES16=0x0, @ANYBLOB="080027bd7000ffdbdf250000000005000d000100000008001800e00000010600030007000000050012000c00e0ff040013000800000006001c00810000000c000f000300000000000000"], 0x50}}, 0x20048040) pipe2$watch_queue(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r2) sendmsg$L2TP_CMD_TUNNEL_GET(r5, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000340)={&(0x7f0000000940)=ANY=[@ANYBLOB="28000000650e0dcaa714e932878604012cb487170a1c0d17cf6beecb78d7215738c312d4ec71f1ac4f96f12ea795a0aa2411cae44b44e7113a8818b62fd76dc984003662e3a1838a1e84339f16690bdf3430d46086679daddd547aa762fa9d6edee0c9bfb07a6764cc8122f3f6373acf66e46a1a596201e3a1437d84e0262376f21faea24f7e90a33e3a2059b4ad98f7d4e3801fc62d9c4624b67d09e4adf4680f2a0ad4d402f17f56bd62832f3fe75a1e6da83d467aceb87e11d09176c41fe4fef1b69d79e0", @ANYRES16=r6, @ANYRESHEX=r1], 0x28}, 0x1, 0x0, 0x0, 0x40811}, 0x0) inotify_init1(0x81000) write$qrtrtun(r1, &(0x7f0000000000)="de8138", 0xf85) 15:29:43 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) setsockopt$MRT_FLUSH(r1, 0x0, 0xd4, &(0x7f0000000080)=0x3, 0x4) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:43 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) openat$cgroup_int(r1, &(0x7f0000000080)='cgroup.max.depth\x00', 0x2, 0x0) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) openat$cgroup_int(r1, &(0x7f0000000080)='cgroup.max.depth\x00', 0x2, 0x0) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) 15:29:43 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) r1 = openat$cgroup_ro(r0, &(0x7f0000000080)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) 15:29:43 executing program 3: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async, rerun: 32) r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (rerun: 32) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x10000000) (async, rerun: 32) write$qrtrtun(r0, &(0x7f0000000140)="d1a04bfa5927094c51c568789b008e49f80b2ebb76520ccdd2d0581f9f85a91f11b25200ec025d4023d4a331733fc4d1c975353a9e4664a90d43d430c1530e10bc0ee0cfaeb8c4cd1f26dec9c4ba450b9d1a2ff3bb663add320e1c37f15e1fe66eb3e8fff9cd4a7efaa2270d760b517fe757e16fca5706f9d16942133277e116ae559e5c40cd2d2cf11e0753a0b65c98caffb54f399fa99d211cb89ef603f54d6c162cc2870000d7379ec87847f27039f8497b927845dde5384d9af17aef1329d4f0bd4bfb4bf6caad615be63f461cc063224cbcee2de23be01c5a0ac67b433f0cd53b47afd1c3048fd95b50573d112a620a29893bb6d8a6170eb5311adc7b6429e19dbc52dfefaf444022181f23df792dbab6b650b606c33abdef06cf921e9d2d5a96c0c6a1f6f9550544c4ac5dd5cdbb4d40e7abe5b30ba36d6687730c0d1cceedf028235d567f66302a4237a063910f50366aacf1ce468517d33f04c3c634b6eeeeb23f8d3f10216e3bb0e1497568442eead4cfe6424a993e4176f121d77ad4f35860c10c34ef05b25d97a878da8cb00a82f510ebef893bb1874c44a56eb181b2b07f8ff247ef7502d1ad402917d583fe9879c8c1caf8812f331149ef9ab11de7491716b0d6f57a27bf05c9dd844937d2a9a720cbdb4c6e", 0x1d9) (rerun: 32) 15:29:43 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) setsockopt$MRT_FLUSH(r1, 0x0, 0xd4, &(0x7f0000000080)=0x3, 0x4) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:43 executing program 0: pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f0000000740)) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x7c, 0x0, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x9a}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x80}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @local}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x4}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x5}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @remote}]}, 0x7c}, 0x1, 0x0, 0x0, 0x40000}, 0x8041) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r2, &(0x7f0000000080)={0x40002010}) (async) r3 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) (async) ioctl$BINDER_CTL_ADD(r3, 0xc1086201, &(0x7f00000004c0)={'custom0\x00'}) (async) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000001500)={0xffffffffffffffff, 0x26, 0x0, 0x0, 0x0}, 0x20) write$qrtrtun(r1, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0xfffffffe, {{}, {}, {0x8, 0x2, 0x4}}}, 0x24}}, 0x20008010) (async) sendmsg$L2TP_CMD_NOOP(r4, &(0x7f00000006c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)=ANY=[@ANYBLOB="80040000", @ANYRES16=0x0, @ANYBLOB="080027bd7000ffdbdf250000000005000d000100000008001800e00000010600030007000000050012000c00e0ff040013000800000006001c00810000000c000f000300000000000000"], 0x50}}, 0x20048040) pipe2$watch_queue(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (async) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r2) sendmsg$L2TP_CMD_TUNNEL_GET(r5, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000340)={&(0x7f0000000940)=ANY=[@ANYBLOB="28000000650e0dcaa714e932878604012cb487170a1c0d17cf6beecb78d7215738c312d4ec71f1ac4f96f12ea795a0aa2411cae44b44e7113a8818b62fd76dc984003662e3a1838a1e84339f16690bdf3430d46086679daddd547aa762fa9d6edee0c9bfb07a6764cc8122f3f6373acf66e46a1a596201e3a1437d84e0262376f21faea24f7e90a33e3a2059b4ad98f7d4e3801fc62d9c4624b67d09e4adf4680f2a0ad4d402f17f56bd62832f3fe75a1e6da83d467aceb87e11d09176c41fe4fef1b69d79e0", @ANYRES16=r6, @ANYRESHEX=r1], 0x28}, 0x1, 0x0, 0x0, 0x40811}, 0x0) inotify_init1(0x81000) (async) write$qrtrtun(r1, &(0x7f0000000000)="de8138", 0xf85) 15:29:43 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) r1 = openat$cgroup_ro(r0, &(0x7f0000000080)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) openat$cgroup_ro(r0, &(0x7f0000000080)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) (async) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) (async) 15:29:43 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0xc00000000000, 0x1a9980) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x949) bpf$OBJ_GET_PROG(0x7, &(0x7f00000000c0)={&(0x7f0000000040)='./file0\x00', 0x0, 0x30}, 0x10) 15:29:43 executing program 3: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x10000000) write$qrtrtun(r0, &(0x7f0000000140)="d1a04bfa5927094c51c568789b008e49f80b2ebb76520ccdd2d0581f9f85a91f11b25200ec025d4023d4a331733fc4d1c975353a9e4664a90d43d430c1530e10bc0ee0cfaeb8c4cd1f26dec9c4ba450b9d1a2ff3bb663add320e1c37f15e1fe66eb3e8fff9cd4a7efaa2270d760b517fe757e16fca5706f9d16942133277e116ae559e5c40cd2d2cf11e0753a0b65c98caffb54f399fa99d211cb89ef603f54d6c162cc2870000d7379ec87847f27039f8497b927845dde5384d9af17aef1329d4f0bd4bfb4bf6caad615be63f461cc063224cbcee2de23be01c5a0ac67b433f0cd53b47afd1c3048fd95b50573d112a620a29893bb6d8a6170eb5311adc7b6429e19dbc52dfefaf444022181f23df792dbab6b650b606c33abdef06cf921e9d2d5a96c0c6a1f6f9550544c4ac5dd5cdbb4d40e7abe5b30ba36d6687730c0d1cceedf028235d567f66302a4237a063910f50366aacf1ce468517d33f04c3c634b6eeeeb23f8d3f10216e3bb0e1497568442eead4cfe6424a993e4176f121d77ad4f35860c10c34ef05b25d97a878da8cb00a82f510ebef893bb1874c44a56eb181b2b07f8ff247ef7502d1ad402917d583fe9879c8c1caf8812f331149ef9ab11de7491716b0d6f57a27bf05c9dd844937d2a9a720cbdb4c6e", 0x1d9) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x10000000) (async) write$qrtrtun(r0, &(0x7f0000000140)="d1a04bfa5927094c51c568789b008e49f80b2ebb76520ccdd2d0581f9f85a91f11b25200ec025d4023d4a331733fc4d1c975353a9e4664a90d43d430c1530e10bc0ee0cfaeb8c4cd1f26dec9c4ba450b9d1a2ff3bb663add320e1c37f15e1fe66eb3e8fff9cd4a7efaa2270d760b517fe757e16fca5706f9d16942133277e116ae559e5c40cd2d2cf11e0753a0b65c98caffb54f399fa99d211cb89ef603f54d6c162cc2870000d7379ec87847f27039f8497b927845dde5384d9af17aef1329d4f0bd4bfb4bf6caad615be63f461cc063224cbcee2de23be01c5a0ac67b433f0cd53b47afd1c3048fd95b50573d112a620a29893bb6d8a6170eb5311adc7b6429e19dbc52dfefaf444022181f23df792dbab6b650b606c33abdef06cf921e9d2d5a96c0c6a1f6f9550544c4ac5dd5cdbb4d40e7abe5b30ba36d6687730c0d1cceedf028235d567f66302a4237a063910f50366aacf1ce468517d33f04c3c634b6eeeeb23f8d3f10216e3bb0e1497568442eead4cfe6424a993e4176f121d77ad4f35860c10c34ef05b25d97a878da8cb00a82f510ebef893bb1874c44a56eb181b2b07f8ff247ef7502d1ad402917d583fe9879c8c1caf8812f331149ef9ab11de7491716b0d6f57a27bf05c9dd844937d2a9a720cbdb4c6e", 0x1d9) (async) 15:29:44 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4102040}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x0, 0x8, 0x70bd29, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_SECLEVELS={0x5, 0x35, 0xcf}]}, 0x1c}, 0x1, 0x0, 0x0, 0xa3df5893ce846525}, 0x44004890) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="000002", 0x3) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x2000) 15:29:44 executing program 0: pipe2$watch_queue(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f0000000740)) (async) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x7c, 0x0, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x9a}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x80}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @local}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x4}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x5}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @remote}]}, 0x7c}, 0x1, 0x0, 0x0, 0x40000}, 0x8041) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r2, &(0x7f0000000080)={0x40002010}) (async) r3 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) (async) ioctl$BINDER_CTL_ADD(r3, 0xc1086201, &(0x7f00000004c0)={'custom0\x00'}) (async) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000001500)={0xffffffffffffffff, 0x26, 0x0, 0x0, 0x0}, 0x20) write$qrtrtun(r1, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0xfffffffe, {{}, {}, {0x8, 0x2, 0x4}}}, 0x24}}, 0x20008010) sendmsg$L2TP_CMD_NOOP(r4, &(0x7f00000006c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)=ANY=[@ANYBLOB="80040000", @ANYRES16=0x0, @ANYBLOB="080027bd7000ffdbdf250000000005000d000100000008001800e00000010600030007000000050012000c00e0ff040013000800000006001c00810000000c000f000300000000000000"], 0x50}}, 0x20048040) (async) pipe2$watch_queue(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (async) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r2) sendmsg$L2TP_CMD_TUNNEL_GET(r5, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000340)={&(0x7f0000000940)=ANY=[@ANYBLOB="28000000650e0dcaa714e932878604012cb487170a1c0d17cf6beecb78d7215738c312d4ec71f1ac4f96f12ea795a0aa2411cae44b44e7113a8818b62fd76dc984003662e3a1838a1e84339f16690bdf3430d46086679daddd547aa762fa9d6edee0c9bfb07a6764cc8122f3f6373acf66e46a1a596201e3a1437d84e0262376f21faea24f7e90a33e3a2059b4ad98f7d4e3801fc62d9c4624b67d09e4adf4680f2a0ad4d402f17f56bd62832f3fe75a1e6da83d467aceb87e11d09176c41fe4fef1b69d79e0", @ANYRES16=r6, @ANYRESHEX=r1], 0x28}, 0x1, 0x0, 0x0, 0x40811}, 0x0) (async) inotify_init1(0x81000) write$qrtrtun(r1, &(0x7f0000000000)="de8138", 0xf85) 15:29:44 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs2/binder1\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x8c, 0x0, &(0x7f0000000240)=[@increfs_done, @acquire={0x40046305, 0x2}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0xfffffffe}, @free_buffer, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/176, 0xb0, 0x2, 0x10}, @flat=@weak_binder={0x77622a85, 0x100, 0x2}, @fda={0x66646185, 0x7, 0x2, 0x25}}, &(0x7f0000000200)={0x0, 0x28, 0x40}}}], 0xc7, 0x0, &(0x7f0000000340)="335c2cf8f4e5db4afcba00ac91e373d2d3b99bdb2507fde218525dae2b18d9b2ebb633d7c2e42e57a78f691a354c543b25baba898e367033560c5ec09a92ef3aa0ad59ac601356b5f22d6e9c5d4684df64c3ddff75ef27647725f71c4f0e73bccb783c957d1d853c28485b865175233975edfd7023746a6d534975d98918326b58f7e2c5559a30e74c49480e38fcba7c7782a3b2a8e3bcf549145587a77ad91625e4dd1f0a752640276b4967144c30c0196e1e9f198bc38d21aa133f394bd8b8222fa669e69b1d"}) 15:29:44 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0xc00000000000, 0x1a9980) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x949) bpf$OBJ_GET_PROG(0x7, &(0x7f00000000c0)={&(0x7f0000000040)='./file0\x00', 0x0, 0x30}, 0x10) syz_open_dev$vcsa(&(0x7f0000000080), 0xc00000000000, 0x1a9980) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x949) (async) bpf$OBJ_GET_PROG(0x7, &(0x7f00000000c0)={&(0x7f0000000040)='./file0\x00', 0x0, 0x30}, 0x10) (async) 15:29:44 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4102040}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x0, 0x8, 0x70bd29, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_SECLEVELS={0x5, 0x35, 0xcf}]}, 0x1c}, 0x1, 0x0, 0x0, 0xa3df5893ce846525}, 0x44004890) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="000002", 0x3) (async, rerun: 32) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x2000) (rerun: 32) 15:29:44 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r0, &(0x7f0000000140)={0x10000000}) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) ioctl$IOC_WATCH_QUEUE_SET_FILTER(r1, 0x5761, &(0x7f0000000080)={0x3, 0x0, [{0x10000, 0x1, 0x6, [0x0, 0x7, 0x7, 0x9, 0x0, 0x10000, 0x1f, 0x1]}, {0x7, 0x7ff, 0x200, [0x8, 0x8000, 0x3, 0x9, 0x5, 0x3f, 0x6fd, 0x2]}, {0x7, 0x401, 0x3, [0x6, 0x1ffc0, 0x1aec7b4b, 0xac1, 0x5, 0x9, 0x2, 0x2]}]}) openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:44 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) read$qrtrtun(r1, &(0x7f0000000080)=""/149, 0x95) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) r2 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_MCAST_REPLICAST(r2, 0x10f, 0x86) getsockopt$TIPC_CONN_TIMEOUT(r2, 0x10f, 0x82, &(0x7f0000000140), &(0x7f0000000180)=0x4) 15:29:44 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs2/binder1\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x8c, 0x0, &(0x7f0000000240)=[@increfs_done, @acquire={0x40046305, 0x2}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0xfffffffe}, @free_buffer, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/176, 0xb0, 0x2, 0x10}, @flat=@weak_binder={0x77622a85, 0x100, 0x2}, @fda={0x66646185, 0x7, 0x2, 0x25}}, &(0x7f0000000200)={0x0, 0x28, 0x40}}}], 0xc7, 0x0, &(0x7f0000000340)="335c2cf8f4e5db4afcba00ac91e373d2d3b99bdb2507fde218525dae2b18d9b2ebb633d7c2e42e57a78f691a354c543b25baba898e367033560c5ec09a92ef3aa0ad59ac601356b5f22d6e9c5d4684df64c3ddff75ef27647725f71c4f0e73bccb783c957d1d853c28485b865175233975edfd7023746a6d534975d98918326b58f7e2c5559a30e74c49480e38fcba7c7782a3b2a8e3bcf549145587a77ad91625e4dd1f0a752640276b4967144c30c0196e1e9f198bc38d21aa133f394bd8b8222fa669e69b1d"}) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs2/binder1\x00', 0x2, 0x0) (async) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x8c, 0x0, &(0x7f0000000240)=[@increfs_done, @acquire={0x40046305, 0x2}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0xfffffffe}, @free_buffer, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/176, 0xb0, 0x2, 0x10}, @flat=@weak_binder={0x77622a85, 0x100, 0x2}, @fda={0x66646185, 0x7, 0x2, 0x25}}, &(0x7f0000000200)={0x0, 0x28, 0x40}}}], 0xc7, 0x0, &(0x7f0000000340)="335c2cf8f4e5db4afcba00ac91e373d2d3b99bdb2507fde218525dae2b18d9b2ebb633d7c2e42e57a78f691a354c543b25baba898e367033560c5ec09a92ef3aa0ad59ac601356b5f22d6e9c5d4684df64c3ddff75ef27647725f71c4f0e73bccb783c957d1d853c28485b865175233975edfd7023746a6d534975d98918326b58f7e2c5559a30e74c49480e38fcba7c7782a3b2a8e3bcf549145587a77ad91625e4dd1f0a752640276b4967144c30c0196e1e9f198bc38d21aa133f394bd8b8222fa669e69b1d"}) (async) 15:29:44 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0xc00000000000, 0x1a9980) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x949) (async) bpf$OBJ_GET_PROG(0x7, &(0x7f00000000c0)={&(0x7f0000000040)='./file0\x00', 0x0, 0x30}, 0x10) 15:29:44 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) read$qrtrtun(r1, &(0x7f0000000080)=""/149, 0x95) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) r2 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_MCAST_REPLICAST(r2, 0x10f, 0x86) (async) getsockopt$TIPC_CONN_TIMEOUT(r2, 0x10f, 0x82, &(0x7f0000000140), &(0x7f0000000180)=0x4) 15:29:44 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4102040}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x0, 0x8, 0x70bd29, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_SECLEVELS={0x5, 0x35, 0xcf}]}, 0x1c}, 0x1, 0x0, 0x0, 0xa3df5893ce846525}, 0x44004890) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="000002", 0x3) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x2000) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4102040}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x0, 0x8, 0x70bd29, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_SECLEVELS={0x5, 0x35, 0xcf}]}, 0x1c}, 0x1, 0x0, 0x0, 0xa3df5893ce846525}, 0x44004890) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="000002", 0x3) (async) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x2000) (async) 15:29:44 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000080), 0x40) ioctl$SNDRV_TIMER_IOCTL_TREAD(r1, 0x40045402, &(0x7f00000000c0)=0x1) 15:29:44 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs2/binder1\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x8c, 0x0, &(0x7f0000000240)=[@increfs_done, @acquire={0x40046305, 0x2}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0xfffffffe}, @free_buffer, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/176, 0xb0, 0x2, 0x10}, @flat=@weak_binder={0x77622a85, 0x100, 0x2}, @fda={0x66646185, 0x7, 0x2, 0x25}}, &(0x7f0000000200)={0x0, 0x28, 0x40}}}], 0xc7, 0x0, &(0x7f0000000340)="335c2cf8f4e5db4afcba00ac91e373d2d3b99bdb2507fde218525dae2b18d9b2ebb633d7c2e42e57a78f691a354c543b25baba898e367033560c5ec09a92ef3aa0ad59ac601356b5f22d6e9c5d4684df64c3ddff75ef27647725f71c4f0e73bccb783c957d1d853c28485b865175233975edfd7023746a6d534975d98918326b58f7e2c5559a30e74c49480e38fcba7c7782a3b2a8e3bcf549145587a77ad91625e4dd1f0a752640276b4967144c30c0196e1e9f198bc38d21aa133f394bd8b8222fa669e69b1d"}) 15:29:44 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r0, &(0x7f0000000140)={0x10000000}) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) ioctl$IOC_WATCH_QUEUE_SET_FILTER(r1, 0x5761, &(0x7f0000000080)={0x3, 0x0, [{0x10000, 0x1, 0x6, [0x0, 0x7, 0x7, 0x9, 0x0, 0x10000, 0x1f, 0x1]}, {0x7, 0x7ff, 0x200, [0x8, 0x8000, 0x3, 0x9, 0x5, 0x3f, 0x6fd, 0x2]}, {0x7, 0x401, 0x3, [0x6, 0x1ffc0, 0x1aec7b4b, 0xac1, 0x5, 0x9, 0x2, 0x2]}]}) (async) openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:44 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000080)="de813892e28fa1c5fec3ebfa57de4badb231b1f722b4fc3d462e54666111b2320ead7b43b91469c6d7fd16a19afd89fbeb9b286928780e11f77c36962fc4a3cf1bf48fd9d723d42acf28c4027a428f3e4816f19fa69a6476711a924c19acc4cbd8368eeac1a47cb09ddd415f68d8710842e473d6314d840592e23f9194bc029cf128fe7da3a3e2036bea260d601bec4d3df8fe8bc0e83ff209f1447753840810dcc6c5272444e5f74575bc2da49d3ffae7ca3900000000", 0xb7) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000000)={0x1, 0x0}, 0x8) bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000140)=r1, 0x4) 15:29:44 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) read$qrtrtun(r1, &(0x7f0000000080)=""/149, 0x95) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) r2 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_MCAST_REPLICAST(r2, 0x10f, 0x86) getsockopt$TIPC_CONN_TIMEOUT(r2, 0x10f, 0x82, &(0x7f0000000140), &(0x7f0000000180)=0x4) 15:29:44 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x4a841) setsockopt$MRT_INIT(r0, 0x0, 0xc8, &(0x7f0000000080), 0x4) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:44 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000080)="de813892e28fa1c5fec3ebfa57de4badb231b1f722b4fc3d462e54666111b2320ead7b43b91469c6d7fd16a19afd89fbeb9b286928780e11f77c36962fc4a3cf1bf48fd9d723d42acf28c4027a428f3e4816f19fa69a6476711a924c19acc4cbd8368eeac1a47cb09ddd415f68d8710842e473d6314d840592e23f9194bc029cf128fe7da3a3e2036bea260d601bec4d3df8fe8bc0e83ff209f1447753840810dcc6c5272444e5f74575bc2da49d3ffae7ca3900000000", 0xb7) (async) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000000)={0x1, 0x0}, 0x8) bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000140)=r1, 0x4) 15:29:44 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r0, &(0x7f0000000140)={0x10000000}) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) ioctl$IOC_WATCH_QUEUE_SET_FILTER(r1, 0x5761, &(0x7f0000000080)={0x3, 0x0, [{0x10000, 0x1, 0x6, [0x0, 0x7, 0x7, 0x9, 0x0, 0x10000, 0x1f, 0x1]}, {0x7, 0x7ff, 0x200, [0x8, 0x8000, 0x3, 0x9, 0x5, 0x3f, 0x6fd, 0x2]}, {0x7, 0x401, 0x3, [0x6, 0x1ffc0, 0x1aec7b4b, 0xac1, 0x5, 0x9, 0x2, 0x2]}]}) (async) openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) (async, rerun: 32) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (rerun: 32) 15:29:44 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000080), 0x40) ioctl$SNDRV_TIMER_IOCTL_TREAD(r1, 0x40045402, &(0x7f00000000c0)=0x1) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000080), 0x40) (async) ioctl$SNDRV_TIMER_IOCTL_TREAD(r1, 0x40045402, &(0x7f00000000c0)=0x1) (async) 15:29:44 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, 0xffffffffffffffff) ioctl$SNDRV_TIMER_IOCTL_PAUSE(0xffffffffffffffff, 0x54a3) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:44 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000080)="de813892e28fa1c5fec3ebfa57de4badb231b1f722b4fc3d462e54666111b2320ead7b43b91469c6d7fd16a19afd89fbeb9b286928780e11f77c36962fc4a3cf1bf48fd9d723d42acf28c4027a428f3e4816f19fa69a6476711a924c19acc4cbd8368eeac1a47cb09ddd415f68d8710842e473d6314d840592e23f9194bc029cf128fe7da3a3e2036bea260d601bec4d3df8fe8bc0e83ff209f1447753840810dcc6c5272444e5f74575bc2da49d3ffae7ca3900000000", 0xb7) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000000)={0x1, 0x0}, 0x8) bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000140)=r1, 0x4) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000080)="de813892e28fa1c5fec3ebfa57de4badb231b1f722b4fc3d462e54666111b2320ead7b43b91469c6d7fd16a19afd89fbeb9b286928780e11f77c36962fc4a3cf1bf48fd9d723d42acf28c4027a428f3e4816f19fa69a6476711a924c19acc4cbd8368eeac1a47cb09ddd415f68d8710842e473d6314d840592e23f9194bc029cf128fe7da3a3e2036bea260d601bec4d3df8fe8bc0e83ff209f1447753840810dcc6c5272444e5f74575bc2da49d3ffae7ca3900000000", 0xb7) (async) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000000)={0x1}, 0x8) (async) bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000140)=r1, 0x4) (async) 15:29:44 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = syz_open_dev$vcsa(&(0x7f0000000080), 0x39c0, 0x2541) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r2) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:44 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) setsockopt$TIPC_MCAST_BROADCAST(r0, 0x10f, 0x85) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:44 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = syz_open_dev$vcsa(&(0x7f0000000080), 0x39c0, 0x2541) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r2) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) syz_open_dev$vcsa(&(0x7f0000000080), 0x39c0, 0x2541) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r2) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) 15:29:44 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, 0xffffffffffffffff) ioctl$SNDRV_TIMER_IOCTL_PAUSE(0xffffffffffffffff, 0x54a3) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x0) (async) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, 0xffffffffffffffff) (async) ioctl$SNDRV_TIMER_IOCTL_PAUSE(0xffffffffffffffff, 0x54a3) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) 15:29:44 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x4a841) setsockopt$MRT_INIT(r0, 0x0, 0xc8, &(0x7f0000000080), 0x4) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:44 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000080), 0x40) ioctl$SNDRV_TIMER_IOCTL_TREAD(r1, 0x40045402, &(0x7f00000000c0)=0x1) 15:29:44 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async, rerun: 32) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (rerun: 32) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async, rerun: 64) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x0) (rerun: 64) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, 0xffffffffffffffff) (async, rerun: 32) ioctl$SNDRV_TIMER_IOCTL_PAUSE(0xffffffffffffffff, 0x54a3) (async, rerun: 32) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:44 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x70b941) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) 15:29:44 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) setsockopt$TIPC_MCAST_BROADCAST(r0, 0x10f, 0x85) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) setsockopt$TIPC_MCAST_BROADCAST(r0, 0x10f, 0x85) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) 15:29:44 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0x8, 0x80) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x0, 0x8, 0x70bd2c, 0x25dfdbfb, {}, [""]}, 0x1c}}, 0x1) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r1, &(0x7f0000000080)="de8138788408273fc7b9c87edb2a9c52aef7b61b38d6b965d5bb2238", 0x1c) 15:29:44 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x70b941) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) 15:29:44 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x4a841) setsockopt$MRT_INIT(r0, 0x0, 0xc8, &(0x7f0000000080), 0x4) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:44 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) write$qrtrtun(r1, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) syz_io_uring_setup(0x5, &(0x7f0000000080)={0x0, 0x3be3, 0x0, 0x1, 0x86, 0x0, r2}, &(0x7f0000fee000/0x12000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:44 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = syz_open_dev$vcsa(&(0x7f0000000080), 0x39c0, 0x2541) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r2) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) syz_open_dev$vcsa(&(0x7f0000000080), 0x39c0, 0x2541) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r2) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) 15:29:44 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) bind$l2tp(r0, &(0x7f0000000080)={0x2, 0x0, @broadcast, 0x2}, 0x10) getsockname$l2tp(r0, &(0x7f00000000c0)={0x2, 0x0, @loopback}, &(0x7f0000000100)=0x10) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:44 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0x8, 0x80) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x0, 0x8, 0x70bd2c, 0x25dfdbfb, {}, [""]}, 0x1c}}, 0x1) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r1, &(0x7f0000000080)="de8138788408273fc7b9c87edb2a9c52aef7b61b38d6b965d5bb2238", 0x1c) 15:29:44 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) setsockopt$TIPC_MCAST_BROADCAST(r0, 0x10f, 0x85) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) setsockopt$TIPC_MCAST_BROADCAST(r0, 0x10f, 0x85) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) 15:29:44 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x70b941) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x70b941) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) (async) 15:29:44 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_MCAST_REPLICAST(r1, 0x10f, 0x86) getsockopt$TIPC_CONN_TIMEOUT(r1, 0x10f, 0x82, &(0x7f0000000000), &(0x7f0000000080)=0x4) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:44 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) write$qrtrtun(r1, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) (async) syz_io_uring_setup(0x5, &(0x7f0000000080)={0x0, 0x3be3, 0x0, 0x1, 0x86, 0x0, r2}, &(0x7f0000fee000/0x12000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:44 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) bind$l2tp(r0, &(0x7f0000000080)={0x2, 0x0, @broadcast, 0x2}, 0x10) getsockname$l2tp(r0, &(0x7f00000000c0)={0x2, 0x0, @loopback}, &(0x7f0000000100)=0x10) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:44 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) ioctl$SNDRV_TIMER_IOCTL_STOP(r0, 0x54a1) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000080)={0x80002000}) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:44 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0x8, 0x80) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x0, 0x8, 0x70bd2c, 0x25dfdbfb, {}, [""]}, 0x1c}}, 0x1) (async) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r1, &(0x7f0000000080)="de8138788408273fc7b9c87edb2a9c52aef7b61b38d6b965d5bb2238", 0x1c) 15:29:44 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_MCAST_REPLICAST(r1, 0x10f, 0x86) getsockopt$TIPC_CONN_TIMEOUT(r1, 0x10f, 0x82, &(0x7f0000000000), &(0x7f0000000080)=0x4) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:44 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) ioctl$SNDRV_TIMER_IOCTL_SELECT(r2, 0x40345410, &(0x7f00000000c0)={{0xffffffffffffffff, 0x3, 0xb28, 0x0, 0xffffffff}}) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x10000000) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs2/binder-control\x00', 0x802, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r3, &(0x7f0000000100)) r4 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r4, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:44 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) write$qrtrtun(r1, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) syz_io_uring_setup(0x5, &(0x7f0000000080)={0x0, 0x3be3, 0x0, 0x1, 0x86, 0x0, r2}, &(0x7f0000fee000/0x12000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) write$qrtrtun(r1, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) (async) syz_io_uring_setup(0x5, &(0x7f0000000080)={0x0, 0x3be3, 0x0, 0x1, 0x86, 0x0, r2}, &(0x7f0000fee000/0x12000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) 15:29:44 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) bind$l2tp(r0, &(0x7f0000000080)={0x2, 0x0, @broadcast, 0x2}, 0x10) (async) getsockname$l2tp(r0, &(0x7f00000000c0)={0x2, 0x0, @loopback}, &(0x7f0000000100)=0x10) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:44 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) ioctl$SNDRV_TIMER_IOCTL_STOP(r0, 0x54a1) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000080)={0x80002000}) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) ioctl$SNDRV_TIMER_IOCTL_STOP(r0, 0x54a1) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) pipe2$watch_queue(&(0x7f0000000100), 0x80) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) (async) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000080)={0x80002000}) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) 15:29:44 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100), r0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r2, 0x400, 0x70bd29, 0x25dfdbfb, {}, ["", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x14}, 0xc4) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r3, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000240), r0) sendmsg$TIPC_CMD_SET_NODE_ADDR(r3, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x24, r4, 0x400, 0x70bd25, 0x25dfdbfd, {{}, {}, {0x8, 0x11, 0x1}}, ["", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x884}, 0x4004005) bind$l2tp(r0, &(0x7f0000000340)={0x2, 0x0, @loopback, 0x4}, 0x10) r5 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r5, 0x10000000) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, r5, 0xf) syz_open_dev$vcsa(&(0x7f0000000080), 0x7, 0x20000) 15:29:44 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) (async, rerun: 32) ioctl$SNDRV_TIMER_IOCTL_SELECT(r2, 0x40345410, &(0x7f00000000c0)={{0xffffffffffffffff, 0x3, 0xb28, 0x0, 0xffffffff}}) (rerun: 32) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x10000000) (async, rerun: 64) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs2/binder-control\x00', 0x802, 0x0) (rerun: 64) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r3, &(0x7f0000000100)) (async, rerun: 32) r4 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (rerun: 32) write$qrtrtun(r4, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:44 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_MCAST_REPLICAST(r1, 0x10f, 0x86) getsockopt$TIPC_CONN_TIMEOUT(r1, 0x10f, 0x82, &(0x7f0000000000), &(0x7f0000000080)=0x4) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:44 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0xe, 0x9, &(0x7f0000000080)=@raw=[@generic={0x8, 0x4, 0x2, 0x2, 0x25d}, @map_idx_val={0x18, 0x0, 0x6, 0x0, 0xff, 0x0, 0x0, 0x0, 0x3ff}, @initr0={0x18, 0x0, 0x0, 0x0, 0x3c8, 0x0, 0x0, 0x0, 0x2}, @cb_func={0x18, 0x6, 0x4, 0x0, 0x5}, @map_idx_val={0x18, 0x6, 0x6, 0x0, 0x4, 0x0, 0x0, 0x0, 0x10001}], &(0x7f0000000100)='syzkaller\x00', 0x7fff, 0xb4, &(0x7f0000000140)=""/180, 0x100, 0x8, '\x00', 0x0, 0x1f, r0, 0x8, &(0x7f0000000200)={0x7, 0x3}, 0x8, 0x10, &(0x7f0000000240)={0x3, 0x2, 0x5, 0x70}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, &(0x7f0000000280)=[r0, r0, r0, r0, 0xffffffffffffffff, r0, 0xffffffffffffffff]}, 0x80) pipe2$watch_queue(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000003c0)={r1, r2, 0xb}, 0x10) 15:29:44 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100), r0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r2, 0x400, 0x70bd29, 0x25dfdbfb, {}, ["", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x14}, 0xc4) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r3, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000240), r0) sendmsg$TIPC_CMD_SET_NODE_ADDR(r3, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x24, r4, 0x400, 0x70bd25, 0x25dfdbfd, {{}, {}, {0x8, 0x11, 0x1}}, ["", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x884}, 0x4004005) bind$l2tp(r0, &(0x7f0000000340)={0x2, 0x0, @loopback, 0x4}, 0x10) r5 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r5, 0x10000000) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, r5, 0xf) syz_open_dev$vcsa(&(0x7f0000000080), 0x7, 0x20000) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$tipc(&(0x7f0000000100), r0) (async) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r2, 0x400, 0x70bd29, 0x25dfdbfb, {}, ["", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x14}, 0xc4) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$TIPC_CMD_SET_NETID(r3, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) syz_genetlink_get_family_id$tipc(&(0x7f0000000240), r0) (async) sendmsg$TIPC_CMD_SET_NODE_ADDR(r3, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x24, r4, 0x400, 0x70bd25, 0x25dfdbfd, {{}, {}, {0x8, 0x11, 0x1}}, ["", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x884}, 0x4004005) (async) bind$l2tp(r0, &(0x7f0000000340)={0x2, 0x0, @loopback, 0x4}, 0x10) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r5, 0x10000000) (async) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, r5, 0xf) (async) syz_open_dev$vcsa(&(0x7f0000000080), 0x7, 0x20000) (async) 15:29:44 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000180), 0xffffc, 0xf85193c105c50c3e) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) write$qrtrtun(r2, &(0x7f0000000000)="51e2fa7806c428de4d66a13700"/23, 0x17) r3 = request_key(&(0x7f00000000c0)='.request_key_auth\x00', &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)='/dev/vcsa#\x00', 0x0) keyctl$KEYCTL_WATCH_KEY(0x20, r3, r1, 0x2) 15:29:44 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) ioctl$SNDRV_TIMER_IOCTL_STOP(r0, 0x54a1) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) (async) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000080)={0x80002000}) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:44 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) (async) ioctl$SNDRV_TIMER_IOCTL_SELECT(r2, 0x40345410, &(0x7f00000000c0)={{0xffffffffffffffff, 0x3, 0xb28, 0x0, 0xffffffff}}) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x10000000) (async) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs2/binder-control\x00', 0x802, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r3, &(0x7f0000000100)) (async) r4 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r4, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) 15:29:44 executing program 3: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) 15:29:44 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0xe, 0x9, &(0x7f0000000080)=@raw=[@generic={0x8, 0x4, 0x2, 0x2, 0x25d}, @map_idx_val={0x18, 0x0, 0x6, 0x0, 0xff, 0x0, 0x0, 0x0, 0x3ff}, @initr0={0x18, 0x0, 0x0, 0x0, 0x3c8, 0x0, 0x0, 0x0, 0x2}, @cb_func={0x18, 0x6, 0x4, 0x0, 0x5}, @map_idx_val={0x18, 0x6, 0x6, 0x0, 0x4, 0x0, 0x0, 0x0, 0x10001}], &(0x7f0000000100)='syzkaller\x00', 0x7fff, 0xb4, &(0x7f0000000140)=""/180, 0x100, 0x8, '\x00', 0x0, 0x1f, r0, 0x8, &(0x7f0000000200)={0x7, 0x3}, 0x8, 0x10, &(0x7f0000000240)={0x3, 0x2, 0x5, 0x70}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, &(0x7f0000000280)=[r0, r0, r0, r0, 0xffffffffffffffff, r0, 0xffffffffffffffff]}, 0x80) (async) pipe2$watch_queue(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000003c0)={r1, r2, 0xb}, 0x10) 15:29:44 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) ioctl$SIOCGETSGCNT(r1, 0x89e1, &(0x7f0000000080)={@rand_addr=0x64010100, @initdev={0xac, 0x1e, 0x0, 0x0}}) r2 = openat$cgroup_ro(r0, &(0x7f00000000c0)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$MRT_FLUSH(r3, 0x0, 0xd4, &(0x7f0000000140)=0x6, 0x4) mmap$binder(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x8) write$qrtrtun(r0, &(0x7f0000000000)="de57de4badba8f2751b23191fc3d4e2e54", 0x43) 15:29:44 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000180), 0xffffc, 0xf85193c105c50c3e) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) write$qrtrtun(r2, &(0x7f0000000000)="51e2fa7806c428de4d66a13700"/23, 0x17) r3 = request_key(&(0x7f00000000c0)='.request_key_auth\x00', &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)='/dev/vcsa#\x00', 0x0) keyctl$KEYCTL_WATCH_KEY(0x20, r3, r1, 0x2) syz_open_dev$vcsa(&(0x7f0000000180), 0xffffc, 0xf85193c105c50c3e) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) pipe2$watch_queue(&(0x7f0000000080), 0x80) (async) write$qrtrtun(r2, &(0x7f0000000000)="51e2fa7806c428de4d66a13700"/23, 0x17) (async) request_key(&(0x7f00000000c0)='.request_key_auth\x00', &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)='/dev/vcsa#\x00', 0x0) (async) keyctl$KEYCTL_WATCH_KEY(0x20, r3, r1, 0x2) (async) 15:29:44 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0xe, 0x9, &(0x7f0000000080)=@raw=[@generic={0x8, 0x4, 0x2, 0x2, 0x25d}, @map_idx_val={0x18, 0x0, 0x6, 0x0, 0xff, 0x0, 0x0, 0x0, 0x3ff}, @initr0={0x18, 0x0, 0x0, 0x0, 0x3c8, 0x0, 0x0, 0x0, 0x2}, @cb_func={0x18, 0x6, 0x4, 0x0, 0x5}, @map_idx_val={0x18, 0x6, 0x6, 0x0, 0x4, 0x0, 0x0, 0x0, 0x10001}], &(0x7f0000000100)='syzkaller\x00', 0x7fff, 0xb4, &(0x7f0000000140)=""/180, 0x100, 0x8, '\x00', 0x0, 0x1f, r0, 0x8, &(0x7f0000000200)={0x7, 0x3}, 0x8, 0x10, &(0x7f0000000240)={0x3, 0x2, 0x5, 0x70}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, &(0x7f0000000280)=[r0, r0, r0, r0, 0xffffffffffffffff, r0, 0xffffffffffffffff]}, 0x80) (async) pipe2$watch_queue(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000003c0)={r1, r2, 0xb}, 0x10) 15:29:44 executing program 3: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) 15:29:44 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x5, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) ioctl$SNDRV_TIMER_IOCTL_STATUS64(r0, 0x80605414, &(0x7f00000000c0)) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) mmap$IORING_OFF_SQES(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2, 0x30, r1, 0x10000000) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) write$qrtrtun(r0, &(0x7f0000000080)="02c91f575305a5440038", 0xa) r3 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r3, 0x54a2) 15:29:44 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000180), 0xffffc, 0xf85193c105c50c3e) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) write$qrtrtun(r2, &(0x7f0000000000)="51e2fa7806c428de4d66a13700"/23, 0x17) (async, rerun: 32) r3 = request_key(&(0x7f00000000c0)='.request_key_auth\x00', &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)='/dev/vcsa#\x00', 0x0) (rerun: 32) keyctl$KEYCTL_WATCH_KEY(0x20, r3, r1, 0x2) 15:29:44 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100), r0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r2, 0x400, 0x70bd29, 0x25dfdbfb, {}, ["", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x14}, 0xc4) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r3, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000240), r0) sendmsg$TIPC_CMD_SET_NODE_ADDR(r3, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x24, r4, 0x400, 0x70bd25, 0x25dfdbfd, {{}, {}, {0x8, 0x11, 0x1}}, ["", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x884}, 0x4004005) bind$l2tp(r0, &(0x7f0000000340)={0x2, 0x0, @loopback, 0x4}, 0x10) r5 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r5, 0x10000000) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, r5, 0xf) syz_open_dev$vcsa(&(0x7f0000000080), 0x7, 0x20000) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$tipc(&(0x7f0000000100), r0) (async) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r2, 0x400, 0x70bd29, 0x25dfdbfb, {}, ["", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x14}, 0xc4) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$TIPC_CMD_SET_NETID(r3, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) syz_genetlink_get_family_id$tipc(&(0x7f0000000240), r0) (async) sendmsg$TIPC_CMD_SET_NODE_ADDR(r3, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x24, r4, 0x400, 0x70bd25, 0x25dfdbfd, {{}, {}, {0x8, 0x11, 0x1}}, ["", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x884}, 0x4004005) (async) bind$l2tp(r0, &(0x7f0000000340)={0x2, 0x0, @loopback, 0x4}, 0x10) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r5, 0x10000000) (async) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, r5, 0xf) (async) syz_open_dev$vcsa(&(0x7f0000000080), 0x7, 0x20000) (async) 15:29:44 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x5, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) ioctl$SNDRV_TIMER_IOCTL_STATUS64(r0, 0x80605414, &(0x7f00000000c0)) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2, 0x30, r1, 0x10000000) (async) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) (async) write$qrtrtun(r0, &(0x7f0000000080)="02c91f575305a5440038", 0xa) (async) r3 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r3, 0x54a2) 15:29:44 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) ioctl$SIOCGETSGCNT(r1, 0x89e1, &(0x7f0000000080)={@rand_addr=0x64010100, @initdev={0xac, 0x1e, 0x0, 0x0}}) (async) r2 = openat$cgroup_ro(r0, &(0x7f00000000c0)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$MRT_FLUSH(r3, 0x0, 0xd4, &(0x7f0000000140)=0x6, 0x4) mmap$binder(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x8) (async) write$qrtrtun(r0, &(0x7f0000000000)="de57de4badba8f2751b23191fc3d4e2e54", 0x43) 15:29:44 executing program 3: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) 15:29:44 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) r2 = openat$cgroup_ro(r0, &(0x7f0000000100)='blkio.bfq.io_service_bytes\x00', 0x0, 0x0) syz_io_uring_setup(0xac3, &(0x7f0000000140)={0x0, 0xa3a, 0x1, 0x1, 0x2be, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000c00000/0x400000)=nil, &(0x7f00000001c0), &(0x7f0000000200)) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x2010, r1, 0x8000000) io_uring_setup(0x7853, &(0x7f0000000080)={0x0, 0xe982, 0x10, 0x2, 0x2ea}) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) r3 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x4010, r3, 0x8000000) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r4, 0x10000000) syz_io_uring_setup(0x2bb5, &(0x7f0000000240)={0x0, 0x3fa, 0x0, 0x1, 0x148, 0x0, r4}, &(0x7f0000ff3000/0xa000)=nil, &(0x7f0000e6e000/0x1000)=nil, &(0x7f00000002c0), &(0x7f00000003c0)) openat$cgroup_freezer_state(r2, &(0x7f0000000380), 0x2, 0x0) 15:29:44 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) ioctl$SIOCGETSGCNT(r1, 0x89e1, &(0x7f0000000080)={@rand_addr=0x64010100, @initdev={0xac, 0x1e, 0x0, 0x0}}) (async) r2 = openat$cgroup_ro(r0, &(0x7f00000000c0)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$MRT_FLUSH(r3, 0x0, 0xd4, &(0x7f0000000140)=0x6, 0x4) mmap$binder(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x8) write$qrtrtun(r0, &(0x7f0000000000)="de57de4badba8f2751b23191fc3d4e2e54", 0x43) 15:29:44 executing program 1: r0 = getpgid(0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x1) kcmp$KCMP_EPOLL_TFD(0xffffffffffffffff, r0, 0x7, r1, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff, 0x7}) r2 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r2, &(0x7f0000000300)="9f", 0x1) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) openat$cgroup_int(r3, &(0x7f00000000c0)='hugetlb.2MB.rsvd.limit_in_bytes\x00', 0x2, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r1) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r4, &(0x7f00000003c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000002c0)={&(0x7f0000000340)={0x68, r5, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @broadcast}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x2}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e24}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x6}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @local}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x3}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x4}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x4}]}, 0x68}, 0x1, 0x0, 0x0, 0x805}, 0x2) write$qrtrtun(r2, &(0x7f0000000000)="de8138", 0x3) sendmsg$TIPC_CMD_DISABLE_BEARER(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x2c, 0x0, 0x200, 0x70bd27, 0x25dfdbfe, {{}, {}, {0x10, 0x13, @udp='udp:syz2\x00'}}, ["", "", "", ""]}, 0x2c}}, 0x0) 15:29:44 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x5, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) ioctl$SNDRV_TIMER_IOCTL_STATUS64(r0, 0x80605414, &(0x7f00000000c0)) (async) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2, 0x30, r1, 0x10000000) (async) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) (async) write$qrtrtun(r0, &(0x7f0000000080)="02c91f575305a5440038", 0xa) (async) r3 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r3, 0x54a2) 15:29:44 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r0, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4100900}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, 0x0, 0x2, 0x70bd26, 0x25dfdbfb, {}, ["", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x40800) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r1, &(0x7f0000000300)="9f", 0x1) pipe2$watch_queue(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_STATS(r2, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x60000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x1c, r3, 0x4, 0x70bd28, 0x25dfdbff, {}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x20010014) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r4, 0x10000000) read$qrtrtun(r4, &(0x7f0000000080)=""/116, 0x74) r5 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r5, 0x10000000) read$qrtrtun(r5, &(0x7f0000000100)=""/240, 0xf0) 15:29:44 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) r2 = openat$cgroup_ro(r0, &(0x7f0000000100)='blkio.bfq.io_service_bytes\x00', 0x0, 0x0) syz_io_uring_setup(0xac3, &(0x7f0000000140)={0x0, 0xa3a, 0x1, 0x1, 0x2be, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000c00000/0x400000)=nil, &(0x7f00000001c0), &(0x7f0000000200)) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x2010, r1, 0x8000000) io_uring_setup(0x7853, &(0x7f0000000080)={0x0, 0xe982, 0x10, 0x2, 0x2ea}) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) r3 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x4010, r3, 0x8000000) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r4, 0x10000000) syz_io_uring_setup(0x2bb5, &(0x7f0000000240)={0x0, 0x3fa, 0x0, 0x1, 0x148, 0x0, r4}, &(0x7f0000ff3000/0xa000)=nil, &(0x7f0000e6e000/0x1000)=nil, &(0x7f00000002c0), &(0x7f00000003c0)) openat$cgroup_freezer_state(r2, &(0x7f0000000380), 0x2, 0x0) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) openat$cgroup_ro(r0, &(0x7f0000000100)='blkio.bfq.io_service_bytes\x00', 0x0, 0x0) (async) syz_io_uring_setup(0xac3, &(0x7f0000000140)={0x0, 0xa3a, 0x1, 0x1, 0x2be, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000c00000/0x400000)=nil, &(0x7f00000001c0), &(0x7f0000000200)) (async) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x2010, r1, 0x8000000) (async) io_uring_setup(0x7853, &(0x7f0000000080)={0x0, 0xe982, 0x10, 0x2, 0x2ea}) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) (async) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x4010, r3, 0x8000000) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r4, 0x10000000) (async) syz_io_uring_setup(0x2bb5, &(0x7f0000000240)={0x0, 0x3fa, 0x0, 0x1, 0x148, 0x0, r4}, &(0x7f0000ff3000/0xa000)=nil, &(0x7f0000e6e000/0x1000)=nil, &(0x7f00000002c0), &(0x7f00000003c0)) (async) openat$cgroup_freezer_state(r2, &(0x7f0000000380), 0x2, 0x0) (async) 15:29:44 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x5, 0xa841) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2000006, 0x8010, r2, 0x10000000) r3 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) openat$cgroup_freezer_state(r3, &(0x7f00000001c0), 0x2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0863101d0300"/20], 0x88, 0x0, &(0x7f00000000c0)="2f802c3b275f2f93ec1bdce380901d6677e0f81dc913f4e69153ae2bce4096b680a740d2db2a4dfb8294668e94684f4842f2312dc265192005bea60f831fb58ee1d76826627d9ac8406f3e5b064098ba38854ebf4cac7036b75afe3e87e4719b090fd52c8b778f3ee8538c2577c02e9a51d7cf0ea9ef1a8674548f7953b56fd138661268fe70358b"}) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:44 executing program 1: r0 = getpgid(0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x1) kcmp$KCMP_EPOLL_TFD(0xffffffffffffffff, r0, 0x7, r1, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff, 0x7}) r2 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r2, &(0x7f0000000300)="9f", 0x1) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) openat$cgroup_int(r3, &(0x7f00000000c0)='hugetlb.2MB.rsvd.limit_in_bytes\x00', 0x2, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r1) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r4, &(0x7f00000003c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000002c0)={&(0x7f0000000340)={0x68, r5, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @broadcast}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x2}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e24}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x6}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @local}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x3}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x4}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x4}]}, 0x68}, 0x1, 0x0, 0x0, 0x805}, 0x2) write$qrtrtun(r2, &(0x7f0000000000)="de8138", 0x3) sendmsg$TIPC_CMD_DISABLE_BEARER(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x2c, 0x0, 0x200, 0x70bd27, 0x25dfdbfe, {{}, {}, {0x10, 0x13, @udp='udp:syz2\x00'}}, ["", "", "", ""]}, 0x2c}}, 0x0) getpgid(0xffffffffffffffff) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x1) (async) kcmp$KCMP_EPOLL_TFD(0xffffffffffffffff, r0, 0x7, r1, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff, 0x7}) (async) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r2, &(0x7f0000000300)="9f", 0x1) (async) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) (async) openat$cgroup_int(r3, &(0x7f00000000c0)='hugetlb.2MB.rsvd.limit_in_bytes\x00', 0x2, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$TIPC_CMD_SET_NETID(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r1) (async) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r4, &(0x7f00000003c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000002c0)={&(0x7f0000000340)={0x68, r5, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @broadcast}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x2}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e24}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x6}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @local}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x3}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x4}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x4}]}, 0x68}, 0x1, 0x0, 0x0, 0x805}, 0x2) (async) write$qrtrtun(r2, &(0x7f0000000000)="de8138", 0x3) (async) sendmsg$TIPC_CMD_DISABLE_BEARER(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x2c, 0x0, 0x200, 0x70bd27, 0x25dfdbfe, {{}, {}, {0x10, 0x13, @udp='udp:syz2\x00'}}, ["", "", "", ""]}, 0x2c}}, 0x0) (async) 15:29:44 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) getsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000080), &(0x7f00000000c0)=0x4) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:44 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8c00000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x34, r1, 0x8, 0x70bd27, 0x25dfdbfb, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x1}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @private=0xa010102}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000880}, 0x855) 15:29:44 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x5, 0xa841) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2000006, 0x8010, r2, 0x10000000) r3 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) openat$cgroup_freezer_state(r3, &(0x7f00000001c0), 0x2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0863101d0300"/20], 0x88, 0x0, &(0x7f00000000c0)="2f802c3b275f2f93ec1bdce380901d6677e0f81dc913f4e69153ae2bce4096b680a740d2db2a4dfb8294668e94684f4842f2312dc265192005bea60f831fb58ee1d76826627d9ac8406f3e5b064098ba38854ebf4cac7036b75afe3e87e4719b090fd52c8b778f3ee8538c2577c02e9a51d7cf0ea9ef1a8674548f7953b56fd138661268fe70358b"}) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) syz_open_dev$vcsa(&(0x7f0000000040), 0x5, 0xa841) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2000006, 0x8010, r2, 0x10000000) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) (async) openat$cgroup_freezer_state(r3, &(0x7f00000001c0), 0x2, 0x0) (async) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0863101d0300"/20], 0x88, 0x0, &(0x7f00000000c0)="2f802c3b275f2f93ec1bdce380901d6677e0f81dc913f4e69153ae2bce4096b680a740d2db2a4dfb8294668e94684f4842f2312dc265192005bea60f831fb58ee1d76826627d9ac8406f3e5b064098ba38854ebf4cac7036b75afe3e87e4719b090fd52c8b778f3ee8538c2577c02e9a51d7cf0ea9ef1a8674548f7953b56fd138661268fe70358b"}) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) 15:29:44 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r0, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4100900}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, 0x0, 0x2, 0x70bd26, 0x25dfdbfb, {}, ["", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x40800) (async, rerun: 64) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (rerun: 64) write$qrtrtun(r1, &(0x7f0000000300)="9f", 0x1) (async, rerun: 64) pipe2$watch_queue(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (async, rerun: 64) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_STATS(r2, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x60000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x1c, r3, 0x4, 0x70bd28, 0x25dfdbff, {}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x20010014) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r4, 0x10000000) (async) read$qrtrtun(r4, &(0x7f0000000080)=""/116, 0x74) (async, rerun: 64) r5 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (rerun: 64) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r5, 0x10000000) (async, rerun: 32) read$qrtrtun(r5, &(0x7f0000000100)=""/240, 0xf0) (rerun: 32) 15:29:44 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async, rerun: 32) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (rerun: 32) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) r2 = openat$cgroup_ro(r0, &(0x7f0000000100)='blkio.bfq.io_service_bytes\x00', 0x0, 0x0) syz_io_uring_setup(0xac3, &(0x7f0000000140)={0x0, 0xa3a, 0x1, 0x1, 0x2be, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000c00000/0x400000)=nil, &(0x7f00000001c0), &(0x7f0000000200)) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x2010, r1, 0x8000000) (async) io_uring_setup(0x7853, &(0x7f0000000080)={0x0, 0xe982, 0x10, 0x2, 0x2ea}) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) r3 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x4010, r3, 0x8000000) (async, rerun: 64) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (rerun: 64) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r4, 0x10000000) syz_io_uring_setup(0x2bb5, &(0x7f0000000240)={0x0, 0x3fa, 0x0, 0x1, 0x148, 0x0, r4}, &(0x7f0000ff3000/0xa000)=nil, &(0x7f0000e6e000/0x1000)=nil, &(0x7f00000002c0), &(0x7f00000003c0)) (async) openat$cgroup_freezer_state(r2, &(0x7f0000000380), 0x2, 0x0) 15:29:44 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8c00000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x34, r1, 0x8, 0x70bd27, 0x25dfdbfb, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x1}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @private=0xa010102}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000880}, 0x855) 15:29:44 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) getsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000080), &(0x7f00000000c0)=0x4) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:44 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x5, 0xa841) (async) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2000006, 0x8010, r2, 0x10000000) (async) r3 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) openat$cgroup_freezer_state(r3, &(0x7f00000001c0), 0x2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0863101d0300"/20], 0x88, 0x0, &(0x7f00000000c0)="2f802c3b275f2f93ec1bdce380901d6677e0f81dc913f4e69153ae2bce4096b680a740d2db2a4dfb8294668e94684f4842f2312dc265192005bea60f831fb58ee1d76826627d9ac8406f3e5b064098ba38854ebf4cac7036b75afe3e87e4719b090fd52c8b778f3ee8538c2577c02e9a51d7cf0ea9ef1a8674548f7953b56fd138661268fe70358b"}) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:44 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async, rerun: 64) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), 0xffffffffffffffff) (rerun: 64) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8c00000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x34, r1, 0x8, 0x70bd27, 0x25dfdbfb, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x1}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @private=0xa010102}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000880}, 0x855) 15:29:44 executing program 1: r0 = getpgid(0xffffffffffffffff) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x1) kcmp$KCMP_EPOLL_TFD(0xffffffffffffffff, r0, 0x7, r1, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff, 0x7}) (async) r2 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r2, &(0x7f0000000300)="9f", 0x1) (async) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) openat$cgroup_int(r3, &(0x7f00000000c0)='hugetlb.2MB.rsvd.limit_in_bytes\x00', 0x2, 0x0) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r1) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r4, &(0x7f00000003c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000002c0)={&(0x7f0000000340)={0x68, r5, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @broadcast}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x2}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e24}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x6}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @local}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x3}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x4}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x4}]}, 0x68}, 0x1, 0x0, 0x0, 0x805}, 0x2) write$qrtrtun(r2, &(0x7f0000000000)="de8138", 0x3) (async) sendmsg$TIPC_CMD_DISABLE_BEARER(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x2c, 0x0, 0x200, 0x70bd27, 0x25dfdbfe, {{}, {}, {0x10, 0x13, @udp='udp:syz2\x00'}}, ["", "", "", ""]}, 0x2c}}, 0x0) 15:29:44 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_MCAST_REPLICAST(r1, 0x10f, 0x86) ioctl$SIOCGETNODEID(r1, 0x89e1, &(0x7f0000000080)) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:44 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) read$qrtrtun(r0, &(0x7f0000000340)=""/4096, 0x1000) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:44 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) getsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000080), &(0x7f00000000c0)=0x4) (async, rerun: 32) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (rerun: 32) 15:29:44 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r0, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4100900}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, 0x0, 0x2, 0x70bd26, 0x25dfdbfb, {}, ["", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x40800) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r1, &(0x7f0000000300)="9f", 0x1) pipe2$watch_queue(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (async, rerun: 32) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), 0xffffffffffffffff) (rerun: 32) sendmsg$TIPC_CMD_SHOW_STATS(r2, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x60000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x1c, r3, 0x4, 0x70bd28, 0x25dfdbff, {}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x20010014) (async, rerun: 32) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (rerun: 32) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r4, 0x10000000) (async, rerun: 64) read$qrtrtun(r4, &(0x7f0000000080)=""/116, 0x74) (rerun: 64) r5 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r5, 0x10000000) (async) read$qrtrtun(r5, &(0x7f0000000100)=""/240, 0xf0) 15:29:44 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r0) sendmsg$TIPC_CMD_SHOW_STATS(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r1, 0x710, 0x70bd2a, 0x25dfdbff, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20004040}, 0x0) 15:29:44 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_MCAST_REPLICAST(r1, 0x10f, 0x86) (async) ioctl$SIOCGETNODEID(r1, 0x89e1, &(0x7f0000000080)) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:44 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) read$qrtrtun(r0, &(0x7f0000000340)=""/4096, 0x1000) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:44 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x24900) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="00a76346d1fa22933553f5", 0xb) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f0000000080)) 15:29:44 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r0) sendmsg$TIPC_CMD_SHOW_STATS(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r1, 0x710, 0x70bd2a, 0x25dfdbff, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20004040}, 0x0) 15:29:44 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_MCAST_REPLICAST(r1, 0x10f, 0x86) (async) ioctl$SIOCGETNODEID(r1, 0x89e1, &(0x7f0000000080)) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:44 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000080)="de813892a072adba8f2751b2acf3bc1dfc3d462e54", 0x15) 15:29:44 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) read$qrtrtun(r0, &(0x7f0000000340)=""/4096, 0x1000) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) read$qrtrtun(r0, &(0x7f0000000340)=""/4096, 0x1000) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) 15:29:44 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x24900) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="00a76346d1fa22933553f5", 0xb) (async) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f0000000080)) 15:29:44 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r0) sendmsg$TIPC_CMD_SHOW_STATS(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r1, 0x710, 0x70bd2a, 0x25dfdbff, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20004040}, 0x0) 15:29:44 executing program 0: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x11, r0, 0x10000000) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x59) 15:29:44 executing program 3: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(0xffffffffffffffff, &(0x7f00000000c0)="00ab7c7a6f", 0x5) r0 = socket$l2tp6(0xa, 0x2, 0x73) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) 15:29:44 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000080)="de813892a072adba8f2751b2acf3bc1dfc3d462e54", 0x15) 15:29:44 executing program 0: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x11, r0, 0x10000000) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x59) 15:29:44 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000080)="de813892a072adba8f2751b2acf3bc1dfc3d462e54", 0x15) 15:29:44 executing program 0: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async, rerun: 32) r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (rerun: 32) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x11, r0, 0x10000000) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x59) 15:29:44 executing program 5: syz_io_uring_setup(0x7950, &(0x7f0000000080)={0x0, 0x2b6b, 0x0, 0x2, 0x270}, &(0x7f0000003000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)) r1 = syz_io_uring_setup(0x176f, &(0x7f0000000080), &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_setup(0x176f, &(0x7f0000000080), &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r2 = mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000006, 0x810, r1, 0x10000000) r3 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) syz_io_uring_submit(r0, r4, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, r3, &(0x7f0000000240)={0x80200, 0x85, 0xc}, &(0x7f0000000280)='./file0\x00', 0x18, 0x0, 0x12345}, 0x101) r5 = socket$l2tp6(0xa, 0x2, 0x73) syz_io_uring_submit(r0, r2, &(0x7f00000001c0)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, r5, &(0x7f0000000180), 0x0, 0x0, 0x1800, 0x1}, 0x6) r6 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r6, &(0x7f0000000000)="de8138", 0xf85) r7 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_MCAST_REPLICAST(r7, 0x10f, 0x86) setsockopt$TIPC_MCAST_BROADCAST(r7, 0x10f, 0x85) r8 = openat$cgroup_ro(r6, &(0x7f00000002c0)='blkio.bfq.io_merged_recursive\x00', 0x0, 0x0) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r8, 0x5760, 0x14) 15:29:44 executing program 1: r0 = gettid() r1 = getpid() kcmp$KCMP_EPOLL_TFD(0x0, r1, 0x7, 0xffffffffffffffff, 0x0) r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) kcmp$KCMP_EPOLL_TFD(r0, r1, 0x7, r2, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x2}) pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$SNDRV_TIMER_IOCTL_SELECT(r3, 0x40345410, &(0x7f0000000140)={{0x2, 0x6, 0x6, 0x4d60cb9dba72b856, 0x6}}) r4 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r4, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r4, &(0x7f0000000000)="de8138", 0x3) 15:29:44 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000080)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e5420b2358e493a25dda7864e211a32352c7543d0595067779215e5ddb226e9f6a49290fdcfeebf3cd02524093e9aad873f72c4aa8c6e6b1422be53daedd12bad60fab93e033a075f", 0x66) 15:29:44 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x24900) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="00a76346d1fa22933553f5", 0xb) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f0000000080)) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x24900) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="00a76346d1fa22933553f5", 0xb) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f0000000080)) (async) 15:29:44 executing program 5: syz_io_uring_setup(0x7950, &(0x7f0000000080)={0x0, 0x2b6b, 0x0, 0x2, 0x270}, &(0x7f0000003000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)) r1 = syz_io_uring_setup(0x176f, &(0x7f0000000080), &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_setup(0x176f, &(0x7f0000000080), &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r2 = mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000006, 0x810, r1, 0x10000000) r3 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) syz_io_uring_submit(r0, r4, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, r3, &(0x7f0000000240)={0x80200, 0x85, 0xc}, &(0x7f0000000280)='./file0\x00', 0x18, 0x0, 0x12345}, 0x101) r5 = socket$l2tp6(0xa, 0x2, 0x73) syz_io_uring_submit(r0, r2, &(0x7f00000001c0)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, r5, &(0x7f0000000180), 0x0, 0x0, 0x1800, 0x1}, 0x6) r6 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r6, &(0x7f0000000000)="de8138", 0xf85) r7 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_MCAST_REPLICAST(r7, 0x10f, 0x86) setsockopt$TIPC_MCAST_BROADCAST(r7, 0x10f, 0x85) r8 = openat$cgroup_ro(r6, &(0x7f00000002c0)='blkio.bfq.io_merged_recursive\x00', 0x0, 0x0) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r8, 0x5760, 0x14) syz_io_uring_setup(0x7950, &(0x7f0000000080)={0x0, 0x2b6b, 0x0, 0x2, 0x270}, &(0x7f0000003000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000140)) (async) syz_io_uring_setup(0x176f, &(0x7f0000000080), &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000140)) (async) syz_io_uring_setup(0x176f, &(0x7f0000000080), &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000140)) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000006, 0x810, r1, 0x10000000) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) (async) syz_io_uring_submit(r0, r4, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, r3, &(0x7f0000000240)={0x80200, 0x85, 0xc}, &(0x7f0000000280)='./file0\x00', 0x18, 0x0, 0x12345}, 0x101) (async) socket$l2tp6(0xa, 0x2, 0x73) (async) syz_io_uring_submit(r0, r2, &(0x7f00000001c0)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, r5, &(0x7f0000000180), 0x0, 0x0, 0x1800, 0x1}, 0x6) (async) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r6, &(0x7f0000000000)="de8138", 0xf85) (async) socket$tipc(0x1e, 0x5, 0x0) (async) setsockopt$TIPC_MCAST_REPLICAST(r7, 0x10f, 0x86) (async) setsockopt$TIPC_MCAST_BROADCAST(r7, 0x10f, 0x85) (async) openat$cgroup_ro(r6, &(0x7f00000002c0)='blkio.bfq.io_merged_recursive\x00', 0x0, 0x0) (async) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r8, 0x5760, 0x14) (async) 15:29:44 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) socketpair(0xa, 0x6, 0x6, &(0x7f0000000080)={0xffffffffffffffff}) sendto$l2tp(r1, &(0x7f00000000c0)="d293365a932d1b259442f1f0f34238f49c3e639ead91f9b5e56086eed7e9e3e4f03a8890b884f2f1f64ebd6f0af87ca2f7d73e6b313e577bef1f92a9215747cc608471fad058cb75fddf91c061d9685ba40fd9c7c0f5d022cf4a0b82e62edd3b36856c0c214fe2c84fab8f2cee4497a7d7f4b69b0914806618b13f5048d7be84560d2878c0c228767d0f57ecb638f1", 0x8f, 0xff11aa5ac56e3abb, 0x0, 0x0) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:44 executing program 1: r0 = gettid() r1 = getpid() kcmp$KCMP_EPOLL_TFD(0x0, r1, 0x7, 0xffffffffffffffff, 0x0) r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) kcmp$KCMP_EPOLL_TFD(r0, r1, 0x7, r2, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x2}) pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$SNDRV_TIMER_IOCTL_SELECT(r3, 0x40345410, &(0x7f0000000140)={{0x2, 0x6, 0x6, 0x4d60cb9dba72b856, 0x6}}) r4 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r4, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r4, &(0x7f0000000000)="de8138", 0x3) gettid() (async) getpid() (async) kcmp$KCMP_EPOLL_TFD(0x0, r1, 0x7, 0xffffffffffffffff, 0x0) (async) openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) (async) kcmp$KCMP_EPOLL_TFD(r0, r1, 0x7, r2, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x2}) (async) pipe2$watch_queue(&(0x7f0000000100), 0x80) (async) ioctl$SNDRV_TIMER_IOCTL_SELECT(r3, 0x40345410, &(0x7f0000000140)={{0x2, 0x6, 0x6, 0x4d60cb9dba72b856, 0x6}}) (async) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r4, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r4, &(0x7f0000000000)="de8138", 0x3) (async) 15:29:44 executing program 3: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(0xffffffffffffffff, &(0x7f00000000c0)="00ab7c7a6f", 0x5) (async, rerun: 32) r0 = socket$l2tp6(0xa, 0x2, 0x73) (rerun: 32) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) 15:29:44 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r0) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:44 executing program 1: r0 = gettid() r1 = getpid() kcmp$KCMP_EPOLL_TFD(0x0, r1, 0x7, 0xffffffffffffffff, 0x0) r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) kcmp$KCMP_EPOLL_TFD(r0, r1, 0x7, r2, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x2}) pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$SNDRV_TIMER_IOCTL_SELECT(r3, 0x40345410, &(0x7f0000000140)={{0x2, 0x6, 0x6, 0x4d60cb9dba72b856, 0x6}}) (async) r4 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r4, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r4, &(0x7f0000000000)="de8138", 0x3) 15:29:44 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r0) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:44 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000080)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e5420b2358e493a25dda7864e211a32352c7543d0595067779215e5ddb226e9f6a49290fdcfeebf3cd02524093e9aad873f72c4aa8c6e6b1422be53daedd12bad60fab93e033a075f", 0x66) 15:29:44 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) write$qrtrtun(r0, &(0x7f0000000080)="9debfa67ab34345e168773976879ff89a27b515caca7e23c8b7742338bf37d49cc52f288de5f5b941d20a2f318885f4ec08ddcfbc01896113c67e5d9d3770dcbf2f8bb823e9f54b36b01a01825a6cbd04649b206f39b99539e19b5a9601f49bb3a1903ed1b2a4d372476faeaf76c3dc9588d6e2b0747f2b61df7ac636becf6194899e4f8fe085a0a225bcae415bc05", 0x8f) 15:29:44 executing program 5: syz_io_uring_setup(0x7950, &(0x7f0000000080)={0x0, 0x2b6b, 0x0, 0x2, 0x270}, &(0x7f0000003000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)) r1 = syz_io_uring_setup(0x176f, &(0x7f0000000080), &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_setup(0x176f, &(0x7f0000000080), &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r2 = mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000006, 0x810, r1, 0x10000000) r3 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) syz_io_uring_submit(r0, r4, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, r3, &(0x7f0000000240)={0x80200, 0x85, 0xc}, &(0x7f0000000280)='./file0\x00', 0x18, 0x0, 0x12345}, 0x101) r5 = socket$l2tp6(0xa, 0x2, 0x73) syz_io_uring_submit(r0, r2, &(0x7f00000001c0)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, r5, &(0x7f0000000180), 0x0, 0x0, 0x1800, 0x1}, 0x6) r6 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r6, &(0x7f0000000000)="de8138", 0xf85) r7 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_MCAST_REPLICAST(r7, 0x10f, 0x86) setsockopt$TIPC_MCAST_BROADCAST(r7, 0x10f, 0x85) r8 = openat$cgroup_ro(r6, &(0x7f00000002c0)='blkio.bfq.io_merged_recursive\x00', 0x0, 0x0) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r8, 0x5760, 0x14) syz_io_uring_setup(0x7950, &(0x7f0000000080)={0x0, 0x2b6b, 0x0, 0x2, 0x270}, &(0x7f0000003000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000140)) (async) syz_io_uring_setup(0x176f, &(0x7f0000000080), &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000140)) (async) syz_io_uring_setup(0x176f, &(0x7f0000000080), &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000140)) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000006, 0x810, r1, 0x10000000) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) (async) syz_io_uring_submit(r0, r4, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, r3, &(0x7f0000000240)={0x80200, 0x85, 0xc}, &(0x7f0000000280)='./file0\x00', 0x18, 0x0, 0x12345}, 0x101) (async) socket$l2tp6(0xa, 0x2, 0x73) (async) syz_io_uring_submit(r0, r2, &(0x7f00000001c0)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, r5, &(0x7f0000000180), 0x0, 0x0, 0x1800, 0x1}, 0x6) (async) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r6, &(0x7f0000000000)="de8138", 0xf85) (async) socket$tipc(0x1e, 0x5, 0x0) (async) setsockopt$TIPC_MCAST_REPLICAST(r7, 0x10f, 0x86) (async) setsockopt$TIPC_MCAST_BROADCAST(r7, 0x10f, 0x85) (async) openat$cgroup_ro(r6, &(0x7f00000002c0)='blkio.bfq.io_merged_recursive\x00', 0x0, 0x0) (async) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r8, 0x5760, 0x14) (async) 15:29:44 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000080)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e5420b2358e493a25dda7864e211a32352c7543d0595067779215e5ddb226e9f6a49290fdcfeebf3cd02524093e9aad873f72c4aa8c6e6b1422be53daedd12bad60fab93e033a075f", 0x66) 15:29:44 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r0) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r0) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) 15:29:44 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) socketpair(0xa, 0x6, 0x6, &(0x7f0000000080)={0xffffffffffffffff}) sendto$l2tp(r1, &(0x7f00000000c0)="d293365a932d1b259442f1f0f34238f49c3e639ead91f9b5e56086eed7e9e3e4f03a8890b884f2f1f64ebd6f0af87ca2f7d73e6b313e577bef1f92a9215747cc608471fad058cb75fddf91c061d9685ba40fd9c7c0f5d022cf4a0b82e62edd3b36856c0c214fe2c84fab8f2cee4497a7d7f4b69b0914806618b13f5048d7be84560d2878c0c228767d0f57ecb638f1", 0x8f, 0xff11aa5ac56e3abb, 0x0, 0x0) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) socketpair(0xa, 0x6, 0x6, &(0x7f0000000080)) (async) sendto$l2tp(r1, &(0x7f00000000c0)="d293365a932d1b259442f1f0f34238f49c3e639ead91f9b5e56086eed7e9e3e4f03a8890b884f2f1f64ebd6f0af87ca2f7d73e6b313e577bef1f92a9215747cc608471fad058cb75fddf91c061d9685ba40fd9c7c0f5d022cf4a0b82e62edd3b36856c0c214fe2c84fab8f2cee4497a7d7f4b69b0914806618b13f5048d7be84560d2878c0c228767d0f57ecb638f1", 0x8f, 0xff11aa5ac56e3abb, 0x0, 0x0) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) 15:29:44 executing program 3: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(0xffffffffffffffff, &(0x7f00000000c0)="00ab7c7a6f", 0x5) r0 = socket$l2tp6(0xa, 0x2, 0x73) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) 15:29:44 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x101000) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x1, 0x3}) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) semget(0x3, 0x2, 0x200) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) write$qrtrtun(r1, &(0x7f0000000100)="1be4a8d92bc61d0878fb481e4097d0967f8f900ddc0bfe650d98af03395cb44ebdc6119febbb6a5f14752e70a4ed69877d90ffc5678cd05b6b79ba6cebc7c927a3c7d05c2f9d25f898309ad6967721f97e2c8f80bbb51d", 0x57) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000300)={&(0x7f0000000200)={0xe4, 0x0, 0x330, 0x70bd28, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x2eb70813, 0x72}}}}, [@NL80211_ATTR_REKEY_DATA={0x44, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="e14c6239a899725c3fb0535b74d09c3a9ef014f9990c4d923fe4c5f2c6991ac4"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="5c066873aa9a6e98ec9878a6151903663468962b9c933423"}]}, @NL80211_ATTR_REKEY_DATA={0x80, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x200}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="0890ca4eeb27b7a8dfafad724997cc1a"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="70530f394448eb2eb12bd06794079c9e"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="46c594453bdf537d2cf798e4aab100b2"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="03367b3ff79e10674d2c1df87e10d0a9cf49470580f415adadc82704e0a16a96"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x400}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4fb41bc8b18101aa"}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x22040000}, 0x4c140) 15:29:44 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) write$qrtrtun(r0, &(0x7f0000000080)="9debfa67ab34345e168773976879ff89a27b515caca7e23c8b7742338bf37d49cc52f288de5f5b941d20a2f318885f4ec08ddcfbc01896113c67e5d9d3770dcbf2f8bb823e9f54b36b01a01825a6cbd04649b206f39b99539e19b5a9601f49bb3a1903ed1b2a4d372476faeaf76c3dc9588d6e2b0747f2b61df7ac636becf6194899e4f8fe085a0a225bcae415bc05", 0x8f) 15:29:44 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) 15:29:44 executing program 5: socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffff8, 0xa941) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:44 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) write$qrtrtun(r0, &(0x7f0000000080)="9debfa67ab34345e168773976879ff89a27b515caca7e23c8b7742338bf37d49cc52f288de5f5b941d20a2f318885f4ec08ddcfbc01896113c67e5d9d3770dcbf2f8bb823e9f54b36b01a01825a6cbd04649b206f39b99539e19b5a9601f49bb3a1903ed1b2a4d372476faeaf76c3dc9588d6e2b0747f2b61df7ac636becf6194899e4f8fe085a0a225bcae415bc05", 0x8f) 15:29:44 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) 15:29:44 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x101000) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x1, 0x3}) (async) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) semget(0x3, 0x2, 0x200) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) write$qrtrtun(r1, &(0x7f0000000100)="1be4a8d92bc61d0878fb481e4097d0967f8f900ddc0bfe650d98af03395cb44ebdc6119febbb6a5f14752e70a4ed69877d90ffc5678cd05b6b79ba6cebc7c927a3c7d05c2f9d25f898309ad6967721f97e2c8f80bbb51d", 0x57) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000300)={&(0x7f0000000200)={0xe4, 0x0, 0x330, 0x70bd28, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x2eb70813, 0x72}}}}, [@NL80211_ATTR_REKEY_DATA={0x44, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="e14c6239a899725c3fb0535b74d09c3a9ef014f9990c4d923fe4c5f2c6991ac4"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="5c066873aa9a6e98ec9878a6151903663468962b9c933423"}]}, @NL80211_ATTR_REKEY_DATA={0x80, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x200}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="0890ca4eeb27b7a8dfafad724997cc1a"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="70530f394448eb2eb12bd06794079c9e"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="46c594453bdf537d2cf798e4aab100b2"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="03367b3ff79e10674d2c1df87e10d0a9cf49470580f415adadc82704e0a16a96"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x400}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4fb41bc8b18101aa"}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x22040000}, 0x4c140) 15:29:44 executing program 5: socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffff8, 0xa941) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_open_dev$vcsa(&(0x7f0000000040), 0xffff8, 0xa941) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) 15:29:44 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) socketpair(0xa, 0x6, 0x6, &(0x7f0000000080)={0xffffffffffffffff}) sendto$l2tp(r1, &(0x7f00000000c0)="d293365a932d1b259442f1f0f34238f49c3e639ead91f9b5e56086eed7e9e3e4f03a8890b884f2f1f64ebd6f0af87ca2f7d73e6b313e577bef1f92a9215747cc608471fad058cb75fddf91c061d9685ba40fd9c7c0f5d022cf4a0b82e62edd3b36856c0c214fe2c84fab8f2cee4497a7d7f4b69b0914806618b13f5048d7be84560d2878c0c228767d0f57ecb638f1", 0x8f, 0xff11aa5ac56e3abb, 0x0, 0x0) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) socketpair(0xa, 0x6, 0x6, &(0x7f0000000080)) (async) sendto$l2tp(r1, &(0x7f00000000c0)="d293365a932d1b259442f1f0f34238f49c3e639ead91f9b5e56086eed7e9e3e4f03a8890b884f2f1f64ebd6f0af87ca2f7d73e6b313e577bef1f92a9215747cc608471fad058cb75fddf91c061d9685ba40fd9c7c0f5d022cf4a0b82e62edd3b36856c0c214fe2c84fab8f2cee4497a7d7f4b69b0914806618b13f5048d7be84560d2878c0c228767d0f57ecb638f1", 0x8f, 0xff11aa5ac56e3abb, 0x0, 0x0) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) 15:29:44 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r0) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000000080)={0x10}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000000)={0x3}) 15:29:44 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) 15:29:44 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x101000) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x1, 0x3}) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) semget(0x3, 0x2, 0x200) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) write$qrtrtun(r1, &(0x7f0000000100)="1be4a8d92bc61d0878fb481e4097d0967f8f900ddc0bfe650d98af03395cb44ebdc6119febbb6a5f14752e70a4ed69877d90ffc5678cd05b6b79ba6cebc7c927a3c7d05c2f9d25f898309ad6967721f97e2c8f80bbb51d", 0x57) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000300)={&(0x7f0000000200)={0xe4, 0x0, 0x330, 0x70bd28, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x2eb70813, 0x72}}}}, [@NL80211_ATTR_REKEY_DATA={0x44, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="e14c6239a899725c3fb0535b74d09c3a9ef014f9990c4d923fe4c5f2c6991ac4"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="5c066873aa9a6e98ec9878a6151903663468962b9c933423"}]}, @NL80211_ATTR_REKEY_DATA={0x80, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x200}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="0890ca4eeb27b7a8dfafad724997cc1a"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="70530f394448eb2eb12bd06794079c9e"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="46c594453bdf537d2cf798e4aab100b2"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="03367b3ff79e10674d2c1df87e10d0a9cf49470580f415adadc82704e0a16a96"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x400}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4fb41bc8b18101aa"}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x22040000}, 0x4c140) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x101000) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x1, 0x3}) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) semget(0x3, 0x2, 0x200) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) write$qrtrtun(r1, &(0x7f0000000100)="1be4a8d92bc61d0878fb481e4097d0967f8f900ddc0bfe650d98af03395cb44ebdc6119febbb6a5f14752e70a4ed69877d90ffc5678cd05b6b79ba6cebc7c927a3c7d05c2f9d25f898309ad6967721f97e2c8f80bbb51d", 0x57) (async) pipe2$watch_queue(&(0x7f0000000080), 0x80) (async) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000300)={&(0x7f0000000200)={0xe4, 0x0, 0x330, 0x70bd28, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x2eb70813, 0x72}}}}, [@NL80211_ATTR_REKEY_DATA={0x44, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="e14c6239a899725c3fb0535b74d09c3a9ef014f9990c4d923fe4c5f2c6991ac4"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="5c066873aa9a6e98ec9878a6151903663468962b9c933423"}]}, @NL80211_ATTR_REKEY_DATA={0x80, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x200}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="0890ca4eeb27b7a8dfafad724997cc1a"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="70530f394448eb2eb12bd06794079c9e"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="46c594453bdf537d2cf798e4aab100b2"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="03367b3ff79e10674d2c1df87e10d0a9cf49470580f415adadc82704e0a16a96"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x400}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4fb41bc8b18101aa"}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x22040000}, 0x4c140) (async) 15:29:44 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), 0xffffffffffffffff) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r2, 0x233}, 0x1c}}, 0x0) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000880)={0x24, r2, 0x4, 0x0, 0x0, {{}, {}, {0xffffffffffffff7e, 0x2, 0xfffffffc}}}, 0x24}}, 0x8010) r4 = openat$cgroup_ro(r0, &(0x7f0000000100)='freezer.self_freezing\x00', 0x0, 0x0) sendmsg$L2TP_CMD_NOOP(r4, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000002c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="240069a5e55395000000000000002f306ae356246058000000000000", @ANYRES16=0x0, @ANYBLOB="80012cbd70250000000006000e003d1f000006001d00020000098508a06b907f3b94daa65e5d6448c4cfe6f1c7490055743e6bef84427c0fc024e6303c7af4b151c3555c218f7828ef7b98a8d8f231b233458885404ac9f87335fd3bf37ed689e576e2784fff2cf991ab44cc650fb9010000805f03d03b169b7fe31f21d52c90ea8bb2ff0d7eb9cdde1e911bee55608ab227d26cb82f3bdcce637e32605ed82acf2dbebb92b39fad1d50197003cf444066e4454048255705f0ceb02eea683275f48acaec93204b0d43cdc18f84e95b74cf234c0a5c5a000000502bc621fba0584fc3802c9cfbd1cb01b4b57be9c3a0d15c590e780888a5a785efa91c48c5e2a2cd46af6dbf2b9c8f5e0e5fc495cdf16422fd6bdee2ac5de0e8d8f3d1b82fa05c73b42cefd3b0a22262648e463bbfc7be2d6f99c9fa35c69891743c0000000000000000"], 0x24}, 0x1, 0x0, 0x0, 0x2004}, 0x2004c840) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r0) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) r5 = openat$cgroup(r0, &(0x7f0000000280)='syz0\x00', 0x200002, 0x0) openat$cgroup_ro(r5, &(0x7f00000003c0)='cgroup.kill\x00', 0x0, 0x0) 15:29:44 executing program 5: socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffff8, 0xa941) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:44 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r0) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000000080)={0x10}) (async) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000000)={0x3}) 15:29:44 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f0000000080)={0x3}) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) openat$qrtrtun(0xffffffffffffff9c, &(0x7f00000000c0), 0x28702) 15:29:44 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x488845) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b60000800300800000481e5782d9617c40", 0xfffffffffffffe05) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f0000000240)={{0x9, 0x1}, 'port0\x00', 0x1, 0x4049c, 0x1, 0x3ff, 0x1, 0x6d, 0x1000, 0x0, 0x6, 0x4}) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000180)=0x0) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x48000) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) write$qrtrtun(r0, &(0x7f0000000500)="accf32b9a6c4e486ce94740341707dd0d7c012eb8faba31e4c45a9304f01e8943e52070000000b56ca595a12e31535e41affdcf8f74174a9a2c8b0948d1a401b4e6c838609dd74c00ed126e8f15059da451e35429706e687cc6a0fc31194c2f3f715bcc1adbd9cf301223014d193cbcc2c2a45b44a739201dbe540dee18139b353e3ed8a9c959833386e608b3f797bb66ee1d15cef9bd4a26b52bbbf24635aa446a781b25cb3654042a8fc4c0054829d15e62c7dab312688218a6b65487926ca78726ac2ceb5c7f66489a6250dddf1dc1d388736993d23a347e7db873a7581a2a4c23e3172d0bbe52032735cba62bf6092d157da0b099568ba1996c571f69b4fc4e25525772d8b3fefd919b3ef82255d3b5688ce9cf1108c8ae80760879f3a99d9ac42c8ba375385114ca0bad1e6e7a11605a23f1f6c869dfd8d07b75c78fdd4758c", 0x1d8934c5) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x101040) r4 = openat$cgroup_ro(r0, &(0x7f00000001c0)='blkio.bfq.idle_time\x00', 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r5, 0x10000000) read$qrtrtun(r5, &(0x7f0000000340)=""/223, 0xdf) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r3, 0xc0a85352, &(0x7f00000000c0)={{0x8}, 'port1\x00', 0x0, 0x120c02, 0x1, 0x80000000, 0x3, 0x81, 0x2, 0x0, 0x2, 0x8}) ioctl$TIOCGSID(r5, 0x5429, &(0x7f0000000200)=0x0) pipe2$9p(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}, 0x100080) kcmp$KCMP_EPOLL_TFD(r1, r6, 0x7, r0, &(0x7f0000000480)={r4, r7, 0x80000001}) 15:29:44 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), 0xffffffffffffffff) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r2, 0x233}, 0x1c}}, 0x0) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000880)={0x24, r2, 0x4, 0x0, 0x0, {{}, {}, {0xffffffffffffff7e, 0x2, 0xfffffffc}}}, 0x24}}, 0x8010) r4 = openat$cgroup_ro(r0, &(0x7f0000000100)='freezer.self_freezing\x00', 0x0, 0x0) sendmsg$L2TP_CMD_NOOP(r4, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000002c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="240069a5e55395000000000000002f306ae356246058000000000000", @ANYRES16=0x0, @ANYBLOB="80012cbd70250000000006000e003d1f000006001d00020000098508a06b907f3b94daa65e5d6448c4cfe6f1c7490055743e6bef84427c0fc024e6303c7af4b151c3555c218f7828ef7b98a8d8f231b233458885404ac9f87335fd3bf37ed689e576e2784fff2cf991ab44cc650fb9010000805f03d03b169b7fe31f21d52c90ea8bb2ff0d7eb9cdde1e911bee55608ab227d26cb82f3bdcce637e32605ed82acf2dbebb92b39fad1d50197003cf444066e4454048255705f0ceb02eea683275f48acaec93204b0d43cdc18f84e95b74cf234c0a5c5a000000502bc621fba0584fc3802c9cfbd1cb01b4b57be9c3a0d15c590e780888a5a785efa91c48c5e2a2cd46af6dbf2b9c8f5e0e5fc495cdf16422fd6bdee2ac5de0e8d8f3d1b82fa05c73b42cefd3b0a22262648e463bbfc7be2d6f99c9fa35c69891743c0000000000000000"], 0x24}, 0x1, 0x0, 0x0, 0x2004}, 0x2004c840) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r0) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) r5 = openat$cgroup(r0, &(0x7f0000000280)='syz0\x00', 0x200002, 0x0) openat$cgroup_ro(r5, &(0x7f00000003c0)='cgroup.kill\x00', 0x0, 0x0) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), 0xffffffffffffffff) (async) syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$TIPC_CMD_SHOW_STATS(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r2, 0x233}, 0x1c}}, 0x0) (async) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000880)={0x24, r2, 0x4, 0x0, 0x0, {{}, {}, {0xffffffffffffff7e, 0x2, 0xfffffffc}}}, 0x24}}, 0x8010) (async) openat$cgroup_ro(r0, &(0x7f0000000100)='freezer.self_freezing\x00', 0x0, 0x0) (async) sendmsg$L2TP_CMD_NOOP(r4, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000002c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="240069a5e55395000000000000002f306ae356246058000000000000", @ANYRES16=0x0, @ANYBLOB="80012cbd70250000000006000e003d1f000006001d00020000098508a06b907f3b94daa65e5d6448c4cfe6f1c7490055743e6bef84427c0fc024e6303c7af4b151c3555c218f7828ef7b98a8d8f231b233458885404ac9f87335fd3bf37ed689e576e2784fff2cf991ab44cc650fb9010000805f03d03b169b7fe31f21d52c90ea8bb2ff0d7eb9cdde1e911bee55608ab227d26cb82f3bdcce637e32605ed82acf2dbebb92b39fad1d50197003cf444066e4454048255705f0ceb02eea683275f48acaec93204b0d43cdc18f84e95b74cf234c0a5c5a000000502bc621fba0584fc3802c9cfbd1cb01b4b57be9c3a0d15c590e780888a5a785efa91c48c5e2a2cd46af6dbf2b9c8f5e0e5fc495cdf16422fd6bdee2ac5de0e8d8f3d1b82fa05c73b42cefd3b0a22262648e463bbfc7be2d6f99c9fa35c69891743c0000000000000000"], 0x24}, 0x1, 0x0, 0x0, 0x2004}, 0x2004c840) (async) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r0) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) openat$cgroup(r0, &(0x7f0000000280)='syz0\x00', 0x200002, 0x0) (async) openat$cgroup_ro(r5, &(0x7f00000003c0)='cgroup.kill\x00', 0x0, 0x0) (async) 15:29:44 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f00000000c0)) 15:29:44 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), r0) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x40, r2, 0x400, 0x70bd2d, 0x25dfdbfb, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x1}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @multicast2}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={'\x00', '\xff\xff', @broadcast}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000}, 0x14) r3 = openat$cgroup_ro(r0, &(0x7f00000001c0)='cpuacct.usage_sys\x00', 0x0, 0x0) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000240), r0) sendmsg$L2TP_CMD_SESSION_GET(r3, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x24, r4, 0x300, 0x70bd2c, 0x25dfdbfe, {}, [@L2TP_ATTR_IP_DADDR={0x8, 0x19, @dev={0xac, 0x14, 0x14, 0x36}}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x101}]}, 0x24}}, 0x4010) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:44 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f0000000080)={0x3}) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) openat$qrtrtun(0xffffffffffffff9c, &(0x7f00000000c0), 0x28702) 15:29:44 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f00000000c0)) 15:29:44 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), r0) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x40, r2, 0x400, 0x70bd2d, 0x25dfdbfb, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x1}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @multicast2}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={'\x00', '\xff\xff', @broadcast}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000}, 0x14) r3 = openat$cgroup_ro(r0, &(0x7f00000001c0)='cpuacct.usage_sys\x00', 0x0, 0x0) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000240), r0) sendmsg$L2TP_CMD_SESSION_GET(r3, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x24, r4, 0x300, 0x70bd2c, 0x25dfdbfe, {}, [@L2TP_ATTR_IP_DADDR={0x8, 0x19, @dev={0xac, 0x14, 0x14, 0x36}}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x101}]}, 0x24}}, 0x4010) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), r0) (async) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x40, r2, 0x400, 0x70bd2d, 0x25dfdbfb, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x1}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @multicast2}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={'\x00', '\xff\xff', @broadcast}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000}, 0x14) (async) openat$cgroup_ro(r0, &(0x7f00000001c0)='cpuacct.usage_sys\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000240), r0) (async) sendmsg$L2TP_CMD_SESSION_GET(r3, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x24, r4, 0x300, 0x70bd2c, 0x25dfdbfe, {}, [@L2TP_ATTR_IP_DADDR={0x8, 0x19, @dev={0xac, 0x14, 0x14, 0x36}}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x101}]}, 0x24}}, 0x4010) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) 15:29:44 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), 0xffffffffffffffff) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r2, 0x233}, 0x1c}}, 0x0) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000880)={0x24, r2, 0x4, 0x0, 0x0, {{}, {}, {0xffffffffffffff7e, 0x2, 0xfffffffc}}}, 0x24}}, 0x8010) r4 = openat$cgroup_ro(r0, &(0x7f0000000100)='freezer.self_freezing\x00', 0x0, 0x0) sendmsg$L2TP_CMD_NOOP(r4, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000002c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="240069a5e55395000000000000002f306ae356246058000000000000", @ANYRES16=0x0, @ANYBLOB="80012cbd70250000000006000e003d1f000006001d00020000098508a06b907f3b94daa65e5d6448c4cfe6f1c7490055743e6bef84427c0fc024e6303c7af4b151c3555c218f7828ef7b98a8d8f231b233458885404ac9f87335fd3bf37ed689e576e2784fff2cf991ab44cc650fb9010000805f03d03b169b7fe31f21d52c90ea8bb2ff0d7eb9cdde1e911bee55608ab227d26cb82f3bdcce637e32605ed82acf2dbebb92b39fad1d50197003cf444066e4454048255705f0ceb02eea683275f48acaec93204b0d43cdc18f84e95b74cf234c0a5c5a000000502bc621fba0584fc3802c9cfbd1cb01b4b57be9c3a0d15c590e780888a5a785efa91c48c5e2a2cd46af6dbf2b9c8f5e0e5fc495cdf16422fd6bdee2ac5de0e8d8f3d1b82fa05c73b42cefd3b0a22262648e463bbfc7be2d6f99c9fa35c69891743c0000000000000000"], 0x24}, 0x1, 0x0, 0x0, 0x2004}, 0x2004c840) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r0) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) r5 = openat$cgroup(r0, &(0x7f0000000280)='syz0\x00', 0x200002, 0x0) openat$cgroup_ro(r5, &(0x7f00000003c0)='cgroup.kill\x00', 0x0, 0x0) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), 0xffffffffffffffff) (async) syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$TIPC_CMD_SHOW_STATS(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r2, 0x233}, 0x1c}}, 0x0) (async) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000880)={0x24, r2, 0x4, 0x0, 0x0, {{}, {}, {0xffffffffffffff7e, 0x2, 0xfffffffc}}}, 0x24}}, 0x8010) (async) openat$cgroup_ro(r0, &(0x7f0000000100)='freezer.self_freezing\x00', 0x0, 0x0) (async) sendmsg$L2TP_CMD_NOOP(r4, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000002c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="240069a5e55395000000000000002f306ae356246058000000000000", @ANYRES16=0x0, @ANYBLOB="80012cbd70250000000006000e003d1f000006001d00020000098508a06b907f3b94daa65e5d6448c4cfe6f1c7490055743e6bef84427c0fc024e6303c7af4b151c3555c218f7828ef7b98a8d8f231b233458885404ac9f87335fd3bf37ed689e576e2784fff2cf991ab44cc650fb9010000805f03d03b169b7fe31f21d52c90ea8bb2ff0d7eb9cdde1e911bee55608ab227d26cb82f3bdcce637e32605ed82acf2dbebb92b39fad1d50197003cf444066e4454048255705f0ceb02eea683275f48acaec93204b0d43cdc18f84e95b74cf234c0a5c5a000000502bc621fba0584fc3802c9cfbd1cb01b4b57be9c3a0d15c590e780888a5a785efa91c48c5e2a2cd46af6dbf2b9c8f5e0e5fc495cdf16422fd6bdee2ac5de0e8d8f3d1b82fa05c73b42cefd3b0a22262648e463bbfc7be2d6f99c9fa35c69891743c0000000000000000"], 0x24}, 0x1, 0x0, 0x0, 0x2004}, 0x2004c840) (async) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r0) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) openat$cgroup(r0, &(0x7f0000000280)='syz0\x00', 0x200002, 0x0) (async) openat$cgroup_ro(r5, &(0x7f00000003c0)='cgroup.kill\x00', 0x0, 0x0) (async) 15:29:44 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x488845) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b60000800300800000481e5782d9617c40", 0xfffffffffffffe05) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f0000000240)={{0x9, 0x1}, 'port0\x00', 0x1, 0x4049c, 0x1, 0x3ff, 0x1, 0x6d, 0x1000, 0x0, 0x6, 0x4}) (async) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000180)=0x0) (async) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x48000) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) (async) write$qrtrtun(r0, &(0x7f0000000500)="accf32b9a6c4e486ce94740341707dd0d7c012eb8faba31e4c45a9304f01e8943e52070000000b56ca595a12e31535e41affdcf8f74174a9a2c8b0948d1a401b4e6c838609dd74c00ed126e8f15059da451e35429706e687cc6a0fc31194c2f3f715bcc1adbd9cf301223014d193cbcc2c2a45b44a739201dbe540dee18139b353e3ed8a9c959833386e608b3f797bb66ee1d15cef9bd4a26b52bbbf24635aa446a781b25cb3654042a8fc4c0054829d15e62c7dab312688218a6b65487926ca78726ac2ceb5c7f66489a6250dddf1dc1d388736993d23a347e7db873a7581a2a4c23e3172d0bbe52032735cba62bf6092d157da0b099568ba1996c571f69b4fc4e25525772d8b3fefd919b3ef82255d3b5688ce9cf1108c8ae80760879f3a99d9ac42c8ba375385114ca0bad1e6e7a11605a23f1f6c869dfd8d07b75c78fdd4758c", 0x1d8934c5) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x101040) (async) r4 = openat$cgroup_ro(r0, &(0x7f00000001c0)='blkio.bfq.idle_time\x00', 0x0, 0x0) (async) r5 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r5, 0x10000000) (async) read$qrtrtun(r5, &(0x7f0000000340)=""/223, 0xdf) (async) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r3, 0xc0a85352, &(0x7f00000000c0)={{0x8}, 'port1\x00', 0x0, 0x120c02, 0x1, 0x80000000, 0x3, 0x81, 0x2, 0x0, 0x2, 0x8}) (async) ioctl$TIOCGSID(r5, 0x5429, &(0x7f0000000200)=0x0) (async) pipe2$9p(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}, 0x100080) kcmp$KCMP_EPOLL_TFD(r1, r6, 0x7, r0, &(0x7f0000000480)={r4, r7, 0x80000001}) 15:29:44 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r0) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000000080)={0x10}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000000)={0x3}) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r0) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000000080)={0x10}) (async) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000000)={0x3}) (async) 15:29:44 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f00000000c0)) 15:29:44 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x488845) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b60000800300800000481e5782d9617c40", 0xfffffffffffffe05) (async) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f0000000240)={{0x9, 0x1}, 'port0\x00', 0x1, 0x4049c, 0x1, 0x3ff, 0x1, 0x6d, 0x1000, 0x0, 0x6, 0x4}) (async, rerun: 64) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000180)=0x0) (async, rerun: 64) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x48000) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) (async) write$qrtrtun(r0, &(0x7f0000000500)="accf32b9a6c4e486ce94740341707dd0d7c012eb8faba31e4c45a9304f01e8943e52070000000b56ca595a12e31535e41affdcf8f74174a9a2c8b0948d1a401b4e6c838609dd74c00ed126e8f15059da451e35429706e687cc6a0fc31194c2f3f715bcc1adbd9cf301223014d193cbcc2c2a45b44a739201dbe540dee18139b353e3ed8a9c959833386e608b3f797bb66ee1d15cef9bd4a26b52bbbf24635aa446a781b25cb3654042a8fc4c0054829d15e62c7dab312688218a6b65487926ca78726ac2ceb5c7f66489a6250dddf1dc1d388736993d23a347e7db873a7581a2a4c23e3172d0bbe52032735cba62bf6092d157da0b099568ba1996c571f69b4fc4e25525772d8b3fefd919b3ef82255d3b5688ce9cf1108c8ae80760879f3a99d9ac42c8ba375385114ca0bad1e6e7a11605a23f1f6c869dfd8d07b75c78fdd4758c", 0x1d8934c5) (async) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x101040) (async) r4 = openat$cgroup_ro(r0, &(0x7f00000001c0)='blkio.bfq.idle_time\x00', 0x0, 0x0) (async) r5 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r5, 0x10000000) (async) read$qrtrtun(r5, &(0x7f0000000340)=""/223, 0xdf) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r3, 0xc0a85352, &(0x7f00000000c0)={{0x8}, 'port1\x00', 0x0, 0x120c02, 0x1, 0x80000000, 0x3, 0x81, 0x2, 0x0, 0x2, 0x8}) ioctl$TIOCGSID(r5, 0x5429, &(0x7f0000000200)=0x0) pipe2$9p(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}, 0x100080) kcmp$KCMP_EPOLL_TFD(r1, r6, 0x7, r0, &(0x7f0000000480)={r4, r7, 0x80000001}) 15:29:44 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r1, 0x233}, 0x1c}}, 0x0) sendmsg$TIPC_CMD_RESET_LINK_STATS(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x28, r1, 0x20, 0x70bd26, 0x25dfdbfc, {{}, {}, {0xc, 0x14, 'syz1\x00'}}, ["", "", "", "", "", "", ""]}, 0x28}}, 0x4805) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r3, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) kcmp$KCMP_EPOLL_TFD(0x0, 0xffffffffffffffff, 0x7, r3, &(0x7f0000000140)={0xffffffffffffffff, r4, 0x372}) r5 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r5, &(0x7f0000000300)="9f", 0x1) 15:29:44 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), r0) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x40, r2, 0x400, 0x70bd2d, 0x25dfdbfb, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x1}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @multicast2}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={'\x00', '\xff\xff', @broadcast}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000}, 0x14) (async) r3 = openat$cgroup_ro(r0, &(0x7f00000001c0)='cpuacct.usage_sys\x00', 0x0, 0x0) (async) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000240), r0) sendmsg$L2TP_CMD_SESSION_GET(r3, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x24, r4, 0x300, 0x70bd2c, 0x25dfdbfe, {}, [@L2TP_ATTR_IP_DADDR={0x8, 0x19, @dev={0xac, 0x14, 0x14, 0x36}}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x101}]}, 0x24}}, 0x4010) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:44 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f0000000080)={0x3}) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) openat$qrtrtun(0xffffffffffffff9c, &(0x7f00000000c0), 0x28702) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f0000000080)={0x3}) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) openat$qrtrtun(0xffffffffffffff9c, &(0x7f00000000c0), 0x28702) (async) 15:29:44 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) bind$l2tp(r1, &(0x7f0000000080)={0x2, 0x0, @empty}, 0x10) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:44 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r0, &(0x7f0000000080)={0x20000004}) 15:29:45 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r0, &(0x7f0000000080)={0x20000004}) 15:29:45 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r1, 0x233}, 0x1c}}, 0x0) (async) sendmsg$TIPC_CMD_RESET_LINK_STATS(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x28, r1, 0x20, 0x70bd26, 0x25dfdbfc, {{}, {}, {0xc, 0x14, 'syz1\x00'}}, ["", "", "", "", "", "", ""]}, 0x28}}, 0x4805) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r3, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) kcmp$KCMP_EPOLL_TFD(0x0, 0xffffffffffffffff, 0x7, r3, &(0x7f0000000140)={0xffffffffffffffff, r4, 0x372}) r5 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r5, &(0x7f0000000300)="9f", 0x1) 15:29:45 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) syz_io_uring_setup(0x176f, &(0x7f0000000080), &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_WRITE_FIXED={0x5, 0x0, 0x0, @fd_index}, 0x8a86c60) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) r3 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) syz_io_uring_setup(0x844, &(0x7f0000000280)={0x0, 0xb908, 0x20, 0x801, 0x2ed, 0x0, r3}, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r2, 0xc0a85352, &(0x7f00000001c0)={{0x9, 0x2}, 'port0\x00', 0x4, 0x20808, 0x4, 0x7fff, 0xffff8000, 0x400, 0x18, 0x0, 0x0, 0x8}) syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index=0x3, 0x4, 0x0, 0x1, 0x1, 0x1}, 0x400) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) r4 = syz_io_uring_setup(0x74c7, &(0x7f0000000380)={0x0, 0xb4e4, 0x0, 0x0, 0x26e}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000400), &(0x7f0000000440)) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r4, &(0x7f0000000480)={0x2002}) 15:29:45 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) syz_io_uring_setup(0x176f, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x51}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_WRITE_FIXED={0x5, 0x0, 0x0, @fd_index}, 0x8a86c60) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x11, r2, 0x10000000) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r2, 0x40485404, &(0x7f00000001c0)={{0xffffffffffffffff, 0x2, 0x5, 0x2, 0x8}, 0x8, 0x8}) socket$can_raw(0x1d, 0x3, 0x1) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_READ=@pass_buffer={0x16, 0x7, 0x6000, @fd_index=0x6, 0x0, &(0x7f0000000080)=""/231, 0xe7}, 0x3) 15:29:45 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) bind$l2tp(r1, &(0x7f0000000080)={0x2, 0x0, @empty}, 0x10) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:45 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r0, &(0x7f0000000080)={0x20000004}) 15:29:45 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r1, 0x233}, 0x1c}}, 0x0) (async) sendmsg$TIPC_CMD_RESET_LINK_STATS(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x28, r1, 0x20, 0x70bd26, 0x25dfdbfc, {{}, {}, {0xc, 0x14, 'syz1\x00'}}, ["", "", "", "", "", "", ""]}, 0x28}}, 0x4805) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r3, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) kcmp$KCMP_EPOLL_TFD(0x0, 0xffffffffffffffff, 0x7, r3, &(0x7f0000000140)={0xffffffffffffffff, r4, 0x372}) (async) r5 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r5, &(0x7f0000000300)="9f", 0x1) 15:29:45 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async, rerun: 32) syz_io_uring_setup(0x176f, &(0x7f0000000080), &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)) (rerun: 32) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_WRITE_FIXED={0x5, 0x0, 0x0, @fd_index}, 0x8a86c60) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) r3 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) syz_io_uring_setup(0x844, &(0x7f0000000280)={0x0, 0xb908, 0x20, 0x801, 0x2ed, 0x0, r3}, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r2, 0xc0a85352, &(0x7f00000001c0)={{0x9, 0x2}, 'port0\x00', 0x4, 0x20808, 0x4, 0x7fff, 0xffff8000, 0x400, 0x18, 0x0, 0x0, 0x8}) (async, rerun: 64) syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index=0x3, 0x4, 0x0, 0x1, 0x1, 0x1}, 0x400) (async, rerun: 64) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) r4 = syz_io_uring_setup(0x74c7, &(0x7f0000000380)={0x0, 0xb4e4, 0x0, 0x0, 0x26e}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000400), &(0x7f0000000440)) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r4, &(0x7f0000000480)={0x2002}) 15:29:45 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) syz_io_uring_setup(0x176f, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x51}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_WRITE_FIXED={0x5, 0x0, 0x0, @fd_index}, 0x8a86c60) (async) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x11, r2, 0x10000000) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r2, 0x40485404, &(0x7f00000001c0)={{0xffffffffffffffff, 0x2, 0x5, 0x2, 0x8}, 0x8, 0x8}) (async) socket$can_raw(0x1d, 0x3, 0x1) (async) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_READ=@pass_buffer={0x16, 0x7, 0x6000, @fd_index=0x6, 0x0, &(0x7f0000000080)=""/231, 0xe7}, 0x3) 15:29:45 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) bind$l2tp(r1, &(0x7f0000000080)={0x2, 0x0, @empty}, 0x10) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:45 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) ioctl$SNDRV_TIMER_IOCTL_STOP(r0, 0x54a1) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:45 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0xffffc, 0x11b8c1) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:45 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), r1) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_RESET_LINK_STATS(r1, &(0x7f0000000180)={&(0x7f0000000080), 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x28, r2, 0x10, 0x70bd28, 0x25dfdbff, {{}, {}, {0xc, 0x14, 'syz1\x00'}}, ["", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x20004084}, 0x40010) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:45 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0xffffc, 0x11b8c1) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:45 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) r1 = inotify_add_watch(r0, &(0x7f0000000080)='./file0\x00', 0x4) inotify_rm_watch(r0, r1) 15:29:45 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) ioctl$SNDRV_TIMER_IOCTL_STOP(r0, 0x54a1) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:45 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) syz_io_uring_setup(0x176f, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x51}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_WRITE_FIXED={0x5, 0x0, 0x0, @fd_index}, 0x8a86c60) (async) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x11, r2, 0x10000000) (async) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r2, 0x40485404, &(0x7f00000001c0)={{0xffffffffffffffff, 0x2, 0x5, 0x2, 0x8}, 0x8, 0x8}) (async) socket$can_raw(0x1d, 0x3, 0x1) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_READ=@pass_buffer={0x16, 0x7, 0x6000, @fd_index=0x6, 0x0, &(0x7f0000000080)=""/231, 0xe7}, 0x3) 15:29:45 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) r1 = inotify_add_watch(r0, &(0x7f0000000080)='./file0\x00', 0x4) inotify_rm_watch(r0, r1) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) inotify_add_watch(r0, &(0x7f0000000080)='./file0\x00', 0x4) (async) inotify_rm_watch(r0, r1) (async) 15:29:45 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), r1) (async) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_RESET_LINK_STATS(r1, &(0x7f0000000180)={&(0x7f0000000080), 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x28, r2, 0x10, 0x70bd28, 0x25dfdbff, {{}, {}, {0xc, 0x14, 'syz1\x00'}}, ["", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x20004084}, 0x40010) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:45 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) syz_io_uring_setup(0x176f, &(0x7f0000000080), &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_WRITE_FIXED={0x5, 0x0, 0x0, @fd_index}, 0x8a86c60) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) r3 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) syz_io_uring_setup(0x844, &(0x7f0000000280)={0x0, 0xb908, 0x20, 0x801, 0x2ed, 0x0, r3}, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000000300), &(0x7f0000000340)) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r2, 0xc0a85352, &(0x7f00000001c0)={{0x9, 0x2}, 'port0\x00', 0x4, 0x20808, 0x4, 0x7fff, 0xffff8000, 0x400, 0x18, 0x0, 0x0, 0x8}) syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index=0x3, 0x4, 0x0, 0x1, 0x1, 0x1}, 0x400) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) r4 = syz_io_uring_setup(0x74c7, &(0x7f0000000380)={0x0, 0xb4e4, 0x0, 0x0, 0x26e}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000400), &(0x7f0000000440)) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r4, &(0x7f0000000480)={0x2002}) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) syz_io_uring_setup(0x176f, &(0x7f0000000080), &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000140)) (async) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_WRITE_FIXED={0x5, 0x0, 0x0, @fd_index}, 0x8a86c60) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) (async) syz_io_uring_setup(0x844, &(0x7f0000000280)={0x0, 0xb908, 0x20, 0x801, 0x2ed, 0x0, r3}, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000000300), &(0x7f0000000340)) (async) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r2, 0xc0a85352, &(0x7f00000001c0)={{0x9, 0x2}, 'port0\x00', 0x4, 0x20808, 0x4, 0x7fff, 0xffff8000, 0x400, 0x18, 0x0, 0x0, 0x8}) (async) syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index=0x3, 0x4, 0x0, 0x1, 0x1, 0x1}, 0x400) (async) write$qrtrtun(r0, &(0x7f0000000000)="de813892e28fa1c5fec3ebfa57de4badba8f2751b231b1f722b4fc3d462e54", 0x1f) (async) syz_io_uring_setup(0x74c7, &(0x7f0000000380)={0x0, 0xb4e4, 0x0, 0x0, 0x26e}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000400), &(0x7f0000000440)) (async) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r4, &(0x7f0000000480)={0x2002}) (async) 15:29:45 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0xffffc, 0x11b8c1) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:45 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) sendmsg$L2TP_CMD_TUNNEL_DELETE(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x68, 0x0, 0x300, 0x70bd28, 0x25dfdbfe, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x79}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e20}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @private1}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0xb}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @private=0xa010102}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, 0x68}, 0x1, 0x0, 0x0, 0x20000004}, 0x4048000) 15:29:45 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) ioctl$SNDRV_TIMER_IOCTL_STOP(r0, 0x54a1) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) ioctl$SNDRV_TIMER_IOCTL_STOP(r0, 0x54a1) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) 15:29:45 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) r1 = inotify_add_watch(r0, &(0x7f0000000080)='./file0\x00', 0x4) inotify_rm_watch(r0, r1) 15:29:45 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), r1) (async) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_RESET_LINK_STATS(r1, &(0x7f0000000180)={&(0x7f0000000080), 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x28, r2, 0x10, 0x70bd28, 0x25dfdbff, {{}, {}, {0xc, 0x14, 'syz1\x00'}}, ["", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x20004084}, 0x40010) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:45 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) sendmsg$L2TP_CMD_TUNNEL_DELETE(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x68, 0x0, 0x300, 0x70bd28, 0x25dfdbfe, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x79}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e20}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @private1}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0xb}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @private=0xa010102}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, 0x68}, 0x1, 0x0, 0x0, 0x20000004}, 0x4048000) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) pipe2$watch_queue(&(0x7f0000000080), 0x80) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x68, 0x0, 0x300, 0x70bd28, 0x25dfdbfe, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x79}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e20}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @private1}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0xb}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @private=0xa010102}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, 0x68}, 0x1, 0x0, 0x0, 0x20000004}, 0x4048000) (async) 15:29:45 executing program 3: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) socketpair(0x27, 0x0, 0x1000, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), r0) sendmsg$L2TP_CMD_SESSION_MODIFY(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r1, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8004}, 0x4000000) 15:29:45 executing program 3: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) socketpair(0x27, 0x0, 0x1000, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), r0) sendmsg$L2TP_CMD_SESSION_MODIFY(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r1, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8004}, 0x4000000) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) socketpair(0x27, 0x0, 0x1000, &(0x7f0000000000)) (async) syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), r0) (async) sendmsg$L2TP_CMD_SESSION_MODIFY(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r1, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8004}, 0x4000000) (async) 15:29:45 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) sendmsg$L2TP_CMD_TUNNEL_DELETE(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x68, 0x0, 0x300, 0x70bd28, 0x25dfdbfe, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x79}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e20}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @private1}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0xb}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @private=0xa010102}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, 0x68}, 0x1, 0x0, 0x0, 0x20000004}, 0x4048000) 15:29:45 executing program 1: ioctl$SNDRV_TIMER_IOCTL_CONTINUE(0xffffffffffffffff, 0x54a2) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000080)) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:45 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = syz_open_dev$vcsa(&(0x7f0000000080), 0x0, 0x14000) ioctl$SNDRV_TIMER_IOCTL_GINFO(r1, 0xc0f85403, &(0x7f00000000c0)={{0x9387177bb2127fe8, 0x2, 0x8, 0x1, 0x4}, 0xffffff7f, 0xf0b, 'id0\x00', 'timer1\x00', 0x0, 0x9, 0x8, 0x0, 0x5}) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:45 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) 15:29:45 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="096310400200000908000000000087e6a616855f"], 0x11, 0x0, &(0x7f00000000c0)="bd07a046db83cd3db3820424346a750987"}) 15:29:45 executing program 1: ioctl$SNDRV_TIMER_IOCTL_CONTINUE(0xffffffffffffffff, 0x54a2) (async) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000080)) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:45 executing program 3: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) socketpair(0x27, 0x0, 0x1000, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), r0) sendmsg$L2TP_CMD_SESSION_MODIFY(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r1, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8004}, 0x4000000) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) socketpair(0x27, 0x0, 0x1000, &(0x7f0000000000)) (async) syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), r0) (async) sendmsg$L2TP_CMD_SESSION_MODIFY(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r1, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8004}, 0x4000000) (async) 15:29:45 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) r1 = syz_open_dev$vcsa(&(0x7f0000000080), 0x0, 0x14000) ioctl$SNDRV_TIMER_IOCTL_GINFO(r1, 0xc0f85403, &(0x7f00000000c0)={{0x9387177bb2127fe8, 0x2, 0x8, 0x1, 0x4}, 0xffffff7f, 0xf0b, 'id0\x00', 'timer1\x00', 0x0, 0x9, 0x8, 0x0, 0x5}) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:45 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:45 executing program 5: setsockopt$TIPC_GROUP_LEAVE(0xffffffffffffffff, 0x10f, 0x88) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)="de8138", 0xf85) 15:29:45 executing program 1: ioctl$SNDRV_TIMER_IOCTL_CONTINUE(0xffffffffffffffff, 0x54a2) (async) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000080)) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:45 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="096310400200000908000000000087e6a616855f"], 0x11, 0x0, &(0x7f00000000c0)="bd07a046db83cd3db3820424346a750987"}) 15:29:45 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = syz_open_dev$vcsa(&(0x7f0000000080), 0x0, 0x14000) ioctl$SNDRV_TIMER_IOCTL_GINFO(r1, 0xc0f85403, &(0x7f00000000c0)={{0x9387177bb2127fe8, 0x2, 0x8, 0x1, 0x4}, 0xffffff7f, 0xf0b, 'id0\x00', 'timer1\x00', 0x0, 0x9, 0x8, 0x0, 0x5}) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:45 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) inotify_add_watch(r1, &(0x7f0000000100)='./file0\x00', 0x24000280) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x3, 0xfffffff8, 0x3, 0xac0, r0, 0x5, '\x00', 0x0, r0, 0x3, 0x1, 0x0, 0x6}, 0x48) r4 = syz_open_dev$vcsa(&(0x7f00000001c0), 0xa8, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@bloom_filter={0x1e, 0xd0c1, 0x5, 0x8, 0x40, r0, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x2, 0x5, 0x9}, 0x48) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@bloom_filter={0x1e, 0x5, 0x0, 0x4, 0x100, r0, 0x689, '\x00', 0x0, r0, 0x8, 0x0, 0x1, 0x3}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000400)={0x6, 0xb, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000ff0f0000000000000800000085000000570000001827000046225efafb8804000000625ec3a723e2cd7192ba191e1029cc0eb1eea8fb71b2338c3b1affe402ecc2505e1b9755680900bf5fbb7c9c2d7691fa9de20db34b4b69c29bbaf4b8602cdcdd6b67ff0f15bcf69d7c69286d365a99ea45278506af69e88eb106b797789bbd5dc67480ed9ebd45e492985e1d4a83", @ANYRES32=r2, @ANYBLOB="00000000ffffffff185a000007000000000000000000000018170000", @ANYRES32=r3, @ANYBLOB="00010000868af2f9658494917b40f0c9980950475dde00"], &(0x7f0000000000)='syzkaller\x00', 0x2e6, 0x35, &(0x7f0000000180)=""/53, 0x41100, 0x9, '\x00', 0x0, 0x25, r4, 0x8, &(0x7f0000000200)={0x5, 0x4}, 0x8, 0x10, &(0x7f0000000240)={0x2, 0x4, 0x1, 0x8}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[r5, r6, r0]}, 0x80) 15:29:45 executing program 5: setsockopt$TIPC_GROUP_LEAVE(0xffffffffffffffff, 0x10f, 0x88) (async) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)="de8138", 0xf85) 15:29:45 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="096310400200000908000000000087e6a616855f"], 0x11, 0x0, &(0x7f00000000c0)="bd07a046db83cd3db3820424346a750987"}) 15:29:45 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:45 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10010, r1, 0x10000000) openat$cgroup_freezer_state(r1, &(0x7f0000000080), 0x2, 0x0) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:45 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) syz_open_dev$vcsa(&(0x7f0000000100), 0x4, 0x117200) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs2/custom0\x00', 0x2, 0x0) mmap$binder(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x3) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r3, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r3, &(0x7f0000000180)={0x60000000}) write$tcp_mem(r2, &(0x7f0000000080)={0xd7, 0x20, 0xb86, 0x20, 0x8}, 0x48) 15:29:45 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:45 executing program 5: setsockopt$TIPC_GROUP_LEAVE(0xffffffffffffffff, 0x10f, 0x88) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)="de8138", 0xf85) 15:29:45 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) inotify_add_watch(r1, &(0x7f0000000100)='./file0\x00', 0x24000280) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x3, 0xfffffff8, 0x3, 0xac0, r0, 0x5, '\x00', 0x0, r0, 0x3, 0x1, 0x0, 0x6}, 0x48) r4 = syz_open_dev$vcsa(&(0x7f00000001c0), 0xa8, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@bloom_filter={0x1e, 0xd0c1, 0x5, 0x8, 0x40, r0, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x2, 0x5, 0x9}, 0x48) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@bloom_filter={0x1e, 0x5, 0x0, 0x4, 0x100, r0, 0x689, '\x00', 0x0, r0, 0x8, 0x0, 0x1, 0x3}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000400)={0x6, 0xb, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000ff0f0000000000000800000085000000570000001827000046225efafb8804000000625ec3a723e2cd7192ba191e1029cc0eb1eea8fb71b2338c3b1affe402ecc2505e1b9755680900bf5fbb7c9c2d7691fa9de20db34b4b69c29bbaf4b8602cdcdd6b67ff0f15bcf69d7c69286d365a99ea45278506af69e88eb106b797789bbd5dc67480ed9ebd45e492985e1d4a83", @ANYRES32=r2, @ANYBLOB="00000000ffffffff185a000007000000000000000000000018170000", @ANYRES32=r3, @ANYBLOB="00010000868af2f9658494917b40f0c9980950475dde00"], &(0x7f0000000000)='syzkaller\x00', 0x2e6, 0x35, &(0x7f0000000180)=""/53, 0x41100, 0x9, '\x00', 0x0, 0x25, r4, 0x8, &(0x7f0000000200)={0x5, 0x4}, 0x8, 0x10, &(0x7f0000000240)={0x2, 0x4, 0x1, 0x8}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[r5, r6, r0]}, 0x80) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) inotify_add_watch(r1, &(0x7f0000000100)='./file0\x00', 0x24000280) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x3, 0xfffffff8, 0x3, 0xac0, r0, 0x5, '\x00', 0x0, r0, 0x3, 0x1, 0x0, 0x6}, 0x48) (async) syz_open_dev$vcsa(&(0x7f00000001c0), 0xa8, 0x0) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@bloom_filter={0x1e, 0xd0c1, 0x5, 0x8, 0x40, r0, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x2, 0x5, 0x9}, 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@bloom_filter={0x1e, 0x5, 0x0, 0x4, 0x100, r0, 0x689, '\x00', 0x0, r0, 0x8, 0x0, 0x1, 0x3}, 0x48) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000400)={0x6, 0xb, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000ff0f0000000000000800000085000000570000001827000046225efafb8804000000625ec3a723e2cd7192ba191e1029cc0eb1eea8fb71b2338c3b1affe402ecc2505e1b9755680900bf5fbb7c9c2d7691fa9de20db34b4b69c29bbaf4b8602cdcdd6b67ff0f15bcf69d7c69286d365a99ea45278506af69e88eb106b797789bbd5dc67480ed9ebd45e492985e1d4a83", @ANYRES32=r2, @ANYBLOB="00000000ffffffff185a000007000000000000000000000018170000", @ANYRES32=r3, @ANYBLOB="00010000868af2f9658494917b40f0c9980950475dde00"], &(0x7f0000000000)='syzkaller\x00', 0x2e6, 0x35, &(0x7f0000000180)=""/53, 0x41100, 0x9, '\x00', 0x0, 0x25, r4, 0x8, &(0x7f0000000200)={0x5, 0x4}, 0x8, 0x10, &(0x7f0000000240)={0x2, 0x4, 0x1, 0x8}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[r5, r6, r0]}, 0x80) (async) 15:29:45 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10010, r1, 0x10000000) openat$cgroup_freezer_state(r1, &(0x7f0000000080), 0x2, 0x0) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10010, r1, 0x10000000) (async) openat$cgroup_freezer_state(r1, &(0x7f0000000080), 0x2, 0x0) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) 15:29:45 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r3, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r1, &(0x7f0000000100)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000340)={0x27c, r3, 0x200, 0x70bd29, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x2, 0x64}}}}, [@NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="8f370d49ede57338a0d33cb3ba3e8870bd6bf2dc77eaa192"}]}, @NL80211_ATTR_REKEY_DATA={0x10, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "833f304f20e17de7"}]}, @NL80211_ATTR_REKEY_DATA={0x78, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2b3}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="736df3b1cf3523ac2d15d7ed824100e3"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="1a5ba127a6f8ca247997da736f901cc6e3e2b4e445d94882"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x1}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "e86ca2244964ecd0"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "89e46e0e547ae925"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "fe750fa41cd5de52"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x401}]}, @NL80211_ATTR_REKEY_DATA={0x4c, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="60245cb89eef98085cbcc1323c84a3737bf48b43b3f8e35e"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="3ddb63199f759134f72d8589529a8d85b2c5a252a78ec330f1fce485ae42ad59"}]}, @NL80211_ATTR_REKEY_DATA={0x94, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xf8000}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="6dd37c4d6f109a15a7b45984a359c2bc"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="e12067820ba9c13eba82c448e92cd1ec"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="63ec6cd6945ee64bba198643bf5aef20422596de2b01fd606f763c095e9e6c41"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="9c687643dbaa9cb84684c8b351ecc9e926d45171e40dc98e7e56576e430b7b70"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "be101c7f50d1ed3b"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4ceb93e0f1f967ec"}]}, @NL80211_ATTR_REKEY_DATA={0x64, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="6a415c0aa0ddeb8c28c8bd42c1effdbf"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "d119b9fcd5fb0340"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3f}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="8dd741e004428f56a3e810789bc0b3c3"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="72ab31f5c037d59f2c032756aca1655cb1793303b205a60c"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x6}]}, @NL80211_ATTR_REKEY_DATA={0x70, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="498fc8581e0d07d2e88e04a6a86be115705978eeb6b480621b8a049d15bc09f9"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xc21f}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="51c2c8f2185bac26bbc452a108fa7c3a"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x81}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="07dc8897cdf15afa31baa647bf6595ddfeb22a836c45308dbd718c3a09617636"}]}]}, 0x27c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000180), r0) sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f0000000600)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000005c0)={&(0x7f00000002c0)={0x38, r4, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0xfd}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x7}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x4}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 15:29:45 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) syz_open_dev$vcsa(&(0x7f0000000100), 0x4, 0x117200) (async) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs2/custom0\x00', 0x2, 0x0) mmap$binder(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x3) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r3, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r3, &(0x7f0000000180)={0x60000000}) (async) write$tcp_mem(r2, &(0x7f0000000080)={0xd7, 0x20, 0xb86, 0x20, 0x8}, 0x48) 15:29:45 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r3, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}}, 0x0) (async) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r1, &(0x7f0000000100)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000340)={0x27c, r3, 0x200, 0x70bd29, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x2, 0x64}}}}, [@NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="8f370d49ede57338a0d33cb3ba3e8870bd6bf2dc77eaa192"}]}, @NL80211_ATTR_REKEY_DATA={0x10, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "833f304f20e17de7"}]}, @NL80211_ATTR_REKEY_DATA={0x78, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2b3}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="736df3b1cf3523ac2d15d7ed824100e3"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="1a5ba127a6f8ca247997da736f901cc6e3e2b4e445d94882"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x1}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "e86ca2244964ecd0"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "89e46e0e547ae925"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "fe750fa41cd5de52"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x401}]}, @NL80211_ATTR_REKEY_DATA={0x4c, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="60245cb89eef98085cbcc1323c84a3737bf48b43b3f8e35e"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="3ddb63199f759134f72d8589529a8d85b2c5a252a78ec330f1fce485ae42ad59"}]}, @NL80211_ATTR_REKEY_DATA={0x94, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xf8000}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="6dd37c4d6f109a15a7b45984a359c2bc"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="e12067820ba9c13eba82c448e92cd1ec"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="63ec6cd6945ee64bba198643bf5aef20422596de2b01fd606f763c095e9e6c41"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="9c687643dbaa9cb84684c8b351ecc9e926d45171e40dc98e7e56576e430b7b70"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "be101c7f50d1ed3b"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4ceb93e0f1f967ec"}]}, @NL80211_ATTR_REKEY_DATA={0x64, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="6a415c0aa0ddeb8c28c8bd42c1effdbf"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "d119b9fcd5fb0340"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3f}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="8dd741e004428f56a3e810789bc0b3c3"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="72ab31f5c037d59f2c032756aca1655cb1793303b205a60c"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x6}]}, @NL80211_ATTR_REKEY_DATA={0x70, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="498fc8581e0d07d2e88e04a6a86be115705978eeb6b480621b8a049d15bc09f9"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xc21f}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="51c2c8f2185bac26bbc452a108fa7c3a"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x81}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="07dc8897cdf15afa31baa647bf6595ddfeb22a836c45308dbd718c3a09617636"}]}]}, 0x27c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000180), r0) sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f0000000600)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000005c0)={&(0x7f00000002c0)={0x38, r4, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0xfd}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x7}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x4}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 15:29:45 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) ioctl$SNDRV_TIMER_IOCTL_TREAD(r1, 0x40045402, &(0x7f0000000080)=0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:45 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) 15:29:45 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async, rerun: 64) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (rerun: 64) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async, rerun: 32) inotify_add_watch(r1, &(0x7f0000000100)='./file0\x00', 0x24000280) (rerun: 32) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async, rerun: 64) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (rerun: 64) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) (async) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x3, 0xfffffff8, 0x3, 0xac0, r0, 0x5, '\x00', 0x0, r0, 0x3, 0x1, 0x0, 0x6}, 0x48) (async) r4 = syz_open_dev$vcsa(&(0x7f00000001c0), 0xa8, 0x0) (async, rerun: 32) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@bloom_filter={0x1e, 0xd0c1, 0x5, 0x8, 0x40, r0, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x2, 0x5, 0x9}, 0x48) (rerun: 32) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@bloom_filter={0x1e, 0x5, 0x0, 0x4, 0x100, r0, 0x689, '\x00', 0x0, r0, 0x8, 0x0, 0x1, 0x3}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000400)={0x6, 0xb, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000ff0f0000000000000800000085000000570000001827000046225efafb8804000000625ec3a723e2cd7192ba191e1029cc0eb1eea8fb71b2338c3b1affe402ecc2505e1b9755680900bf5fbb7c9c2d7691fa9de20db34b4b69c29bbaf4b8602cdcdd6b67ff0f15bcf69d7c69286d365a99ea45278506af69e88eb106b797789bbd5dc67480ed9ebd45e492985e1d4a83", @ANYRES32=r2, @ANYBLOB="00000000ffffffff185a000007000000000000000000000018170000", @ANYRES32=r3, @ANYBLOB="00010000868af2f9658494917b40f0c9980950475dde00"], &(0x7f0000000000)='syzkaller\x00', 0x2e6, 0x35, &(0x7f0000000180)=""/53, 0x41100, 0x9, '\x00', 0x0, 0x25, r4, 0x8, &(0x7f0000000200)={0x5, 0x4}, 0x8, 0x10, &(0x7f0000000240)={0x2, 0x4, 0x1, 0x8}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[r5, r6, r0]}, 0x80) 15:29:45 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10010, r1, 0x10000000) (async) openat$cgroup_freezer_state(r1, &(0x7f0000000080), 0x2, 0x0) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:45 executing program 4: write$qrtrtun(0xffffffffffffffff, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) 15:29:45 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) syz_open_dev$vcsa(&(0x7f0000000100), 0x4, 0x117200) (async) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs2/custom0\x00', 0x2, 0x0) mmap$binder(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x3) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r3, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r3, &(0x7f0000000180)={0x60000000}) (async) write$tcp_mem(r2, &(0x7f0000000080)={0xd7, 0x20, 0xb86, 0x20, 0x8}, 0x48) 15:29:45 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) ioctl$SNDRV_TIMER_IOCTL_TREAD(r1, 0x40045402, &(0x7f0000000080)=0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) ioctl$SNDRV_TIMER_IOCTL_TREAD(r1, 0x40045402, &(0x7f0000000080)=0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) 15:29:45 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async, rerun: 64) r1 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r3, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r1, &(0x7f0000000100)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000340)={0x27c, r3, 0x200, 0x70bd29, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x2, 0x64}}}}, [@NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="8f370d49ede57338a0d33cb3ba3e8870bd6bf2dc77eaa192"}]}, @NL80211_ATTR_REKEY_DATA={0x10, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "833f304f20e17de7"}]}, @NL80211_ATTR_REKEY_DATA={0x78, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2b3}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="736df3b1cf3523ac2d15d7ed824100e3"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="1a5ba127a6f8ca247997da736f901cc6e3e2b4e445d94882"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x1}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "e86ca2244964ecd0"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "89e46e0e547ae925"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "fe750fa41cd5de52"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x401}]}, @NL80211_ATTR_REKEY_DATA={0x4c, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="60245cb89eef98085cbcc1323c84a3737bf48b43b3f8e35e"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="3ddb63199f759134f72d8589529a8d85b2c5a252a78ec330f1fce485ae42ad59"}]}, @NL80211_ATTR_REKEY_DATA={0x94, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xf8000}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="6dd37c4d6f109a15a7b45984a359c2bc"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="e12067820ba9c13eba82c448e92cd1ec"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="63ec6cd6945ee64bba198643bf5aef20422596de2b01fd606f763c095e9e6c41"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="9c687643dbaa9cb84684c8b351ecc9e926d45171e40dc98e7e56576e430b7b70"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "be101c7f50d1ed3b"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4ceb93e0f1f967ec"}]}, @NL80211_ATTR_REKEY_DATA={0x64, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="6a415c0aa0ddeb8c28c8bd42c1effdbf"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "d119b9fcd5fb0340"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3f}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="8dd741e004428f56a3e810789bc0b3c3"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="72ab31f5c037d59f2c032756aca1655cb1793303b205a60c"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x6}]}, @NL80211_ATTR_REKEY_DATA={0x70, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="498fc8581e0d07d2e88e04a6a86be115705978eeb6b480621b8a049d15bc09f9"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xc21f}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="51c2c8f2185bac26bbc452a108fa7c3a"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x81}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="07dc8897cdf15afa31baa647bf6595ddfeb22a836c45308dbd718c3a09617636"}]}]}, 0x27c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000180), r0) sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f0000000600)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000005c0)={&(0x7f00000002c0)={0x38, r4, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0xfd}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x7}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x4}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 15:29:45 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0xffffc, 0x682c41) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000040), 0x101000) socketpair(0x27, 0x4, 0x7ffb, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000000), 0x4f4, 0x4000) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r2, 0x233}, 0x1c}}, 0x0) sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x68, r2, 0x2, 0x70bd25, 0x25dfdbfe, {{}, {}, {0x4c, 0x18, {0x5, @media='ib\x00'}}}, ["", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x40010}, 0xc080) write$qrtrtun(r0, &(0x7f00000000c0)="a6aa229e59e59170a28b943e50733204ffffff7f00000000ec0900000000000000e4ed2c1251cb56eae058106f8131131e9c42ebefadb461193d1cb0b46519ef1908ff726712f37d2529620000000000000000000000000000000000000000306fd10a1e9d4f8ba45d8445f4bafea94a50ca504f13ec53cbd1038414a4df54513372361362b1c60d6620876228369018afe35b70450ba5b2d01737c3d4314876c20fc41a55c1000159d32e01cddc86e4cbe2bb42ac6e200a82d6408968ea2532a4d9c42edcc1f6d1bdcb325216db8674793fe1e56f8df33d81635d9a924f28c75be7c27699e6039b33e20c5dfc56f929297f5cb25e47bdbb041538669fc3b504c8c7a750d15e8c4cd62c8909a2b402ecda47ebda4dcad117464142990400f9d3e16b84563ef4fb059a2d5eda8d706f6b446d09dd9feec965a72930d0b977f9ccbfb9c9631fdec3", 0x147) socketpair(0x21, 0x3, 0x4, &(0x7f0000000400)={0xffffffffffffffff}) r5 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r5, 0x233}, 0x1c}}, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f0000000500)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x34, r5, 0x1, 0x70bd29, 0x25dfdbfc, {{}, {}, {0x18, 0x17, {0x1e, 0x80000001, @udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x84}, 0x8000) 15:29:45 executing program 4: write$qrtrtun(0xffffffffffffffff, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) 15:29:45 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x408c43) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x10000000) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000000080)) write$qrtrtun(r0, &(0x7f00000000c0)="bc8990258f229e13ffd6e3f09d18614d0ddd3e6be09aa2714e328502c63a17a71dab53638e86204cb636908b4071952732be37b04a7b137a0faaa969cd51a90ee299fd7fa8b100"/80, 0x50) 15:29:45 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:45 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:45 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) ioctl$SNDRV_TIMER_IOCTL_TREAD(r1, 0x40045402, &(0x7f0000000080)=0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) ioctl$SNDRV_TIMER_IOCTL_TREAD(r1, 0x40045402, &(0x7f0000000080)=0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) 15:29:45 executing program 4: write$qrtrtun(0xffffffffffffffff, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) 15:29:45 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x408c43) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x10000000) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000000080)) write$qrtrtun(r0, &(0x7f00000000c0)="bc8990258f229e13ffd6e3f09d18614d0ddd3e6be09aa2714e328502c63a17a71dab53638e86204cb636908b4071952732be37b04a7b137a0faaa969cd51a90ee299fd7fa8b100"/80, 0x50) 15:29:45 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) pipe2$9p(&(0x7f0000000080), 0x80000) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:45 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0xffffc, 0x682c41) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000040), 0x101000) socketpair(0x27, 0x4, 0x7ffb, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) syz_open_dev$vcsa(&(0x7f0000000000), 0x4f4, 0x4000) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r2, 0x233}, 0x1c}}, 0x0) sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x68, r2, 0x2, 0x70bd25, 0x25dfdbfe, {{}, {}, {0x4c, 0x18, {0x5, @media='ib\x00'}}}, ["", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x40010}, 0xc080) write$qrtrtun(r0, &(0x7f00000000c0)="a6aa229e59e59170a28b943e50733204ffffff7f00000000ec0900000000000000e4ed2c1251cb56eae058106f8131131e9c42ebefadb461193d1cb0b46519ef1908ff726712f37d2529620000000000000000000000000000000000000000306fd10a1e9d4f8ba45d8445f4bafea94a50ca504f13ec53cbd1038414a4df54513372361362b1c60d6620876228369018afe35b70450ba5b2d01737c3d4314876c20fc41a55c1000159d32e01cddc86e4cbe2bb42ac6e200a82d6408968ea2532a4d9c42edcc1f6d1bdcb325216db8674793fe1e56f8df33d81635d9a924f28c75be7c27699e6039b33e20c5dfc56f929297f5cb25e47bdbb041538669fc3b504c8c7a750d15e8c4cd62c8909a2b402ecda47ebda4dcad117464142990400f9d3e16b84563ef4fb059a2d5eda8d706f6b446d09dd9feec965a72930d0b977f9ccbfb9c9631fdec3", 0x147) socketpair(0x21, 0x3, 0x4, &(0x7f0000000400)={0xffffffffffffffff}) r5 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r5, 0x233}, 0x1c}}, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f0000000500)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x34, r5, 0x1, 0x70bd29, 0x25dfdbfc, {{}, {}, {0x18, 0x17, {0x1e, 0x80000001, @udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x84}, 0x8000) syz_open_dev$vcsa(&(0x7f0000000080), 0xffffc, 0x682c41) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000040), 0x101000) (async) socketpair(0x27, 0x4, 0x7ffb, &(0x7f00000003c0)) (async) syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) (async) syz_open_dev$vcsa(&(0x7f0000000000), 0x4f4, 0x4000) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$TIPC_CMD_SHOW_STATS(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r2, 0x233}, 0x1c}}, 0x0) (async) sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x68, r2, 0x2, 0x70bd25, 0x25dfdbfe, {{}, {}, {0x4c, 0x18, {0x5, @media='ib\x00'}}}, ["", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x40010}, 0xc080) (async) write$qrtrtun(r0, &(0x7f00000000c0)="a6aa229e59e59170a28b943e50733204ffffff7f00000000ec0900000000000000e4ed2c1251cb56eae058106f8131131e9c42ebefadb461193d1cb0b46519ef1908ff726712f37d2529620000000000000000000000000000000000000000306fd10a1e9d4f8ba45d8445f4bafea94a50ca504f13ec53cbd1038414a4df54513372361362b1c60d6620876228369018afe35b70450ba5b2d01737c3d4314876c20fc41a55c1000159d32e01cddc86e4cbe2bb42ac6e200a82d6408968ea2532a4d9c42edcc1f6d1bdcb325216db8674793fe1e56f8df33d81635d9a924f28c75be7c27699e6039b33e20c5dfc56f929297f5cb25e47bdbb041538669fc3b504c8c7a750d15e8c4cd62c8909a2b402ecda47ebda4dcad117464142990400f9d3e16b84563ef4fb059a2d5eda8d706f6b446d09dd9feec965a72930d0b977f9ccbfb9c9631fdec3", 0x147) (async) socketpair(0x21, 0x3, 0x4, &(0x7f0000000400)) (async) syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r5, 0x233}, 0x1c}}, 0x0) (async) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f0000000500)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x34, r5, 0x1, 0x70bd29, 0x25dfdbfc, {{}, {}, {0x18, 0x17, {0x1e, 0x80000001, @udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x84}, 0x8000) (async) 15:29:45 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:45 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) pipe2$9p(&(0x7f0000000080), 0x80000) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:45 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(0xffffffffffffffff, 0x40046210, &(0x7f0000000080)=0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:45 executing program 4: r0 = syz_open_dev$vcsa(0x0, 0xffffb, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) 15:29:45 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x408c43) (async) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x10000000) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000000080)) (async) write$qrtrtun(r0, &(0x7f00000000c0)="bc8990258f229e13ffd6e3f09d18614d0ddd3e6be09aa2714e328502c63a17a71dab53638e86204cb636908b4071952732be37b04a7b137a0faaa969cd51a90ee299fd7fa8b100"/80, 0x50) 15:29:45 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) pipe2$9p(&(0x7f0000000080), 0x80000) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:45 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x10000000) connect$l2tp(r0, &(0x7f0000000000)={0x2, 0x0, @private=0xa010102, 0x4}, 0x10) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r1, &(0x7f0000000300)="9f", 0x1) 15:29:45 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(0xffffffffffffffff, 0x40046210, &(0x7f0000000080)=0x1) (async, rerun: 32) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (rerun: 32) 15:29:45 executing program 4: r0 = syz_open_dev$vcsa(0x0, 0xffffb, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) 15:29:45 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0xffffc, 0x682c41) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000040), 0x101000) (async) socketpair(0x27, 0x4, 0x7ffb, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) (async) syz_open_dev$vcsa(&(0x7f0000000000), 0x4f4, 0x4000) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r2, 0x233}, 0x1c}}, 0x0) (async) sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x68, r2, 0x2, 0x70bd25, 0x25dfdbfe, {{}, {}, {0x4c, 0x18, {0x5, @media='ib\x00'}}}, ["", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x40010}, 0xc080) (async, rerun: 64) write$qrtrtun(r0, &(0x7f00000000c0)="a6aa229e59e59170a28b943e50733204ffffff7f00000000ec0900000000000000e4ed2c1251cb56eae058106f8131131e9c42ebefadb461193d1cb0b46519ef1908ff726712f37d2529620000000000000000000000000000000000000000306fd10a1e9d4f8ba45d8445f4bafea94a50ca504f13ec53cbd1038414a4df54513372361362b1c60d6620876228369018afe35b70450ba5b2d01737c3d4314876c20fc41a55c1000159d32e01cddc86e4cbe2bb42ac6e200a82d6408968ea2532a4d9c42edcc1f6d1bdcb325216db8674793fe1e56f8df33d81635d9a924f28c75be7c27699e6039b33e20c5dfc56f929297f5cb25e47bdbb041538669fc3b504c8c7a750d15e8c4cd62c8909a2b402ecda47ebda4dcad117464142990400f9d3e16b84563ef4fb059a2d5eda8d706f6b446d09dd9feec965a72930d0b977f9ccbfb9c9631fdec3", 0x147) (async, rerun: 64) socketpair(0x21, 0x3, 0x4, &(0x7f0000000400)={0xffffffffffffffff}) (async) r5 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r5, 0x233}, 0x1c}}, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f0000000500)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x34, r5, 0x1, 0x70bd29, 0x25dfdbfc, {{}, {}, {0x18, 0x17, {0x1e, 0x80000001, @udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x84}, 0x8000) 15:29:45 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x10000000) connect$l2tp(r0, &(0x7f0000000000)={0x2, 0x0, @private=0xa010102, 0x4}, 0x10) (async) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r1, &(0x7f0000000300)="9f", 0x1) 15:29:45 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x80, 0x0, &(0x7f00000001c0)=[@increfs_done={0x40106308, 0x1}, @enter_looper, @clear_death={0x400c630f, 0x1}, @decrefs={0x40046307, 0x2}, @enter_looper, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000100)={@fda={0x66646185, 0x1, 0x0, 0x8}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000080)=""/80, 0x50, 0x0, 0x27}}, &(0x7f0000000180)={0x0, 0x20, 0x38}}, 0x1000}], 0xce, 0x0, &(0x7f0000000340)="e1da6fc664f3aa60e7e8dc41290bdd4d2313373c3c16a0a084e8a35dad6b2524a0277e2650666dd63e0438806600f759b5e4d7d024fffc42c950a34664ca87d325ed8ce4b3d76f4ad0ba9afe405e5358ba5eb3c9df80e95ed2a9fddda468094a49837ef952cab5d9303055928f3e91423da7f464b9c16c97cd97a833cd30286845ce658ded6905b1fa401fcfdba65d07844c328b936c1468e93a87f6cfd84d59f9f816fdfab9b85ae2c0ed8be22e0ae103333d443d078337a4a9928df2e59dc7b497c4e5bce2043c1846ff837b82"}) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:45 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = inotify_init1(0x80800) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000080)={0x80000007}) pipe2$watch_queue(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) sendmsg$L2TP_CMD_SESSION_CREATE(r2, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000440)={&(0x7f0000000540)=ANY=[@ANYBLOB="3409003c00d51268015dfb0c29e626dbd64af200", @ANYRES16=0x0, @ANYBLOB="00032abd7000ffdbdf2505000000080011000100000008000c000300000006000300000000000800090001000000"], 0x34}, 0x1, 0x0, 0x0, 0x4000004}, 0x20000010) epoll_wait(r2, &(0x7f0000000100)=[{}, {}, {}, {}, {}, {}], 0x6, 0x5) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000200)) r3 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) getsockopt$MRT(r3, 0x0, 0xcf, &(0x7f00000004c0), &(0x7f0000000500)=0x4) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r4, 0x10000000) ioctl$TIOCGSID(r0, 0x5429, &(0x7f00000000c0)) r5 = getpid() kcmp$KCMP_EPOLL_TFD(0x0, r5, 0x7, 0xffffffffffffffff, 0x0) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom0\x00', 0x0, 0x0) ioctl$BINDER_GET_FROZEN_INFO(r6, 0xc00c620f, &(0x7f0000000380)={r5}) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) syz_io_uring_setup(0x497b, &(0x7f0000000240)={0x0, 0xbe5e, 0x0, 0xffffffff, 0x3a0, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f00000002c0), &(0x7f0000000340)) 15:29:45 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="00f4ff", 0x3) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), r2) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r3, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2fb6ca0f97df2acd}]}, 0x1c}}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan3\x00', 0x0}) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x38, r3, 0x300, 0x70bd29, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}]}, 0x38}}, 0x40) read$qrtrtun(r1, &(0x7f0000000080)=""/168, 0xa8) 15:29:45 executing program 4: r0 = syz_open_dev$vcsa(0x0, 0xffffb, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) 15:29:45 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x10000000) connect$l2tp(r0, &(0x7f0000000000)={0x2, 0x0, @private=0xa010102, 0x4}, 0x10) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r1, &(0x7f0000000300)="9f", 0x1) 15:29:45 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(0xffffffffffffffff, 0x40046210, &(0x7f0000000080)=0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:45 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="00f4ff", 0x3) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), r2) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r3, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2fb6ca0f97df2acd}]}, 0x1c}}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan3\x00', 0x0}) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x38, r3, 0x300, 0x70bd29, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}]}, 0x38}}, 0x40) (async) read$qrtrtun(r1, &(0x7f0000000080)=""/168, 0xa8) 15:29:45 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x80, 0x0, &(0x7f00000001c0)=[@increfs_done={0x40106308, 0x1}, @enter_looper, @clear_death={0x400c630f, 0x1}, @decrefs={0x40046307, 0x2}, @enter_looper, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000100)={@fda={0x66646185, 0x1, 0x0, 0x8}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000080)=""/80, 0x50, 0x0, 0x27}}, &(0x7f0000000180)={0x0, 0x20, 0x38}}, 0x1000}], 0xce, 0x0, &(0x7f0000000340)="e1da6fc664f3aa60e7e8dc41290bdd4d2313373c3c16a0a084e8a35dad6b2524a0277e2650666dd63e0438806600f759b5e4d7d024fffc42c950a34664ca87d325ed8ce4b3d76f4ad0ba9afe405e5358ba5eb3c9df80e95ed2a9fddda468094a49837ef952cab5d9303055928f3e91423da7f464b9c16c97cd97a833cd30286845ce658ded6905b1fa401fcfdba65d07844c328b936c1468e93a87f6cfd84d59f9f816fdfab9b85ae2c0ed8be22e0ae103333d443d078337a4a9928df2e59dc7b497c4e5bce2043c1846ff837b82"}) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:45 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) pkey_alloc(0x0, 0x2) 15:29:45 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) 15:29:45 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x80, 0x0, &(0x7f00000001c0)=[@increfs_done={0x40106308, 0x1}, @enter_looper, @clear_death={0x400c630f, 0x1}, @decrefs={0x40046307, 0x2}, @enter_looper, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000100)={@fda={0x66646185, 0x1, 0x0, 0x8}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000080)=""/80, 0x50, 0x0, 0x27}}, &(0x7f0000000180)={0x0, 0x20, 0x38}}, 0x1000}], 0xce, 0x0, &(0x7f0000000340)="e1da6fc664f3aa60e7e8dc41290bdd4d2313373c3c16a0a084e8a35dad6b2524a0277e2650666dd63e0438806600f759b5e4d7d024fffc42c950a34664ca87d325ed8ce4b3d76f4ad0ba9afe405e5358ba5eb3c9df80e95ed2a9fddda468094a49837ef952cab5d9303055928f3e91423da7f464b9c16c97cd97a833cd30286845ce658ded6905b1fa401fcfdba65d07844c328b936c1468e93a87f6cfd84d59f9f816fdfab9b85ae2c0ed8be22e0ae103333d443d078337a4a9928df2e59dc7b497c4e5bce2043c1846ff837b82"}) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x80, 0x0, &(0x7f00000001c0)=[@increfs_done={0x40106308, 0x1}, @enter_looper, @clear_death={0x400c630f, 0x1}, @decrefs={0x40046307, 0x2}, @enter_looper, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000100)={@fda={0x66646185, 0x1, 0x0, 0x8}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000080)=""/80, 0x50, 0x0, 0x27}}, &(0x7f0000000180)={0x0, 0x20, 0x38}}, 0x1000}], 0xce, 0x0, &(0x7f0000000340)="e1da6fc664f3aa60e7e8dc41290bdd4d2313373c3c16a0a084e8a35dad6b2524a0277e2650666dd63e0438806600f759b5e4d7d024fffc42c950a34664ca87d325ed8ce4b3d76f4ad0ba9afe405e5358ba5eb3c9df80e95ed2a9fddda468094a49837ef952cab5d9303055928f3e91423da7f464b9c16c97cd97a833cd30286845ce658ded6905b1fa401fcfdba65d07844c328b936c1468e93a87f6cfd84d59f9f816fdfab9b85ae2c0ed8be22e0ae103333d443d078337a4a9928df2e59dc7b497c4e5bce2043c1846ff837b82"}) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) 15:29:45 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = inotify_init1(0x80800) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000080)={0x80000007}) pipe2$watch_queue(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) sendmsg$L2TP_CMD_SESSION_CREATE(r2, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000440)={&(0x7f0000000540)=ANY=[@ANYBLOB="3409003c00d51268015dfb0c29e626dbd64af200", @ANYRES16=0x0, @ANYBLOB="00032abd7000ffdbdf2505000000080011000100000008000c000300000006000300000000000800090001000000"], 0x34}, 0x1, 0x0, 0x0, 0x4000004}, 0x20000010) epoll_wait(r2, &(0x7f0000000100)=[{}, {}, {}, {}, {}, {}], 0x6, 0x5) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000200)) r3 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) getsockopt$MRT(r3, 0x0, 0xcf, &(0x7f00000004c0), &(0x7f0000000500)=0x4) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r4, 0x10000000) ioctl$TIOCGSID(r0, 0x5429, &(0x7f00000000c0)) r5 = getpid() kcmp$KCMP_EPOLL_TFD(0x0, r5, 0x7, 0xffffffffffffffff, 0x0) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom0\x00', 0x0, 0x0) ioctl$BINDER_GET_FROZEN_INFO(r6, 0xc00c620f, &(0x7f0000000380)={r5}) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) syz_io_uring_setup(0x497b, &(0x7f0000000240)={0x0, 0xbe5e, 0x0, 0xffffffff, 0x3a0, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f00000002c0), &(0x7f0000000340)) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) inotify_init1(0x80800) (async) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000080)={0x80000007}) (async) pipe2$watch_queue(&(0x7f0000000180), 0x80) (async) sendmsg$L2TP_CMD_SESSION_CREATE(r2, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000440)={&(0x7f0000000540)=ANY=[@ANYBLOB="3409003c00d51268015dfb0c29e626dbd64af200", @ANYRES16=0x0, @ANYBLOB="00032abd7000ffdbdf2505000000080011000100000008000c000300000006000300000000000800090001000000"], 0x34}, 0x1, 0x0, 0x0, 0x4000004}, 0x20000010) (async) epoll_wait(r2, &(0x7f0000000100)=[{}, {}, {}, {}, {}, {}], 0x6, 0x5) (async) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000200)) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) (async) getsockopt$MRT(r3, 0x0, 0xcf, &(0x7f00000004c0), &(0x7f0000000500)=0x4) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r4, 0x10000000) (async) ioctl$TIOCGSID(r0, 0x5429, &(0x7f00000000c0)) (async) getpid() (async) kcmp$KCMP_EPOLL_TFD(0x0, r5, 0x7, 0xffffffffffffffff, 0x0) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom0\x00', 0x0, 0x0) (async) ioctl$BINDER_GET_FROZEN_INFO(r6, 0xc00c620f, &(0x7f0000000380)={r5}) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) syz_io_uring_setup(0x497b, &(0x7f0000000240)={0x0, 0xbe5e, 0x0, 0xffffffff, 0x3a0, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f00000002c0), &(0x7f0000000340)) (async) 15:29:45 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="00f4ff", 0x3) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), r2) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r3, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2fb6ca0f97df2acd}]}, 0x1c}}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan3\x00', 0x0}) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x38, r3, 0x300, 0x70bd29, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}]}, 0x38}}, 0x40) read$qrtrtun(r1, &(0x7f0000000080)=""/168, 0xa8) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="00f4ff", 0x3) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), r2) (async) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r3, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2fb6ca0f97df2acd}]}, 0x1c}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan3\x00'}) (async) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x38, r3, 0x300, 0x70bd29, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}]}, 0x38}}, 0x40) (async) read$qrtrtun(r1, &(0x7f0000000080)=""/168, 0xa8) (async) 15:29:45 executing program 5: r0 = semget(0x0, 0x1, 0x621) semop(r0, &(0x7f0000000000)=[{0x3, 0x3f, 0x800}, {0x1, 0x7, 0x800}, {0x3, 0x4, 0x1000}, {0x4, 0x4, 0x1000}, {0x3, 0x4, 0x1800}, {0x2, 0x8, 0x1000}, {0x3, 0x0, 0x800}], 0x7) semop(r0, &(0x7f0000000080)=[{0x8c516a1ba673ce51, 0x4}, {0x0, 0x20, 0x1000}, {0x1, 0x2, 0x1800}], 0x3) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r1, &(0x7f0000000000)="de8138", 0xf85) 15:29:45 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) pkey_alloc(0x0, 0x2) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) pkey_alloc(0x0, 0x2) (async) 15:29:45 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) 15:29:45 executing program 5: r0 = semget(0x0, 0x1, 0x621) semop(r0, &(0x7f0000000000)=[{0x3, 0x3f, 0x800}, {0x1, 0x7, 0x800}, {0x3, 0x4, 0x1000}, {0x4, 0x4, 0x1000}, {0x3, 0x4, 0x1800}, {0x2, 0x8, 0x1000}, {0x3, 0x0, 0x800}], 0x7) semop(r0, &(0x7f0000000080)=[{0x8c516a1ba673ce51, 0x4}, {0x0, 0x20, 0x1000}, {0x1, 0x2, 0x1800}], 0x3) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r1, &(0x7f0000000000)="de8138", 0xf85) 15:29:45 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0xa841) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000100)) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) socketpair(0x25, 0x80000, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$MRT_ADD_VIF(r1, 0x0, 0xca, &(0x7f00000000c0)={0x0, 0x4, 0x7, 0x10000, @vifc_lcl_addr=@multicast1, @private=0xa010101}, 0x10) 15:29:45 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0x2b883106, 0x3a8c1) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000040)='ns/mnt\x00') bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x2, 0x9, 0x9, 0x2, 0x202, r0, 0x0, '\x00', 0x0, r0, 0x1, 0x5, 0x2}, 0x48) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:45 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) 15:29:45 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = inotify_init1(0x80800) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000080)={0x80000007}) (async) pipe2$watch_queue(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) sendmsg$L2TP_CMD_SESSION_CREATE(r2, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000440)={&(0x7f0000000540)=ANY=[@ANYBLOB="3409003c00d51268015dfb0c29e626dbd64af200", @ANYRES16=0x0, @ANYBLOB="00032abd7000ffdbdf2505000000080011000100000008000c000300000006000300000000000800090001000000"], 0x34}, 0x1, 0x0, 0x0, 0x4000004}, 0x20000010) (async, rerun: 32) epoll_wait(r2, &(0x7f0000000100)=[{}, {}, {}, {}, {}, {}], 0x6, 0x5) (async, rerun: 32) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000200)) (async) r3 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) (async) getsockopt$MRT(r3, 0x0, 0xcf, &(0x7f00000004c0), &(0x7f0000000500)=0x4) (async, rerun: 32) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (rerun: 32) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r4, 0x10000000) (async) ioctl$TIOCGSID(r0, 0x5429, &(0x7f00000000c0)) (async) r5 = getpid() kcmp$KCMP_EPOLL_TFD(0x0, r5, 0x7, 0xffffffffffffffff, 0x0) (async) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom0\x00', 0x0, 0x0) ioctl$BINDER_GET_FROZEN_INFO(r6, 0xc00c620f, &(0x7f0000000380)={r5}) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) syz_io_uring_setup(0x497b, &(0x7f0000000240)={0x0, 0xbe5e, 0x0, 0xffffffff, 0x3a0, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f00000002c0), &(0x7f0000000340)) 15:29:45 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) pkey_alloc(0x0, 0x2) 15:29:45 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0xa841) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000100)) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) socketpair(0x25, 0x80000, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$MRT_ADD_VIF(r1, 0x0, 0xca, &(0x7f00000000c0)={0x0, 0x4, 0x7, 0x10000, @vifc_lcl_addr=@multicast1, @private=0xa010101}, 0x10) 15:29:45 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0x0) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) 15:29:45 executing program 3: pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f0000000140)={&(0x7f0000000080), 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="3800000048650dd5294d3da664d74ce6a1e3cba3ffbfd59d022e9af9aa1be82c1d74861310b76d13189163ecb0446e98ccc270479f075f1b1b0596fca996e327bc558ec986d66edd77d5da867bae5cb984ae6dda7b3e4b93", @ANYRES16=0x0, @ANYBLOB="000025bd7000fbdbdf25010000000000000001410000001c00170000001b000000816574683a697036677265746170300000"], 0x38}, 0x1, 0x0, 0x0, 0xc94}, 0x20040051) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) pipe2$watch_queue(&(0x7f0000000180), 0x80) write$qrtrtun(r1, &(0x7f0000000300)="9f", 0x1) sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, 0x0, 0x4, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_FD={0x8, 0x17, @udp=r0}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8001}, 0x40) 15:29:45 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0x2b883106, 0x3a8c1) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000040)='ns/mnt\x00') bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x2, 0x9, 0x9, 0x2, 0x202, r0, 0x0, '\x00', 0x0, r0, 0x1, 0x5, 0x2}, 0x48) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) syz_open_dev$vcsa(&(0x7f0000000080), 0x2b883106, 0x3a8c1) (async) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000040)='ns/mnt\x00') (async) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x2, 0x9, 0x9, 0x2, 0x202, r0, 0x0, '\x00', 0x0, r0, 0x1, 0x5, 0x2}, 0x48) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) 15:29:45 executing program 5: r0 = semget(0x0, 0x1, 0x621) semop(r0, &(0x7f0000000000)=[{0x3, 0x3f, 0x800}, {0x1, 0x7, 0x800}, {0x3, 0x4, 0x1000}, {0x4, 0x4, 0x1000}, {0x3, 0x4, 0x1800}, {0x2, 0x8, 0x1000}, {0x3, 0x0, 0x800}], 0x7) semop(r0, &(0x7f0000000080)=[{0x8c516a1ba673ce51, 0x4}, {0x0, 0x20, 0x1000}, {0x1, 0x2, 0x1800}], 0x3) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r1, &(0x7f0000000000)="de8138", 0xf85) 15:29:45 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0xa841) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000100)) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) socketpair(0x25, 0x80000, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$MRT_ADD_VIF(r1, 0x0, 0xca, &(0x7f00000000c0)={0x0, 0x4, 0x7, 0x10000, @vifc_lcl_addr=@multicast1, @private=0xa010101}, 0x10) 15:29:45 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0xfff, 0x4200) write$qrtrtun(r0, &(0x7f00000000c0)="f7d70266b8b60fca1c478515da026f8679e585384895da1ba0f2cca423340fda604d4c7f27f5d5a38fbaed059c421fa47899aa1656c236584dbe5ed028a2da397eefb65aad2ccf3f137097b1a6943c1e88b00b87680409", 0xfffffffffffffe03) write$tcp_congestion(0xffffffffffffffff, &(0x7f0000000000)='reno\x00', 0x5) 15:29:45 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x9b64e572376812c3) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r2, 0x233}, 0x1c}}, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x34, r2, 0x8, 0x70bd26, 0x25dfdbfc, {{}, {}, {0x18, 0x17, {0xc, 0x6, @l2={'eth', 0x3a, 'pim6reg\x00'}}}}, ["", "", "", "", "", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x8010}, 0xd0) 15:29:45 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0x2b883106, 0x3a8c1) (async) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000040)='ns/mnt\x00') bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x2, 0x9, 0x9, 0x2, 0x202, r0, 0x0, '\x00', 0x0, r0, 0x1, 0x5, 0x2}, 0x48) (async, rerun: 32) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async, rerun: 32) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:45 executing program 3: pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f0000000140)={&(0x7f0000000080), 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="3800000048650dd5294d3da664d74ce6a1e3cba3ffbfd59d022e9af9aa1be82c1d74861310b76d13189163ecb0446e98ccc270479f075f1b1b0596fca996e327bc558ec986d66edd77d5da867bae5cb984ae6dda7b3e4b93", @ANYRES16=0x0, @ANYBLOB="000025bd7000fbdbdf25010000000000000001410000001c00170000001b000000816574683a697036677265746170300000"], 0x38}, 0x1, 0x0, 0x0, 0xc94}, 0x20040051) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) pipe2$watch_queue(&(0x7f0000000180), 0x80) (async) write$qrtrtun(r1, &(0x7f0000000300)="9f", 0x1) (async) sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, 0x0, 0x4, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_FD={0x8, 0x17, @udp=r0}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8001}, 0x40) 15:29:45 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0x0) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) 15:29:45 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) r1 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:45 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0x0) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) 15:29:45 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x9b64e572376812c3) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r2, 0x233}, 0x1c}}, 0x0) (async) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x34, r2, 0x8, 0x70bd26, 0x25dfdbfc, {{}, {}, {0x18, 0x17, {0xc, 0x6, @l2={'eth', 0x3a, 'pim6reg\x00'}}}}, ["", "", "", "", "", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x8010}, 0xd0) 15:29:45 executing program 3: pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f0000000140)={&(0x7f0000000080), 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="3800000048650dd5294d3da664d74ce6a1e3cba3ffbfd59d022e9af9aa1be82c1d74861310b76d13189163ecb0446e98ccc270479f075f1b1b0596fca996e327bc558ec986d66edd77d5da867bae5cb984ae6dda7b3e4b93", @ANYRES16=0x0, @ANYBLOB="000025bd7000fbdbdf25010000000000000001410000001c00170000001b000000816574683a697036677265746170300000"], 0x38}, 0x1, 0x0, 0x0, 0xc94}, 0x20040051) (async) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) pipe2$watch_queue(&(0x7f0000000180), 0x80) (async) write$qrtrtun(r1, &(0x7f0000000300)="9f", 0x1) (async, rerun: 32) sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, 0x0, 0x4, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_FD={0x8, 0x17, @udp=r0}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8001}, 0x40) (rerun: 32) 15:29:45 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0xfff, 0x4200) write$qrtrtun(r0, &(0x7f00000000c0)="f7d70266b8b60fca1c478515da026f8679e585384895da1ba0f2cca423340fda604d4c7f27f5d5a38fbaed059c421fa47899aa1656c236584dbe5ed028a2da397eefb65aad2ccf3f137097b1a6943c1e88b00b87680409", 0xfffffffffffffe03) (async) write$tcp_congestion(0xffffffffffffffff, &(0x7f0000000000)='reno\x00', 0x5) 15:29:45 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0xfff, 0x4200) write$qrtrtun(r0, &(0x7f00000000c0)="f7d70266b8b60fca1c478515da026f8679e585384895da1ba0f2cca423340fda604d4c7f27f5d5a38fbaed059c421fa47899aa1656c236584dbe5ed028a2da397eefb65aad2ccf3f137097b1a6943c1e88b00b87680409", 0xfffffffffffffe03) write$tcp_congestion(0xffffffffffffffff, &(0x7f0000000000)='reno\x00', 0x5) syz_open_dev$vcsa(&(0x7f0000000080), 0xfff, 0x4200) (async) write$qrtrtun(r0, &(0x7f00000000c0)="f7d70266b8b60fca1c478515da026f8679e585384895da1ba0f2cca423340fda604d4c7f27f5d5a38fbaed059c421fa47899aa1656c236584dbe5ed028a2da397eefb65aad2ccf3f137097b1a6943c1e88b00b87680409", 0xfffffffffffffe03) (async) write$tcp_congestion(0xffffffffffffffff, &(0x7f0000000000)='reno\x00', 0x5) (async) 15:29:45 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) r1 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:45 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0xffffc, 0x80) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:45 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x9b64e572376812c3) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r2, 0x233}, 0x1c}}, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x34, r2, 0x8, 0x70bd26, 0x25dfdbfc, {{}, {}, {0x18, 0x17, {0xc, 0x6, @l2={'eth', 0x3a, 'pim6reg\x00'}}}}, ["", "", "", "", "", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x8010}, 0xd0) 15:29:45 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000000)={0xa0000005}) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:45 executing program 4: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0xa841) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) 15:29:45 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000000)={0xa0000005}) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000000)={0xa0000005}) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) 15:29:45 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0xffffc, 0x80) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:45 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) r1 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:45 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0xffffc, 0x80) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) syz_open_dev$vcsa(&(0x7f0000000080), 0xffffc, 0x80) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) 15:29:45 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) pipe2$watch_queue(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) mmap$IORING_OFF_SQES(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x0, 0x2010, r1, 0x10000000) recvfrom$l2tp(r0, &(0x7f0000000080)=""/243, 0xf3, 0x10000, &(0x7f0000000180)={0x2, 0x0, @remote}, 0x10) write$qrtrtun(r0, &(0x7f0000000200)="e454043efcf1e2e26b96ed487d728bd30896057793a85293fbb44ab39455843ef330f3133bd6974cfdd9b63ecd420c9e250cc39011d320f5d399f5154be7e706ba8ca98dede46004c66314c92719ab3305f4642ea315cb99c1b537bcf606954fbebda70b9fa40e264ffe089538f1541ac7d7206ac53b8ba8450f84548595bd37c3f9c2d0e52b15ac9399a7eda442b5295a910055e50d5f2a3b32db8cf5b1233c66bfd32e3b28f4112ba670ea382c004cc41a66cdd9bb317a4ce794f3f2de5e", 0xbf) r2 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r2, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) r3 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r4, 0x10000000) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000002c0)={r3, r4, 0x2}, 0x10) write$qrtrtun(r2, &(0x7f0000000000)="de8138", 0x3) 15:29:45 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async, rerun: 32) pipe2$watch_queue(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (rerun: 32) mmap$IORING_OFF_SQES(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x0, 0x2010, r1, 0x10000000) recvfrom$l2tp(r0, &(0x7f0000000080)=""/243, 0xf3, 0x10000, &(0x7f0000000180)={0x2, 0x0, @remote}, 0x10) (async) write$qrtrtun(r0, &(0x7f0000000200)="e454043efcf1e2e26b96ed487d728bd30896057793a85293fbb44ab39455843ef330f3133bd6974cfdd9b63ecd420c9e250cc39011d320f5d399f5154be7e706ba8ca98dede46004c66314c92719ab3305f4642ea315cb99c1b537bcf606954fbebda70b9fa40e264ffe089538f1541ac7d7206ac53b8ba8450f84548595bd37c3f9c2d0e52b15ac9399a7eda442b5295a910055e50d5f2a3b32db8cf5b1233c66bfd32e3b28f4112ba670ea382c004cc41a66cdd9bb317a4ce794f3f2de5e", 0xbf) (async) r2 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r2, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) r3 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) (async, rerun: 32) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (rerun: 32) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r4, 0x10000000) (async) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000002c0)={r3, r4, 0x2}, 0x10) (async) write$qrtrtun(r2, &(0x7f0000000000)="de8138", 0x3) 15:29:45 executing program 1: write$qrtrtun(0xffffffffffffffff, &(0x7f0000000300)="9f", 0x1) pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) syz_io_uring_setup(0x176f, &(0x7f0000000080), &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_WRITE_FIXED={0x5, 0x0, 0x0, @fd_index}, 0x8a86c60) syz_io_uring_setup(0x5fe7, &(0x7f0000000140)={0x0, 0xcc40, 0x0, 0x2, 0xf8, 0x0, r0}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000001c0), &(0x7f0000000200)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x5, 0x0, 0x7fffffff, 0x0, &(0x7f0000000340)="77a883c1e79f32745169ebba52844398342f69b46db70c08c5ee904427252c644c3fa0a27580256829deb347c96e5ef897759e6a706d723b93080584b13c528aec3b68553169766e977fb62629f07e1e17824827493affc38e2a3535ed733308cbec5295263bbae5838a60b9f511a7cb99186a4cfc2423ad94ee7c55a84bfbfc0f868c061ae20c2cf6f444ed793367f8fb3ead9aa5e458131f9dac088958294131ddd7200d84f55a1dfbd38e3b435cdd5c2b9e052f8d7b1e1ce2de58d546c2fb83689bc32b5ab099806ce57aeeb6278a3654948ad6370b602afdf1aa8492157d94d2fa6d0cdecaac079124c9be9830edde512b4d3eca758d6c037eaae584c0b0e8551ee11aa38c6f9c59daa75495ab555ec425c9008a557feb45b22ec8fc9f58eb2225956b03322b07f37bd52c4ec2244d7551f58849e2f1ae242e97029a4d26e1567827826b5855d95a64bef4663d08deeddbf6418ffb5f1d0defd0dfdb45025b6ab2a69d670991bfca2e126f6496dc6471513dba3019c0e6ffd3e56d8a4fd05f2485b5884c047d77a2cd6a5f747a4ed13e04ee86e7fd6a150083b964386383902ee5a1665045496d7558d64e9ce207a445c78fceb9fcaf9f97ba66819c45f065726e02b9e442b2a2b7c7d50de15b6bfeeb6db7610efb8a8f8f38456855f99b53a5e4095ced43ba90a84f5471cf8a77c27bbdd8c6d5891a34f16c7686060e084ebee51a6439c73d02919173c90150e462b326987f0382a802e6f1a0990a6d0b2498e5c0e1defdbfab871f0d2f3d8eeb40c72d02401ad3db50d44eb4df6a7765e9198482ef601474f263fcacd63634a52010e44ba24aa7e3d9e2a9bc1cb1c7b4b061aec39574044cc808c7415422737a31c51f1f5ea970ce80500f55389cc8e31c0514c6bee098439f9a479c54cc83e645fe8ef523fa8898867c267fa7b1ff668a39943657fc5694e9cc27adaae2577b05d9562edb6513d473a3ab464981a5adf3f6dbeecb889e8039ff50b0782967de09cfbe6a27dd92d6a01e0c702109de6af18af287996e3af27ed37cb279d04df5da003f89edb40163573cb1d8ac9a10bb55999cca5dbb2fa6150880a8b9e2e36b33ecc415a7df57e320e0e966b98bfcd34dfe7651f3309d0314e860df57c095a360b823bcf7ed3e28bc9d31a3a044ba23be3b343ae10bc7db6d759d0d4d105755b71467c24d65ee8178710de13096e61cfb3ef2ffee2fba433db48afd52c8062579d62baf4deaf3f0927b378f3df47b5e9c575b8a2391d577c2fb263ca4fbc016586dfa9c10a1d14768ce314a36a1f2653cbd2611607b4f62f2eb3b1ae6e4badd546530d6c6535b73a1d99c0688efe5b3e5b77ff396e4f7d39fa2b51aaadf5e091f4534951ee54985800ce5be3ac7f9c7038e8546b72b5a09796e896be49b57afa9f678786f96d850f3018de0ebdd53de23c0a2a5da33fe6fd8b013ff758ea2b4011c296a83596ace3dd06f0144fed348dda1ef7dfaea92f99ae7b6f74815f7fabfbab5d860eeba2c924d2ec935515ce94845c17faa3aa7ced00bf1a2722bbc7c9e7c13fa0f6a25fbcddaeb23135c18a5149c2ecbfb14a3f0130ae4d6e3817b49d021d7710371d7bd292e542308bfd32abe5f960c8d4ba99f77b18967cdcce0bb26ca5a9ca5f76c264b11b006a71c60aa2fdcefe9fd2516c4aa647a08806b4613752108c95c075f29459ca758cbae996a3e0329c54acb9f247c691bf129fb69177804d7de9d07b37724aff8eeb773c27a0e330cf275b728e81fc7a9398bbead3ec69283a84140c3e0869fee301de402e1e93d2dcf75c52bc21c1aae37c3435959b77aee7d0aee08721283f65c811a3c96abdd0bf5f222d9a4ce8e80e72aacdddc189b0c165a8cc03218a758d700267fe884b1424f469be038ff0fffa799824636e987cfaf34ac9dff0b82e49e3c83e711163b4670b63f103a044d82a406f7c74c92d9b2d6aa53f7c3d1fc719e62df55c9484773caa2a075eba58a0eace39d6234e3e11c8ef9cc73663ca8542aac87f09ff65b043ba76cd2da9be91efe16fe7217be969f3c4eeca68e35b846ab9f678841526821f7f8164b9dddcf99f920d2d3134169b376b03ebb31a0b3f958e6a55a066ed38ffb6f737e76734aeb9de977891be708d01d9347fe90b75111e0da7e23eafceca3e42490a2b6ccc2bad515d7c157471914f323d139cd9bb8213727a9f63e11376e856202c1a714c89da13ce0235bdbdf7329da3ca859b1b44cbbae2474e16b9ee2c442b5963aa1a1133d7257d629defd2ab1e61febd33a8cf0eb85ed6169f68c2da9e3321b76af1e81592dde37e82e3fa5caca200e4e0b734fc6a3d940a4ee8156acc03c4d92ab87f3bab359da1484fd1fd3b95ccd0739d35343fd3f87ab7aa561c7c9a19b44722e4ac75568038e1b0a5614a6cc679fb4870c325b2fa487b4ed619a51f1dcb9981a8f292c1ab058632ada2469d0d374cb32f2a2b8f4fd9273d77641c25add32e3291bc625c66181d0c87034f2dc99ca87245092b94921b9f8d7f2cd42a90ba8f53159924c2191990b04b500ec84bae752731a8683ae42ff5b70de5ebec2f5b536b6aa4b3391c06e43e9150b8c1679e6560db65414ff5a328ee8d2e9e00324c7215aedd7795c633a73ef47230405961cd990d230217539bf670bcd9f7711e207eee8c4b42ede4719e4e5093897eba42ef9a57b03736975e3c6393498eca4c5dddc8b5a797381b65840fa98b139816f653a035ff4e133425fc6c64d666f9a94cc17397becc6437670334955957367a0a6c656cc874a3c7a1ac9627b0c53b6076bed362c1329227b366066c30cee49b5aeb60ab8f10981e4f8a0d6f47cc5debc79fedaded5401b29e1738f66700d36c019da3753c74d156558dcd50417a0c5b635b3a62367912b60e050971441b9e83841603bdcf8f9d462e4022cfcae16372197b6ec6d3b5957c283690ee78f9c7af496692f0f90f08d982f42d2e4847f0b8ced3042ab9fcc9e1a423a5e056630df93db19333bc8559d465f2717d36bb4a6bc62df9465e707e2cc81d87bfff071b0df7ec00f20eb5d241d5850526b6c3a5992b9f79746b7e397c450c339630fd494fd76912847089ee76221f723bfda66cfbb11074d40d14bb75c205cf17833865a6ece59082400da27ad6dfd60f338c88edd4fc548b0f9668225a8596f2c462d620513df3cfdcfed69c769b8b71384493bdc6036aac46b4be39668f6c0aaaed892e6f54c511ddb15c7c6a386d4562f11a87a334725ffa92f51a4816332e9aae408656abcc0d87e9635b215cdb232653396a1d15bf0640913aa2dc50edc51657eeaacedc9a98e262f57e9355be04faae97aacd7bf84f53557520e69f8b207d76019d6131181d564e9ee57131a2d2c47103c88880d73c687e9e7375264dd17bff06e8e0ed6f91ae99549e227f2b7d9beb2666615356b5a537c1e936142665ef882b43fe9c7adec5bb73ec9533995224412f95c1fd17e00c0650122d5113e46c3e0fcec95a1d97d61478576c32c2a91ef4568625cb71ebc52df2140915206998a236dbdd6f5404c2463db65ece18e0719eaf23fe19e39b67051a3c2086451684d05b9a01664959ea59e8d435d2f432719486d5ffd2ec73ee31f8c37f9ecdb6ac996b14f418914ad49e6a96b6ee3de3e3d61eb7452a0e8d302a0126c137c91be20afe84557db13e16d8bf8a3cd9c025817433a63aac7a77fce4158385cc4c1505de0aa93870f134b424bbdaaeb3efccaa79c164e8ab934e867904acea8aa2e6ee630487de9c4ea6bbf5b4ccb397e608b2ef7120545fb4334744058cd4c36da477638a7fccf4444fb4be1154dd63426eade040fa2702c724db8f9d28104b13ffc5223a6d476520c47565eab6149ede4a9fa6a9d5fcb2906c0854413074f3f2c1a02a024e6236bd8091a76fd7991e4be72d3e4b627b46d3cf82fbb282c2825459edcaee769d00ae5425457b3c5b92b232ccf1dc1caa764a467ea5cfaaea04ea877ad74b63bb90652c8180bccf9345adf1333587301148a390e13cb0c52c5dd10246c9f66fe538e9db8c06b687b25ca9016085b8b497b019f7e2d512261998d46b130a9292fb0fce483959508fbbe311bf061065adddbac0ebc7b94f03e0d1d27a7aeaf02810b4b92b37f9c435f9c5adc94a17dd119d9d929f37f6a8812d915d0c60919a3ffcfee896964cb298d282c868431f0e57ebc543a7a539def7e45893bfe4bf7da23b3f101d637a751e59b31de870c8fab2fe2e91893303e96fdc52604a49a69f8ac35c544ef56cf263bf90719eacd6806391b8ec62b86380a5ebbf743b6f588249fee625997b06d857b66be4789b1d50b063a4f0aa6a7567989d6f771e60dcc09566b80e106ae6fd3bedacadf97bc16d612f3d7c3a4a8394c5e4c3bf36a37a01649f755d65d71ef30f83453e5290e5ede479d8c450e09642e70e07733dd1cc1fca1ad109f441cba947f90ddb560f99e09275d783bc8a221cd02e79a9ce58613569c67f05957a325ff5e21ec5c65089a235422f31e9453910956db2e19fd4389c229f4edbb967f770d56afdc6ee709447d4ec6776d57abbc038652ea7ce364db846c8dcfa07dc61048dbbc4253e29b624665dde8da68678176f98fc9a0c4b7540d94f3cc55d8ef7d0acf7c26b2339cac6f3da779fab830ae9c7271d34e8f237465d67e608a110c9b86e092e2e221bb042a94cb60b0129182ee8a2da5ba9aac57a981594796610552b7c376bba16c50aa2bd57f7241674ac17622fd06e4e138e1fdf97ecbe1dd1ba5b3dd420aaec74fedc8cab7334e0619991b591d79f2c1d8f6c8af5283cf9966bd2ae79b03a302fbdd8ba40552778aa1176934ce385562d4b0dac32eb04153d36f1a025cc7aecf3ef9156b27a1fe6d22af78c43c3111c8046f9877e3c0abdf00bb0d2f216c452159ced33d2b946be8e8a1d9a7e4f58e9f9133732d4babfa02edb4b8c2b86ddadeeabfb960199c8c1b11b64f55f8e4e901929de451b06f9b5905abe113546c5e4141896de66d1cc0d5427890e3e54cecbb4c40ab3e2c30e35e835a3bc59ef7587f8008f3222ab9dbddaefc1acb69cde12e189627de86cd37e7bae3678abc0b2dc62958878c6b72dac79f9b507de97b603bd54956619bc361973671fc702a17f1b14a3e1b188844f7681625036fd585c1a44f738cb62d11cbfe739f1481186502a396e3fd02ff5c2a76f0df4601df0deab0cf0534f725e75825f974d644ffadd01279aac3cd9bf155e98d1fcd673e5031e57054430cc0fdff6f5c53a7ac18215b1f27e3b7360429ceb5442e2ceda6544961e35570804dcbd888a37d2169859955873d9b5bd1a586739d24bab6a05c545361f1405c215073f32f41111471425449f29bb6f20644cf04efeb0f02bc426d6aa1cb03b362d328b33f4c50ce3fc05334f600c98e72b599888e1a86e08eaf1bdabc5b047581f2ca36a1eef7d7d60ebcb07c915efb04c761359f6830ddf7535ccfe51b36ec7b58c04ac944a96acca39caefce84486fdda957c9245d3e46e4478a71426b0149a79125603049c069652b8a77ca879085817dd245c8162294127d3ffaffb4065564995be2fc9a7a2bdbc80793b5bfbdab469664fa3e77097d44ae38f09f376a441997cce708f41fd1071ec1781d2381ffa400f03180878adc5250be23316ef9309b9d3c234726e15c7f04957443f6ef976d2c55579a00cb2efa2dafc2938175e8982e7da470d3fbd13670a24915a07ab83c24ee016dfbad650a3531d4e61342dd6c6f0af04abf83e2329", 0x5f3, 0x0, 0x0, {0x1}}, 0x80) openat$cgroup_ro(r0, &(0x7f0000000080)='blkio.bfq.avg_queue_size\x00', 0x0, 0x0) socketpair(0x15, 0x5, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) semget$private(0x0, 0x2, 0x665) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r6, 0x10000000) openat$cgroup_devices(r6, &(0x7f0000001400)='devices.deny\x00', 0x2, 0x0) sendmsg$TIPC_CMD_SHOW_STATS(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r4, 0x233}, 0x1c}}, 0x0) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r3, &(0x7f00000013c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000001380)={&(0x7f0000001340)={0x1c, r4, 0xca354e586da9bcbc, 0x70bd29, 0x25dfdbff, {}, ["", "", "", "", ""]}, 0x37}, 0x1, 0x0, 0x0, 0x40040c0}, 0x44010) pipe2$watch_queue(&(0x7f0000000000), 0x80) pipe2$watch_queue(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) write$qrtrtun(r7, &(0x7f0000000100)="cb73a3fbfa77f7a4577f3bf7269b7b0005338f8138", 0x62) 15:29:45 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000000)={0xa0000005}) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000000)={0xa0000005}) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) 15:29:45 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) openat$cgroup_pressure(r1, &(0x7f0000000000)='io.pressure\x00', 0x2, 0x0) write$qrtrtun(r0, &(0x7f0000000080)="de8138", 0xffffffffffffffde) 15:29:45 executing program 4: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0xa841) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) 15:29:45 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x10000000) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x4) r2 = geteuid() sendmsg$nl_xfrm(r0, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=@migrate={0x58, 0x21, 0x200, 0x70bd26, 0x25dfdbfe, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in=@local, 0x4e24, 0x7, 0x4e20, 0x1, 0x2, 0x80, 0x80, 0x67, r1, r2}, 0x6e6bb6, 0x2}, [@tfcpad={0x8, 0x16, 0x2}]}, 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x10) r3 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r3, &(0x7f0000000000)="de8138", 0xf85) 15:29:45 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder0\x00', 0x804, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1000, 0x3}) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r2, 0x5760, 0xc) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) write$tcp_mem(r1, &(0x7f0000000080)={0x4, 0x20, 0x9e3, 0x20, 0x8}, 0x48) 15:29:45 executing program 4: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0xa841) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) 15:29:45 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) pipe2$watch_queue(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) mmap$IORING_OFF_SQES(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x0, 0x2010, r1, 0x10000000) (async) recvfrom$l2tp(r0, &(0x7f0000000080)=""/243, 0xf3, 0x10000, &(0x7f0000000180)={0x2, 0x0, @remote}, 0x10) write$qrtrtun(r0, &(0x7f0000000200)="e454043efcf1e2e26b96ed487d728bd30896057793a85293fbb44ab39455843ef330f3133bd6974cfdd9b63ecd420c9e250cc39011d320f5d399f5154be7e706ba8ca98dede46004c66314c92719ab3305f4642ea315cb99c1b537bcf606954fbebda70b9fa40e264ffe089538f1541ac7d7206ac53b8ba8450f84548595bd37c3f9c2d0e52b15ac9399a7eda442b5295a910055e50d5f2a3b32db8cf5b1233c66bfd32e3b28f4112ba670ea382c004cc41a66cdd9bb317a4ce794f3f2de5e", 0xbf) (async) r2 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r2, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) r3 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) (async) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r4, 0x10000000) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000002c0)={r3, r4, 0x2}, 0x10) write$qrtrtun(r2, &(0x7f0000000000)="de8138", 0x3) 15:29:45 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) openat$cgroup_pressure(r1, &(0x7f0000000000)='io.pressure\x00', 0x2, 0x0) write$qrtrtun(r0, &(0x7f0000000080)="de8138", 0xffffffffffffffde) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) openat$cgroup_pressure(r1, &(0x7f0000000000)='io.pressure\x00', 0x2, 0x0) (async) write$qrtrtun(r0, &(0x7f0000000080)="de8138", 0xffffffffffffffde) (async) 15:29:45 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x10000000) (async) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x4) r2 = geteuid() sendmsg$nl_xfrm(r0, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=@migrate={0x58, 0x21, 0x200, 0x70bd26, 0x25dfdbfe, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in=@local, 0x4e24, 0x7, 0x4e20, 0x1, 0x2, 0x80, 0x80, 0x67, r1, r2}, 0x6e6bb6, 0x2}, [@tfcpad={0x8, 0x16, 0x2}]}, 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x10) (async) r3 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r3, &(0x7f0000000000)="de8138", 0xf85) 15:29:45 executing program 1: write$qrtrtun(0xffffffffffffffff, &(0x7f0000000300)="9f", 0x1) (async) pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (async) syz_io_uring_setup(0x176f, &(0x7f0000000080), &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_WRITE_FIXED={0x5, 0x0, 0x0, @fd_index}, 0x8a86c60) syz_io_uring_setup(0x5fe7, &(0x7f0000000140)={0x0, 0xcc40, 0x0, 0x2, 0xf8, 0x0, r0}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000001c0), &(0x7f0000000200)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x5, 0x0, 0x7fffffff, 0x0, &(0x7f0000000340)="77a883c1e79f32745169ebba52844398342f69b46db70c08c5ee904427252c644c3fa0a27580256829deb347c96e5ef897759e6a706d723b93080584b13c528aec3b68553169766e977fb62629f07e1e17824827493affc38e2a3535ed733308cbec5295263bbae5838a60b9f511a7cb99186a4cfc2423ad94ee7c55a84bfbfc0f868c061ae20c2cf6f444ed793367f8fb3ead9aa5e458131f9dac088958294131ddd7200d84f55a1dfbd38e3b435cdd5c2b9e052f8d7b1e1ce2de58d546c2fb83689bc32b5ab099806ce57aeeb6278a3654948ad6370b602afdf1aa8492157d94d2fa6d0cdecaac079124c9be9830edde512b4d3eca758d6c037eaae584c0b0e8551ee11aa38c6f9c59daa75495ab555ec425c9008a557feb45b22ec8fc9f58eb2225956b03322b07f37bd52c4ec2244d7551f58849e2f1ae242e97029a4d26e1567827826b5855d95a64bef4663d08deeddbf6418ffb5f1d0defd0dfdb45025b6ab2a69d670991bfca2e126f6496dc6471513dba3019c0e6ffd3e56d8a4fd05f2485b5884c047d77a2cd6a5f747a4ed13e04ee86e7fd6a150083b964386383902ee5a1665045496d7558d64e9ce207a445c78fceb9fcaf9f97ba66819c45f065726e02b9e442b2a2b7c7d50de15b6bfeeb6db7610efb8a8f8f38456855f99b53a5e4095ced43ba90a84f5471cf8a77c27bbdd8c6d5891a34f16c7686060e084ebee51a6439c73d02919173c90150e462b326987f0382a802e6f1a0990a6d0b2498e5c0e1defdbfab871f0d2f3d8eeb40c72d02401ad3db50d44eb4df6a7765e9198482ef601474f263fcacd63634a52010e44ba24aa7e3d9e2a9bc1cb1c7b4b061aec39574044cc808c7415422737a31c51f1f5ea970ce80500f55389cc8e31c0514c6bee098439f9a479c54cc83e645fe8ef523fa8898867c267fa7b1ff668a39943657fc5694e9cc27adaae2577b05d9562edb6513d473a3ab464981a5adf3f6dbeecb889e8039ff50b0782967de09cfbe6a27dd92d6a01e0c702109de6af18af287996e3af27ed37cb279d04df5da003f89edb40163573cb1d8ac9a10bb55999cca5dbb2fa6150880a8b9e2e36b33ecc415a7df57e320e0e966b98bfcd34dfe7651f3309d0314e860df57c095a360b823bcf7ed3e28bc9d31a3a044ba23be3b343ae10bc7db6d759d0d4d105755b71467c24d65ee8178710de13096e61cfb3ef2ffee2fba433db48afd52c8062579d62baf4deaf3f0927b378f3df47b5e9c575b8a2391d577c2fb263ca4fbc016586dfa9c10a1d14768ce314a36a1f2653cbd2611607b4f62f2eb3b1ae6e4badd546530d6c6535b73a1d99c0688efe5b3e5b77ff396e4f7d39fa2b51aaadf5e091f4534951ee54985800ce5be3ac7f9c7038e8546b72b5a09796e896be49b57afa9f678786f96d850f3018de0ebdd53de23c0a2a5da33fe6fd8b013ff758ea2b4011c296a83596ace3dd06f0144fed348dda1ef7dfaea92f99ae7b6f74815f7fabfbab5d860eeba2c924d2ec935515ce94845c17faa3aa7ced00bf1a2722bbc7c9e7c13fa0f6a25fbcddaeb23135c18a5149c2ecbfb14a3f0130ae4d6e3817b49d021d7710371d7bd292e542308bfd32abe5f960c8d4ba99f77b18967cdcce0bb26ca5a9ca5f76c264b11b006a71c60aa2fdcefe9fd2516c4aa647a08806b4613752108c95c075f29459ca758cbae996a3e0329c54acb9f247c691bf129fb69177804d7de9d07b37724aff8eeb773c27a0e330cf275b728e81fc7a9398bbead3ec69283a84140c3e0869fee301de402e1e93d2dcf75c52bc21c1aae37c3435959b77aee7d0aee08721283f65c811a3c96abdd0bf5f222d9a4ce8e80e72aacdddc189b0c165a8cc03218a758d700267fe884b1424f469be038ff0fffa799824636e987cfaf34ac9dff0b82e49e3c83e711163b4670b63f103a044d82a406f7c74c92d9b2d6aa53f7c3d1fc719e62df55c9484773caa2a075eba58a0eace39d6234e3e11c8ef9cc73663ca8542aac87f09ff65b043ba76cd2da9be91efe16fe7217be969f3c4eeca68e35b846ab9f678841526821f7f8164b9dddcf99f920d2d3134169b376b03ebb31a0b3f958e6a55a066ed38ffb6f737e76734aeb9de977891be708d01d9347fe90b75111e0da7e23eafceca3e42490a2b6ccc2bad515d7c157471914f323d139cd9bb8213727a9f63e11376e856202c1a714c89da13ce0235bdbdf7329da3ca859b1b44cbbae2474e16b9ee2c442b5963aa1a1133d7257d629defd2ab1e61febd33a8cf0eb85ed6169f68c2da9e3321b76af1e81592dde37e82e3fa5caca200e4e0b734fc6a3d940a4ee8156acc03c4d92ab87f3bab359da1484fd1fd3b95ccd0739d35343fd3f87ab7aa561c7c9a19b44722e4ac75568038e1b0a5614a6cc679fb4870c325b2fa487b4ed619a51f1dcb9981a8f292c1ab058632ada2469d0d374cb32f2a2b8f4fd9273d77641c25add32e3291bc625c66181d0c87034f2dc99ca87245092b94921b9f8d7f2cd42a90ba8f53159924c2191990b04b500ec84bae752731a8683ae42ff5b70de5ebec2f5b536b6aa4b3391c06e43e9150b8c1679e6560db65414ff5a328ee8d2e9e00324c7215aedd7795c633a73ef47230405961cd990d230217539bf670bcd9f7711e207eee8c4b42ede4719e4e5093897eba42ef9a57b03736975e3c6393498eca4c5dddc8b5a797381b65840fa98b139816f653a035ff4e133425fc6c64d666f9a94cc17397becc6437670334955957367a0a6c656cc874a3c7a1ac9627b0c53b6076bed362c1329227b366066c30cee49b5aeb60ab8f10981e4f8a0d6f47cc5debc79fedaded5401b29e1738f66700d36c019da3753c74d156558dcd50417a0c5b635b3a62367912b60e050971441b9e83841603bdcf8f9d462e4022cfcae16372197b6ec6d3b5957c283690ee78f9c7af496692f0f90f08d982f42d2e4847f0b8ced3042ab9fcc9e1a423a5e056630df93db19333bc8559d465f2717d36bb4a6bc62df9465e707e2cc81d87bfff071b0df7ec00f20eb5d241d5850526b6c3a5992b9f79746b7e397c450c339630fd494fd76912847089ee76221f723bfda66cfbb11074d40d14bb75c205cf17833865a6ece59082400da27ad6dfd60f338c88edd4fc548b0f9668225a8596f2c462d620513df3cfdcfed69c769b8b71384493bdc6036aac46b4be39668f6c0aaaed892e6f54c511ddb15c7c6a386d4562f11a87a334725ffa92f51a4816332e9aae408656abcc0d87e9635b215cdb232653396a1d15bf0640913aa2dc50edc51657eeaacedc9a98e262f57e9355be04faae97aacd7bf84f53557520e69f8b207d76019d6131181d564e9ee57131a2d2c47103c88880d73c687e9e7375264dd17bff06e8e0ed6f91ae99549e227f2b7d9beb2666615356b5a537c1e936142665ef882b43fe9c7adec5bb73ec9533995224412f95c1fd17e00c0650122d5113e46c3e0fcec95a1d97d61478576c32c2a91ef4568625cb71ebc52df2140915206998a236dbdd6f5404c2463db65ece18e0719eaf23fe19e39b67051a3c2086451684d05b9a01664959ea59e8d435d2f432719486d5ffd2ec73ee31f8c37f9ecdb6ac996b14f418914ad49e6a96b6ee3de3e3d61eb7452a0e8d302a0126c137c91be20afe84557db13e16d8bf8a3cd9c025817433a63aac7a77fce4158385cc4c1505de0aa93870f134b424bbdaaeb3efccaa79c164e8ab934e867904acea8aa2e6ee630487de9c4ea6bbf5b4ccb397e608b2ef7120545fb4334744058cd4c36da477638a7fccf4444fb4be1154dd63426eade040fa2702c724db8f9d28104b13ffc5223a6d476520c47565eab6149ede4a9fa6a9d5fcb2906c0854413074f3f2c1a02a024e6236bd8091a76fd7991e4be72d3e4b627b46d3cf82fbb282c2825459edcaee769d00ae5425457b3c5b92b232ccf1dc1caa764a467ea5cfaaea04ea877ad74b63bb90652c8180bccf9345adf1333587301148a390e13cb0c52c5dd10246c9f66fe538e9db8c06b687b25ca9016085b8b497b019f7e2d512261998d46b130a9292fb0fce483959508fbbe311bf061065adddbac0ebc7b94f03e0d1d27a7aeaf02810b4b92b37f9c435f9c5adc94a17dd119d9d929f37f6a8812d915d0c60919a3ffcfee896964cb298d282c868431f0e57ebc543a7a539def7e45893bfe4bf7da23b3f101d637a751e59b31de870c8fab2fe2e91893303e96fdc52604a49a69f8ac35c544ef56cf263bf90719eacd6806391b8ec62b86380a5ebbf743b6f588249fee625997b06d857b66be4789b1d50b063a4f0aa6a7567989d6f771e60dcc09566b80e106ae6fd3bedacadf97bc16d612f3d7c3a4a8394c5e4c3bf36a37a01649f755d65d71ef30f83453e5290e5ede479d8c450e09642e70e07733dd1cc1fca1ad109f441cba947f90ddb560f99e09275d783bc8a221cd02e79a9ce58613569c67f05957a325ff5e21ec5c65089a235422f31e9453910956db2e19fd4389c229f4edbb967f770d56afdc6ee709447d4ec6776d57abbc038652ea7ce364db846c8dcfa07dc61048dbbc4253e29b624665dde8da68678176f98fc9a0c4b7540d94f3cc55d8ef7d0acf7c26b2339cac6f3da779fab830ae9c7271d34e8f237465d67e608a110c9b86e092e2e221bb042a94cb60b0129182ee8a2da5ba9aac57a981594796610552b7c376bba16c50aa2bd57f7241674ac17622fd06e4e138e1fdf97ecbe1dd1ba5b3dd420aaec74fedc8cab7334e0619991b591d79f2c1d8f6c8af5283cf9966bd2ae79b03a302fbdd8ba40552778aa1176934ce385562d4b0dac32eb04153d36f1a025cc7aecf3ef9156b27a1fe6d22af78c43c3111c8046f9877e3c0abdf00bb0d2f216c452159ced33d2b946be8e8a1d9a7e4f58e9f9133732d4babfa02edb4b8c2b86ddadeeabfb960199c8c1b11b64f55f8e4e901929de451b06f9b5905abe113546c5e4141896de66d1cc0d5427890e3e54cecbb4c40ab3e2c30e35e835a3bc59ef7587f8008f3222ab9dbddaefc1acb69cde12e189627de86cd37e7bae3678abc0b2dc62958878c6b72dac79f9b507de97b603bd54956619bc361973671fc702a17f1b14a3e1b188844f7681625036fd585c1a44f738cb62d11cbfe739f1481186502a396e3fd02ff5c2a76f0df4601df0deab0cf0534f725e75825f974d644ffadd01279aac3cd9bf155e98d1fcd673e5031e57054430cc0fdff6f5c53a7ac18215b1f27e3b7360429ceb5442e2ceda6544961e35570804dcbd888a37d2169859955873d9b5bd1a586739d24bab6a05c545361f1405c215073f32f41111471425449f29bb6f20644cf04efeb0f02bc426d6aa1cb03b362d328b33f4c50ce3fc05334f600c98e72b599888e1a86e08eaf1bdabc5b047581f2ca36a1eef7d7d60ebcb07c915efb04c761359f6830ddf7535ccfe51b36ec7b58c04ac944a96acca39caefce84486fdda957c9245d3e46e4478a71426b0149a79125603049c069652b8a77ca879085817dd245c8162294127d3ffaffb4065564995be2fc9a7a2bdbc80793b5bfbdab469664fa3e77097d44ae38f09f376a441997cce708f41fd1071ec1781d2381ffa400f03180878adc5250be23316ef9309b9d3c234726e15c7f04957443f6ef976d2c55579a00cb2efa2dafc2938175e8982e7da470d3fbd13670a24915a07ab83c24ee016dfbad650a3531d4e61342dd6c6f0af04abf83e2329", 0x5f3, 0x0, 0x0, {0x1}}, 0x80) (async) openat$cgroup_ro(r0, &(0x7f0000000080)='blkio.bfq.avg_queue_size\x00', 0x0, 0x0) (async) socketpair(0x15, 0x5, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) (async) semget$private(0x0, 0x2, 0x665) (async) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r6, 0x10000000) openat$cgroup_devices(r6, &(0x7f0000001400)='devices.deny\x00', 0x2, 0x0) sendmsg$TIPC_CMD_SHOW_STATS(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r4, 0x233}, 0x1c}}, 0x0) (async) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r3, &(0x7f00000013c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000001380)={&(0x7f0000001340)={0x1c, r4, 0xca354e586da9bcbc, 0x70bd29, 0x25dfdbff, {}, ["", "", "", "", ""]}, 0x37}, 0x1, 0x0, 0x0, 0x40040c0}, 0x44010) (async) pipe2$watch_queue(&(0x7f0000000000), 0x80) (async) pipe2$watch_queue(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) write$qrtrtun(r7, &(0x7f0000000100)="cb73a3fbfa77f7a4577f3bf7269b7b0005338f8138", 0x62) 15:29:45 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0xa841) write$qrtrtun(r0, 0x0, 0x0) 15:29:45 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x10000000) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x4) r2 = geteuid() sendmsg$nl_xfrm(r0, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=@migrate={0x58, 0x21, 0x200, 0x70bd26, 0x25dfdbfe, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in=@local, 0x4e24, 0x7, 0x4e20, 0x1, 0x2, 0x80, 0x80, 0x67, r1, r2}, 0x6e6bb6, 0x2}, [@tfcpad={0x8, 0x16, 0x2}]}, 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x10) r3 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r3, &(0x7f0000000000)="de8138", 0xf85) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x10000000) (async) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f00000000c0), &(0x7f0000000100)=0x4) (async) geteuid() (async) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=@migrate={0x58, 0x21, 0x200, 0x70bd26, 0x25dfdbfe, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in=@local, 0x4e24, 0x7, 0x4e20, 0x1, 0x2, 0x80, 0x80, 0x67, r1, r2}, 0x6e6bb6, 0x2}, [@tfcpad={0x8, 0x16, 0x2}]}, 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x10) (async) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r3, &(0x7f0000000000)="de8138", 0xf85) (async) 15:29:45 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0xa841) write$qrtrtun(r0, 0x0, 0x0) 15:29:45 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) openat$cgroup_pressure(r1, &(0x7f0000000000)='io.pressure\x00', 0x2, 0x0) write$qrtrtun(r0, &(0x7f0000000080)="de8138", 0xffffffffffffffde) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) openat$cgroup_pressure(r1, &(0x7f0000000000)='io.pressure\x00', 0x2, 0x0) (async) write$qrtrtun(r0, &(0x7f0000000080)="de8138", 0xffffffffffffffde) (async) 15:29:45 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (async) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder0\x00', 0x804, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1000, 0x3}) (async) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r2, 0x5760, 0xc) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) write$tcp_mem(r1, &(0x7f0000000080)={0x4, 0x20, 0x9e3, 0x20, 0x8}, 0x48) 15:29:45 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r1, &(0x7f0000000540)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x30, 0x0, 0x200, 0x70bd25, 0x25dfdbfd, {{}, {}, {0x14, 0x19, {0x101, 0x40, 0xe07, 0x800}}}, ["", "", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x4000810}, 0x20048004) sendmsg$TIPC_CMD_SET_NETID(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x5c, 0x0, 0x4, 0x70bd2d, 0x7c4, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @loopback}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private0}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x5}, @L2TP_ATTR_MTU={0x6, 0x1c, 0xfbff}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @mcast2}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8000}, 0x5) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r2, &(0x7f0000000000)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000380)={0x20, 0x0, 0x300, 0x70bd2a, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0xe55, 0x72}}}}, ["", "", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x4008800}, 0x80) r3 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r3, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), r0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x58}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x24, r4, 0x1, 0x70bd2b, 0x25dfdbff, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x3f}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @remote}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008001}, 0x20004041) write$qrtrtun(r3, &(0x7f00000003c0)="de8138865bd1fbb1cb622dc43bb9725ef4f8adb44b6ed2004af2d5854d56039d59cec87c7355ce0145a64f1e6349f7beca58b52129a155bc681cf2c3813f9bf1333245adfc0cd3dc70fd72d4b408f3271a14c7233b5d77d6cd951a10b19d35d9d48f94f128d0f61e7f93d69dd66521e31f8d956c9af52d122781d85c01b87a25bfe823b3deeae83685d3d45da9d24516081380b3fc1bb77ee5cc2e0b0883ca9918efed10ff0960d6b276e194cc53df2cdf40fef1d0b5ce71cd44428ab5fa39ca164f8ea3500aeb3694e45d2e1ec295337370a8c48d205d11a00c1b10d074536a9d4012d7ff4f8e1a9fd4e307114db0ea5b9d7ddf75ca699cf1c1d40f", 0xfc) r5 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r5, 0x10000000) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r5, 0xc0a85352, &(0x7f0000000080)={{0x5, 0x81}, 'port0\x00', 0x0, 0x10413, 0x0, 0x39e0, 0xfff, 0x3, 0x6, 0x0, 0x2, 0x7}) 15:29:45 executing program 5: pipe2$watch_queue(&(0x7f0000000200)={0xffffffffffffffff}, 0x80) read$watch_queue(r0, &(0x7f0000000240)=""/196, 0xc4) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r2 = syz_open_dev$tty1(0xc, 0x4, 0x3) syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), r1) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r4, &(0x7f0000000440)={&(0x7f0000000240), 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x14, r3, 0x1}, 0x14}}, 0x0) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r6, &(0x7f0000000440)={&(0x7f0000000240), 0xc, &(0x7f0000000400)={&(0x7f00000003c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r5, @ANYBLOB="01010000002c7e079f3cdb101900"], 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000600)=ANY=[@ANYBLOB="4400000089f8fbbb1f53e4a3ac136909ecc183bbda2bc3c8666861274de70a5ca65d489db65abb9dfa427f8d3972b63d03a317756cd62fcae359345a71dac6a88448596bd62f8553ea0b4e8f6ec0b13d55ec834aab36d3c11637e0a9694b2891b7ec43c9f46115fdd2e2e91f71c45c8696431bb5a8af53cc31ffe52fa0d000"/140, @ANYRES16=r5, @ANYBLOB="080029bd7000ffdbdf2503000000050014000300000006001a004e2200000c001000070000000000000014002000fe80000000000000000000000000003e"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x1) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000080)) write$qrtrtun(r1, &(0x7f0000000000)="de8138", 0xf85) 15:29:45 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r1 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r1, &(0x7f0000000540)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x30, 0x0, 0x200, 0x70bd25, 0x25dfdbfd, {{}, {}, {0x14, 0x19, {0x101, 0x40, 0xe07, 0x800}}}, ["", "", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x4000810}, 0x20048004) (async, rerun: 64) sendmsg$TIPC_CMD_SET_NETID(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async, rerun: 64) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x5c, 0x0, 0x4, 0x70bd2d, 0x7c4, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @loopback}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private0}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x5}, @L2TP_ATTR_MTU={0x6, 0x1c, 0xfbff}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @mcast2}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8000}, 0x5) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r2, &(0x7f0000000000)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000380)={0x20, 0x0, 0x300, 0x70bd2a, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0xe55, 0x72}}}}, ["", "", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x4008800}, 0x80) r3 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r3, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), r0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x58}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x24, r4, 0x1, 0x70bd2b, 0x25dfdbff, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x3f}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @remote}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008001}, 0x20004041) write$qrtrtun(r3, &(0x7f00000003c0)="de8138865bd1fbb1cb622dc43bb9725ef4f8adb44b6ed2004af2d5854d56039d59cec87c7355ce0145a64f1e6349f7beca58b52129a155bc681cf2c3813f9bf1333245adfc0cd3dc70fd72d4b408f3271a14c7233b5d77d6cd951a10b19d35d9d48f94f128d0f61e7f93d69dd66521e31f8d956c9af52d122781d85c01b87a25bfe823b3deeae83685d3d45da9d24516081380b3fc1bb77ee5cc2e0b0883ca9918efed10ff0960d6b276e194cc53df2cdf40fef1d0b5ce71cd44428ab5fa39ca164f8ea3500aeb3694e45d2e1ec295337370a8c48d205d11a00c1b10d074536a9d4012d7ff4f8e1a9fd4e307114db0ea5b9d7ddf75ca699cf1c1d40f", 0xfc) r5 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r5, 0x10000000) (async) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r5, 0xc0a85352, &(0x7f0000000080)={{0x5, 0x81}, 'port0\x00', 0x0, 0x10413, 0x0, 0x39e0, 0xfff, 0x3, 0x6, 0x0, 0x2, 0x7}) 15:29:45 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) r1 = openat$cgroup_ro(r0, &(0x7f0000000080)='devices.list\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f00000000c0)={0x2}) 15:29:45 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0xa841) write$qrtrtun(r0, 0x0, 0x0) 15:29:45 executing program 5: pipe2$watch_queue(&(0x7f0000000200)={0xffffffffffffffff}, 0x80) read$watch_queue(r0, &(0x7f0000000240)=""/196, 0xc4) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r2 = syz_open_dev$tty1(0xc, 0x4, 0x3) syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), r1) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r4, &(0x7f0000000440)={&(0x7f0000000240), 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x14, r3, 0x1}, 0x14}}, 0x0) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r6, &(0x7f0000000440)={&(0x7f0000000240), 0xc, &(0x7f0000000400)={&(0x7f00000003c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r5, @ANYBLOB="01010000002c7e079f3cdb101900"], 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000600)=ANY=[@ANYBLOB="4400000089f8fbbb1f53e4a3ac136909ecc183bbda2bc3c8666861274de70a5ca65d489db65abb9dfa427f8d3972b63d03a317756cd62fcae359345a71dac6a88448596bd62f8553ea0b4e8f6ec0b13d55ec834aab36d3c11637e0a9694b2891b7ec43c9f46115fdd2e2e91f71c45c8696431bb5a8af53cc31ffe52fa0d000"/140, @ANYRES16=r5, @ANYBLOB="080029bd7000ffdbdf2503000000050014000300000006001a004e2200000c001000070000000000000014002000fe80000000000000000000000000003e"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x1) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000080)) write$qrtrtun(r1, &(0x7f0000000000)="de8138", 0xf85) pipe2$watch_queue(&(0x7f0000000200), 0x80) (async) read$watch_queue(r0, &(0x7f0000000240)=""/196, 0xc4) (async) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) syz_open_dev$tty1(0xc, 0x4, 0x3) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), r1) (async) syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$L2TP_CMD_SESSION_CREATE(r4, &(0x7f0000000440)={&(0x7f0000000240), 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x14, r3, 0x1}, 0x14}}, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$L2TP_CMD_SESSION_CREATE(r6, &(0x7f0000000440)={&(0x7f0000000240), 0xc, &(0x7f0000000400)={&(0x7f00000003c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r5, @ANYBLOB="01010000002c7e079f3cdb101900"], 0x14}}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000600)=ANY=[@ANYBLOB="4400000089f8fbbb1f53e4a3ac136909ecc183bbda2bc3c8666861274de70a5ca65d489db65abb9dfa427f8d3972b63d03a317756cd62fcae359345a71dac6a88448596bd62f8553ea0b4e8f6ec0b13d55ec834aab36d3c11637e0a9694b2891b7ec43c9f46115fdd2e2e91f71c45c8696431bb5a8af53cc31ffe52fa0d000"/140, @ANYRES16=r5, @ANYBLOB="080029bd7000ffdbdf2503000000050014000300000006001a004e2200000c001000070000000000000014002000fe80000000000000000000000000003e"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x1) (async) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000080)) (async) write$qrtrtun(r1, &(0x7f0000000000)="de8138", 0xf85) (async) 15:29:45 executing program 1: write$qrtrtun(0xffffffffffffffff, &(0x7f0000000300)="9f", 0x1) (async, rerun: 64) pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (async, rerun: 64) syz_io_uring_setup(0x176f, &(0x7f0000000080), &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)) syz_io_uring_submit(r1, 0x0, &(0x7f0000000180)=@IORING_OP_WRITE_FIXED={0x5, 0x0, 0x0, @fd_index}, 0x8a86c60) syz_io_uring_setup(0x5fe7, &(0x7f0000000140)={0x0, 0xcc40, 0x0, 0x2, 0xf8, 0x0, r0}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000001c0), &(0x7f0000000200)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x5, 0x0, 0x7fffffff, 0x0, &(0x7f0000000340)="77a883c1e79f32745169ebba52844398342f69b46db70c08c5ee904427252c644c3fa0a27580256829deb347c96e5ef897759e6a706d723b93080584b13c528aec3b68553169766e977fb62629f07e1e17824827493affc38e2a3535ed733308cbec5295263bbae5838a60b9f511a7cb99186a4cfc2423ad94ee7c55a84bfbfc0f868c061ae20c2cf6f444ed793367f8fb3ead9aa5e458131f9dac088958294131ddd7200d84f55a1dfbd38e3b435cdd5c2b9e052f8d7b1e1ce2de58d546c2fb83689bc32b5ab099806ce57aeeb6278a3654948ad6370b602afdf1aa8492157d94d2fa6d0cdecaac079124c9be9830edde512b4d3eca758d6c037eaae584c0b0e8551ee11aa38c6f9c59daa75495ab555ec425c9008a557feb45b22ec8fc9f58eb2225956b03322b07f37bd52c4ec2244d7551f58849e2f1ae242e97029a4d26e1567827826b5855d95a64bef4663d08deeddbf6418ffb5f1d0defd0dfdb45025b6ab2a69d670991bfca2e126f6496dc6471513dba3019c0e6ffd3e56d8a4fd05f2485b5884c047d77a2cd6a5f747a4ed13e04ee86e7fd6a150083b964386383902ee5a1665045496d7558d64e9ce207a445c78fceb9fcaf9f97ba66819c45f065726e02b9e442b2a2b7c7d50de15b6bfeeb6db7610efb8a8f8f38456855f99b53a5e4095ced43ba90a84f5471cf8a77c27bbdd8c6d5891a34f16c7686060e084ebee51a6439c73d02919173c90150e462b326987f0382a802e6f1a0990a6d0b2498e5c0e1defdbfab871f0d2f3d8eeb40c72d02401ad3db50d44eb4df6a7765e9198482ef601474f263fcacd63634a52010e44ba24aa7e3d9e2a9bc1cb1c7b4b061aec39574044cc808c7415422737a31c51f1f5ea970ce80500f55389cc8e31c0514c6bee098439f9a479c54cc83e645fe8ef523fa8898867c267fa7b1ff668a39943657fc5694e9cc27adaae2577b05d9562edb6513d473a3ab464981a5adf3f6dbeecb889e8039ff50b0782967de09cfbe6a27dd92d6a01e0c702109de6af18af287996e3af27ed37cb279d04df5da003f89edb40163573cb1d8ac9a10bb55999cca5dbb2fa6150880a8b9e2e36b33ecc415a7df57e320e0e966b98bfcd34dfe7651f3309d0314e860df57c095a360b823bcf7ed3e28bc9d31a3a044ba23be3b343ae10bc7db6d759d0d4d105755b71467c24d65ee8178710de13096e61cfb3ef2ffee2fba433db48afd52c8062579d62baf4deaf3f0927b378f3df47b5e9c575b8a2391d577c2fb263ca4fbc016586dfa9c10a1d14768ce314a36a1f2653cbd2611607b4f62f2eb3b1ae6e4badd546530d6c6535b73a1d99c0688efe5b3e5b77ff396e4f7d39fa2b51aaadf5e091f4534951ee54985800ce5be3ac7f9c7038e8546b72b5a09796e896be49b57afa9f678786f96d850f3018de0ebdd53de23c0a2a5da33fe6fd8b013ff758ea2b4011c296a83596ace3dd06f0144fed348dda1ef7dfaea92f99ae7b6f74815f7fabfbab5d860eeba2c924d2ec935515ce94845c17faa3aa7ced00bf1a2722bbc7c9e7c13fa0f6a25fbcddaeb23135c18a5149c2ecbfb14a3f0130ae4d6e3817b49d021d7710371d7bd292e542308bfd32abe5f960c8d4ba99f77b18967cdcce0bb26ca5a9ca5f76c264b11b006a71c60aa2fdcefe9fd2516c4aa647a08806b4613752108c95c075f29459ca758cbae996a3e0329c54acb9f247c691bf129fb69177804d7de9d07b37724aff8eeb773c27a0e330cf275b728e81fc7a9398bbead3ec69283a84140c3e0869fee301de402e1e93d2dcf75c52bc21c1aae37c3435959b77aee7d0aee08721283f65c811a3c96abdd0bf5f222d9a4ce8e80e72aacdddc189b0c165a8cc03218a758d700267fe884b1424f469be038ff0fffa799824636e987cfaf34ac9dff0b82e49e3c83e711163b4670b63f103a044d82a406f7c74c92d9b2d6aa53f7c3d1fc719e62df55c9484773caa2a075eba58a0eace39d6234e3e11c8ef9cc73663ca8542aac87f09ff65b043ba76cd2da9be91efe16fe7217be969f3c4eeca68e35b846ab9f678841526821f7f8164b9dddcf99f920d2d3134169b376b03ebb31a0b3f958e6a55a066ed38ffb6f737e76734aeb9de977891be708d01d9347fe90b75111e0da7e23eafceca3e42490a2b6ccc2bad515d7c157471914f323d139cd9bb8213727a9f63e11376e856202c1a714c89da13ce0235bdbdf7329da3ca859b1b44cbbae2474e16b9ee2c442b5963aa1a1133d7257d629defd2ab1e61febd33a8cf0eb85ed6169f68c2da9e3321b76af1e81592dde37e82e3fa5caca200e4e0b734fc6a3d940a4ee8156acc03c4d92ab87f3bab359da1484fd1fd3b95ccd0739d35343fd3f87ab7aa561c7c9a19b44722e4ac75568038e1b0a5614a6cc679fb4870c325b2fa487b4ed619a51f1dcb9981a8f292c1ab058632ada2469d0d374cb32f2a2b8f4fd9273d77641c25add32e3291bc625c66181d0c87034f2dc99ca87245092b94921b9f8d7f2cd42a90ba8f53159924c2191990b04b500ec84bae752731a8683ae42ff5b70de5ebec2f5b536b6aa4b3391c06e43e9150b8c1679e6560db65414ff5a328ee8d2e9e00324c7215aedd7795c633a73ef47230405961cd990d230217539bf670bcd9f7711e207eee8c4b42ede4719e4e5093897eba42ef9a57b03736975e3c6393498eca4c5dddc8b5a797381b65840fa98b139816f653a035ff4e133425fc6c64d666f9a94cc17397becc6437670334955957367a0a6c656cc874a3c7a1ac9627b0c53b6076bed362c1329227b366066c30cee49b5aeb60ab8f10981e4f8a0d6f47cc5debc79fedaded5401b29e1738f66700d36c019da3753c74d156558dcd50417a0c5b635b3a62367912b60e050971441b9e83841603bdcf8f9d462e4022cfcae16372197b6ec6d3b5957c283690ee78f9c7af496692f0f90f08d982f42d2e4847f0b8ced3042ab9fcc9e1a423a5e056630df93db19333bc8559d465f2717d36bb4a6bc62df9465e707e2cc81d87bfff071b0df7ec00f20eb5d241d5850526b6c3a5992b9f79746b7e397c450c339630fd494fd76912847089ee76221f723bfda66cfbb11074d40d14bb75c205cf17833865a6ece59082400da27ad6dfd60f338c88edd4fc548b0f9668225a8596f2c462d620513df3cfdcfed69c769b8b71384493bdc6036aac46b4be39668f6c0aaaed892e6f54c511ddb15c7c6a386d4562f11a87a334725ffa92f51a4816332e9aae408656abcc0d87e9635b215cdb232653396a1d15bf0640913aa2dc50edc51657eeaacedc9a98e262f57e9355be04faae97aacd7bf84f53557520e69f8b207d76019d6131181d564e9ee57131a2d2c47103c88880d73c687e9e7375264dd17bff06e8e0ed6f91ae99549e227f2b7d9beb2666615356b5a537c1e936142665ef882b43fe9c7adec5bb73ec9533995224412f95c1fd17e00c0650122d5113e46c3e0fcec95a1d97d61478576c32c2a91ef4568625cb71ebc52df2140915206998a236dbdd6f5404c2463db65ece18e0719eaf23fe19e39b67051a3c2086451684d05b9a01664959ea59e8d435d2f432719486d5ffd2ec73ee31f8c37f9ecdb6ac996b14f418914ad49e6a96b6ee3de3e3d61eb7452a0e8d302a0126c137c91be20afe84557db13e16d8bf8a3cd9c025817433a63aac7a77fce4158385cc4c1505de0aa93870f134b424bbdaaeb3efccaa79c164e8ab934e867904acea8aa2e6ee630487de9c4ea6bbf5b4ccb397e608b2ef7120545fb4334744058cd4c36da477638a7fccf4444fb4be1154dd63426eade040fa2702c724db8f9d28104b13ffc5223a6d476520c47565eab6149ede4a9fa6a9d5fcb2906c0854413074f3f2c1a02a024e6236bd8091a76fd7991e4be72d3e4b627b46d3cf82fbb282c2825459edcaee769d00ae5425457b3c5b92b232ccf1dc1caa764a467ea5cfaaea04ea877ad74b63bb90652c8180bccf9345adf1333587301148a390e13cb0c52c5dd10246c9f66fe538e9db8c06b687b25ca9016085b8b497b019f7e2d512261998d46b130a9292fb0fce483959508fbbe311bf061065adddbac0ebc7b94f03e0d1d27a7aeaf02810b4b92b37f9c435f9c5adc94a17dd119d9d929f37f6a8812d915d0c60919a3ffcfee896964cb298d282c868431f0e57ebc543a7a539def7e45893bfe4bf7da23b3f101d637a751e59b31de870c8fab2fe2e91893303e96fdc52604a49a69f8ac35c544ef56cf263bf90719eacd6806391b8ec62b86380a5ebbf743b6f588249fee625997b06d857b66be4789b1d50b063a4f0aa6a7567989d6f771e60dcc09566b80e106ae6fd3bedacadf97bc16d612f3d7c3a4a8394c5e4c3bf36a37a01649f755d65d71ef30f83453e5290e5ede479d8c450e09642e70e07733dd1cc1fca1ad109f441cba947f90ddb560f99e09275d783bc8a221cd02e79a9ce58613569c67f05957a325ff5e21ec5c65089a235422f31e9453910956db2e19fd4389c229f4edbb967f770d56afdc6ee709447d4ec6776d57abbc038652ea7ce364db846c8dcfa07dc61048dbbc4253e29b624665dde8da68678176f98fc9a0c4b7540d94f3cc55d8ef7d0acf7c26b2339cac6f3da779fab830ae9c7271d34e8f237465d67e608a110c9b86e092e2e221bb042a94cb60b0129182ee8a2da5ba9aac57a981594796610552b7c376bba16c50aa2bd57f7241674ac17622fd06e4e138e1fdf97ecbe1dd1ba5b3dd420aaec74fedc8cab7334e0619991b591d79f2c1d8f6c8af5283cf9966bd2ae79b03a302fbdd8ba40552778aa1176934ce385562d4b0dac32eb04153d36f1a025cc7aecf3ef9156b27a1fe6d22af78c43c3111c8046f9877e3c0abdf00bb0d2f216c452159ced33d2b946be8e8a1d9a7e4f58e9f9133732d4babfa02edb4b8c2b86ddadeeabfb960199c8c1b11b64f55f8e4e901929de451b06f9b5905abe113546c5e4141896de66d1cc0d5427890e3e54cecbb4c40ab3e2c30e35e835a3bc59ef7587f8008f3222ab9dbddaefc1acb69cde12e189627de86cd37e7bae3678abc0b2dc62958878c6b72dac79f9b507de97b603bd54956619bc361973671fc702a17f1b14a3e1b188844f7681625036fd585c1a44f738cb62d11cbfe739f1481186502a396e3fd02ff5c2a76f0df4601df0deab0cf0534f725e75825f974d644ffadd01279aac3cd9bf155e98d1fcd673e5031e57054430cc0fdff6f5c53a7ac18215b1f27e3b7360429ceb5442e2ceda6544961e35570804dcbd888a37d2169859955873d9b5bd1a586739d24bab6a05c545361f1405c215073f32f41111471425449f29bb6f20644cf04efeb0f02bc426d6aa1cb03b362d328b33f4c50ce3fc05334f600c98e72b599888e1a86e08eaf1bdabc5b047581f2ca36a1eef7d7d60ebcb07c915efb04c761359f6830ddf7535ccfe51b36ec7b58c04ac944a96acca39caefce84486fdda957c9245d3e46e4478a71426b0149a79125603049c069652b8a77ca879085817dd245c8162294127d3ffaffb4065564995be2fc9a7a2bdbc80793b5bfbdab469664fa3e77097d44ae38f09f376a441997cce708f41fd1071ec1781d2381ffa400f03180878adc5250be23316ef9309b9d3c234726e15c7f04957443f6ef976d2c55579a00cb2efa2dafc2938175e8982e7da470d3fbd13670a24915a07ab83c24ee016dfbad650a3531d4e61342dd6c6f0af04abf83e2329", 0x5f3, 0x0, 0x0, {0x1}}, 0x80) (async, rerun: 64) openat$cgroup_ro(r0, &(0x7f0000000080)='blkio.bfq.avg_queue_size\x00', 0x0, 0x0) (rerun: 64) socketpair(0x15, 0x5, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) semget$private(0x0, 0x2, 0x665) (async) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r6, 0x10000000) openat$cgroup_devices(r6, &(0x7f0000001400)='devices.deny\x00', 0x2, 0x0) sendmsg$TIPC_CMD_SHOW_STATS(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r4, 0x233}, 0x1c}}, 0x0) (async) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r3, &(0x7f00000013c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000001380)={&(0x7f0000001340)={0x1c, r4, 0xca354e586da9bcbc, 0x70bd29, 0x25dfdbff, {}, ["", "", "", "", ""]}, 0x37}, 0x1, 0x0, 0x0, 0x40040c0}, 0x44010) (async) pipe2$watch_queue(&(0x7f0000000000), 0x80) (async) pipe2$watch_queue(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) write$qrtrtun(r7, &(0x7f0000000100)="cb73a3fbfa77f7a4577f3bf7269b7b0005338f8138", 0x62) 15:29:45 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder0\x00', 0x804, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1000, 0x3}) (async, rerun: 64) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r2, 0x5760, 0xc) (async, rerun: 64) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) write$tcp_mem(r1, &(0x7f0000000080)={0x4, 0x20, 0x9e3, 0x20, 0x8}, 0x48) 15:29:45 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) r1 = openat$cgroup_ro(r0, &(0x7f0000000080)='devices.list\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f00000000c0)={0x2}) 15:29:45 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0xa841) write$qrtrtun(r0, &(0x7f0000000300), 0x0) 15:29:45 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r1, &(0x7f0000000540)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x30, 0x0, 0x200, 0x70bd25, 0x25dfdbfd, {{}, {}, {0x14, 0x19, {0x101, 0x40, 0xe07, 0x800}}}, ["", "", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x4000810}, 0x20048004) sendmsg$TIPC_CMD_SET_NETID(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x5c, 0x0, 0x4, 0x70bd2d, 0x7c4, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @loopback}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private0}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x5}, @L2TP_ATTR_MTU={0x6, 0x1c, 0xfbff}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @mcast2}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8000}, 0x5) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r2, &(0x7f0000000000)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000380)={0x20, 0x0, 0x300, 0x70bd2a, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0xe55, 0x72}}}}, ["", "", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x4008800}, 0x80) r3 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r3, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), r0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x58}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x24, r4, 0x1, 0x70bd2b, 0x25dfdbff, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x3f}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @remote}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008001}, 0x20004041) write$qrtrtun(r3, &(0x7f00000003c0)="de8138865bd1fbb1cb622dc43bb9725ef4f8adb44b6ed2004af2d5854d56039d59cec87c7355ce0145a64f1e6349f7beca58b52129a155bc681cf2c3813f9bf1333245adfc0cd3dc70fd72d4b408f3271a14c7233b5d77d6cd951a10b19d35d9d48f94f128d0f61e7f93d69dd66521e31f8d956c9af52d122781d85c01b87a25bfe823b3deeae83685d3d45da9d24516081380b3fc1bb77ee5cc2e0b0883ca9918efed10ff0960d6b276e194cc53df2cdf40fef1d0b5ce71cd44428ab5fa39ca164f8ea3500aeb3694e45d2e1ec295337370a8c48d205d11a00c1b10d074536a9d4012d7ff4f8e1a9fd4e307114db0ea5b9d7ddf75ca699cf1c1d40f", 0xfc) r5 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r5, 0x10000000) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r5, 0xc0a85352, &(0x7f0000000080)={{0x5, 0x81}, 'port0\x00', 0x0, 0x10413, 0x0, 0x39e0, 0xfff, 0x3, 0x6, 0x0, 0x2, 0x7}) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r1, &(0x7f0000000540)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x30, 0x0, 0x200, 0x70bd25, 0x25dfdbfd, {{}, {}, {0x14, 0x19, {0x101, 0x40, 0xe07, 0x800}}}, ["", "", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x4000810}, 0x20048004) (async) sendmsg$TIPC_CMD_SET_NETID(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x5c, 0x0, 0x4, 0x70bd2d, 0x7c4, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @loopback}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private0}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x5}, @L2TP_ATTR_MTU={0x6, 0x1c, 0xfbff}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @mcast2}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8000}, 0x5) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r2, &(0x7f0000000000)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000380)={0x20, 0x0, 0x300, 0x70bd2a, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0xe55, 0x72}}}}, ["", "", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x4008800}, 0x80) (async) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r3, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), r0) (async) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x58}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x24, r4, 0x1, 0x70bd2b, 0x25dfdbff, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x3f}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @remote}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008001}, 0x20004041) (async) write$qrtrtun(r3, &(0x7f00000003c0)="de8138865bd1fbb1cb622dc43bb9725ef4f8adb44b6ed2004af2d5854d56039d59cec87c7355ce0145a64f1e6349f7beca58b52129a155bc681cf2c3813f9bf1333245adfc0cd3dc70fd72d4b408f3271a14c7233b5d77d6cd951a10b19d35d9d48f94f128d0f61e7f93d69dd66521e31f8d956c9af52d122781d85c01b87a25bfe823b3deeae83685d3d45da9d24516081380b3fc1bb77ee5cc2e0b0883ca9918efed10ff0960d6b276e194cc53df2cdf40fef1d0b5ce71cd44428ab5fa39ca164f8ea3500aeb3694e45d2e1ec295337370a8c48d205d11a00c1b10d074536a9d4012d7ff4f8e1a9fd4e307114db0ea5b9d7ddf75ca699cf1c1d40f", 0xfc) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r5, 0x10000000) (async) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r5, 0xc0a85352, &(0x7f0000000080)={{0x5, 0x81}, 'port0\x00', 0x0, 0x10413, 0x0, 0x39e0, 0xfff, 0x3, 0x6, 0x0, 0x2, 0x7}) (async) 15:29:45 executing program 3: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) 15:29:46 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f00000000c0), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) r1 = syz_open_dev$vcsa(&(0x7f0000000080), 0x13f, 0x208a02) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8901, 0x0) syz_clone(0x200, &(0x7f0000000100)="9d2e5a0d05528b0d299f712728a306ea407002f654b0b1bbea74f7dc7d8e14be470b2371ed8737dff671453f01e70d0b2b99731a0f44d4de0cc5e4940579fc3f0e236d555f899936d6c81b085a2d968f98573b1571c6bf8736cde2274b1bb561758ebdd7917f991764d0eb63b7bdec0e9d511516525f62e9f3cad8fdb2468178b93aef2a", 0x84, &(0x7f0000000040), &(0x7f00000001c0), &(0x7f0000000200)) write$qrtrtun(r1, &(0x7f0000000000)="de8138", 0x3) 15:29:46 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0xa841) write$qrtrtun(r0, &(0x7f0000000300), 0x0) [ 3279.153505][T23898] ================================================================== [ 3279.161744][T23898] BUG: KCSAN: data-race in ksys_write / ksys_write [ 3279.168342][T23898] [ 3279.168350][T23898] write to 0xffff88811d640f68 of 8 bytes by task 23882 on cpu 1: [ 3279.168365][T23898] ksys_write+0x11b/0x1a0 [ 3279.168383][T23898] __x64_sys_write+0x3e/0x50 [ 3279.168398][T23898] do_syscall_64+0x2b/0x70 [ 3279.168417][T23898] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 3279.168436][T23898] [ 3279.168440][T23898] read to 0xffff88811d640f68 of 8 bytes by task 23898 on cpu 0: [ 3279.168455][T23898] ksys_write+0xa9/0x1a0 [ 3279.168470][T23898] __x64_sys_write+0x3e/0x50 [ 3279.168485][T23898] do_syscall_64+0x2b/0x70 [ 3279.168501][T23898] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 3279.168519][T23898] [ 3279.168521][T23898] value changed: 0x0000000000000000 -> 0x000000000000001f [ 3279.168531][T23898] [ 3279.168534][T23898] Reported by Kernel Concurrency Sanitizer on: 15:29:46 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x5b, 0xa400) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:46 executing program 5: pipe2$watch_queue(&(0x7f0000000200)={0xffffffffffffffff}, 0x80) read$watch_queue(r0, &(0x7f0000000240)=""/196, 0xc4) (async) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r2 = syz_open_dev$tty1(0xc, 0x4, 0x3) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), r1) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r4, &(0x7f0000000440)={&(0x7f0000000240), 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x14, r3, 0x1}, 0x14}}, 0x0) (async) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r6, &(0x7f0000000440)={&(0x7f0000000240), 0xc, &(0x7f0000000400)={&(0x7f00000003c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r5, @ANYBLOB="01010000002c7e079f3cdb101900"], 0x14}}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000600)=ANY=[@ANYBLOB="4400000089f8fbbb1f53e4a3ac136909ecc183bbda2bc3c8666861274de70a5ca65d489db65abb9dfa427f8d3972b63d03a317756cd62fcae359345a71dac6a88448596bd62f8553ea0b4e8f6ec0b13d55ec834aab36d3c11637e0a9694b2891b7ec43c9f46115fdd2e2e91f71c45c8696431bb5a8af53cc31ffe52fa0d000"/140, @ANYRES16=r5, @ANYBLOB="080029bd7000ffdbdf2503000000050014000300000006001a004e2200000c001000070000000000000014002000fe80000000000000000000000000003e"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x1) (async) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000080)) (async) write$qrtrtun(r1, &(0x7f0000000000)="de8138", 0xf85) 15:29:46 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0xa841) write$qrtrtun(r0, &(0x7f0000000300), 0x0) 15:29:46 executing program 3: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) 15:29:46 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f00000000c0), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) r1 = syz_open_dev$vcsa(&(0x7f0000000080), 0x13f, 0x208a02) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8901, 0x0) (async) syz_clone(0x200, &(0x7f0000000100)="9d2e5a0d05528b0d299f712728a306ea407002f654b0b1bbea74f7dc7d8e14be470b2371ed8737dff671453f01e70d0b2b99731a0f44d4de0cc5e4940579fc3f0e236d555f899936d6c81b085a2d968f98573b1571c6bf8736cde2274b1bb561758ebdd7917f991764d0eb63b7bdec0e9d511516525f62e9f3cad8fdb2468178b93aef2a", 0x84, &(0x7f0000000040), &(0x7f00000001c0), &(0x7f0000000200)) (async) write$qrtrtun(r1, &(0x7f0000000000)="de8138", 0x3) 15:29:46 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767", 0x10) 15:29:46 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) r1 = openat$cgroup_ro(r0, &(0x7f0000000080)='devices.list\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f00000000c0)={0x2}) 15:29:46 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x5b, 0xa400) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:46 executing program 3: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) [ 3279.168540][T23898] CPU: 0 PID: 23898 Comm: syz-executor.0 Not tainted 5.19.0-syzkaller-dirty #0 [ 3279.168559][T23898] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 [ 3279.168569][T23898] ================================================================== 15:29:46 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:46 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x5b, 0xa400) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:46 executing program 3: setsockopt$TIPC_MCAST_BROADCAST(0xffffffffffffffff, 0x10f, 0x85) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x1) ioctl$SNDRV_TIMER_IOCTL_STATUS64(r0, 0x80605414, &(0x7f0000000080)) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:46 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f00000000c0), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) r1 = syz_open_dev$vcsa(&(0x7f0000000080), 0x13f, 0x208a02) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8901, 0x0) (async) syz_clone(0x200, &(0x7f0000000100)="9d2e5a0d05528b0d299f712728a306ea407002f654b0b1bbea74f7dc7d8e14be470b2371ed8737dff671453f01e70d0b2b99731a0f44d4de0cc5e4940579fc3f0e236d555f899936d6c81b085a2d968f98573b1571c6bf8736cde2274b1bb561758ebdd7917f991764d0eb63b7bdec0e9d511516525f62e9f3cad8fdb2468178b93aef2a", 0x84, &(0x7f0000000040), &(0x7f00000001c0), &(0x7f0000000200)) write$qrtrtun(r1, &(0x7f0000000000)="de8138", 0x3) 15:29:46 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) socket$inet_udp(0x2, 0x2, 0x0) r1 = request_key(&(0x7f0000000040)='cifs.spnego\x00', &(0x7f0000000080)={'syz', 0x3}, &(0x7f00000000c0)='/dev/vcsa#\x00', 0xffffffffffffffff) request_key(&(0x7f0000000140)='ceph\x00', &(0x7f0000000000)={'syz', 0x2}, &(0x7f00000001c0)='/dev/vcsa#\x00', r1) add_key(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz', 0x0}, &(0x7f0000000100), 0x0, r1) 15:29:46 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x25dfdbfc, {{}, {}, {0x8}}}, 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r1, 0x233}, 0x1c}}, 0x0) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, r1, 0x300, 0x70bd26, 0x25dfdbfc, {{}, {}, {0x14, 0x19, {0x6, 0x57, 0x6, 0x252}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x820) r3 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r3, &(0x7f0000000000)="de8138", 0xf85) 15:29:46 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x65c, 0x400000) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) openat$cgroup(r0, &(0x7f0000000080)='syz1\x00', 0x200002, 0x0) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000100), 0x13a100) ioctl$SNDRV_TIMER_IOCTL_GINFO(r1, 0xc0f85403, &(0x7f0000000140)={{0x1, 0x0, 0x7, 0x3, 0x1ff}, 0x0, 0x6, 'id0\x00', 'timer1\x00', 0x0, 0x6, 0x2, 0x1, 0x400}) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f00000000c0)={0x2}) 15:29:46 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:46 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x25dfdbfc, {{}, {}, {0x8}}}, 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x0) (async) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r1, 0x233}, 0x1c}}, 0x0) (async) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, r1, 0x300, 0x70bd26, 0x25dfdbfc, {{}, {}, {0x14, 0x19, {0x6, 0x57, 0x6, 0x252}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x820) (async) r3 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r3, &(0x7f0000000000)="de8138", 0xf85) 15:29:46 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) ioctl$BINDER_CTL_ADD(r1, 0xc1086201, &(0x7f00000000c0)={'custom1\x00'}) write$qrtrtun(r0, &(0x7f0000000080)="de7090deea94d9e6fad2ee4a518138", 0xf) 15:29:46 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:46 executing program 3: setsockopt$TIPC_MCAST_BROADCAST(0xffffffffffffffff, 0x10f, 0x85) (async) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x1) ioctl$SNDRV_TIMER_IOCTL_STATUS64(r0, 0x80605414, &(0x7f0000000080)) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:46 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) socket$inet_udp(0x2, 0x2, 0x0) r1 = request_key(&(0x7f0000000040)='cifs.spnego\x00', &(0x7f0000000080)={'syz', 0x3}, &(0x7f00000000c0)='/dev/vcsa#\x00', 0xffffffffffffffff) request_key(&(0x7f0000000140)='ceph\x00', &(0x7f0000000000)={'syz', 0x2}, &(0x7f00000001c0)='/dev/vcsa#\x00', r1) add_key(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz', 0x0}, &(0x7f0000000100), 0x0, r1) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) request_key(&(0x7f0000000040)='cifs.spnego\x00', &(0x7f0000000080)={'syz', 0x3}, &(0x7f00000000c0)='/dev/vcsa#\x00', 0xffffffffffffffff) (async) request_key(&(0x7f0000000140)='ceph\x00', &(0x7f0000000000)={'syz', 0x2}, &(0x7f00000001c0)='/dev/vcsa#\x00', r1) (async) add_key(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz', 0x0}, &(0x7f0000000100), 0x0, r1) (async) 15:29:46 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x65c, 0x400000) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) openat$cgroup(r0, &(0x7f0000000080)='syz1\x00', 0x200002, 0x0) (async) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000100), 0x13a100) ioctl$SNDRV_TIMER_IOCTL_GINFO(r1, 0xc0f85403, &(0x7f0000000140)={{0x1, 0x0, 0x7, 0x3, 0x1ff}, 0x0, 0x6, 'id0\x00', 'timer1\x00', 0x0, 0x6, 0x2, 0x1, 0x400}) (async) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f00000000c0)={0x2}) 15:29:46 executing program 3: setsockopt$TIPC_MCAST_BROADCAST(0xffffffffffffffff, 0x10f, 0x85) (async) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x1) ioctl$SNDRV_TIMER_IOCTL_STATUS64(r0, 0x80605414, &(0x7f0000000080)) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:46 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x25dfdbfc, {{}, {}, {0x8}}}, 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r1, 0x233}, 0x1c}}, 0x0) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, r1, 0x300, 0x70bd26, 0x25dfdbfc, {{}, {}, {0x14, 0x19, {0x6, 0x57, 0x6, 0x252}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x820) r3 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r3, &(0x7f0000000000)="de8138", 0xf85) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$TIPC_CMD_SET_NETID(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x25dfdbfc, {{}, {}, {0x8}}}, 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x0) (async) syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$TIPC_CMD_SHOW_STATS(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r1, 0x233}, 0x1c}}, 0x0) (async) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, r1, 0x300, 0x70bd26, 0x25dfdbfc, {{}, {}, {0x14, 0x19, {0x6, 0x57, 0x6, 0x252}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x820) (async) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r3, &(0x7f0000000000)="de8138", 0xf85) (async) 15:29:46 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee241", 0x9) 15:29:46 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async, rerun: 64) socket$inet_udp(0x2, 0x2, 0x0) (rerun: 64) r1 = request_key(&(0x7f0000000040)='cifs.spnego\x00', &(0x7f0000000080)={'syz', 0x3}, &(0x7f00000000c0)='/dev/vcsa#\x00', 0xffffffffffffffff) request_key(&(0x7f0000000140)='ceph\x00', &(0x7f0000000000)={'syz', 0x2}, &(0x7f00000001c0)='/dev/vcsa#\x00', r1) (async) add_key(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz', 0x0}, &(0x7f0000000100), 0x0, r1) 15:29:46 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x65c, 0x400000) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async, rerun: 32) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (rerun: 32) openat$cgroup(r0, &(0x7f0000000080)='syz1\x00', 0x200002, 0x0) (async) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000100), 0x13a100) ioctl$SNDRV_TIMER_IOCTL_GINFO(r1, 0xc0f85403, &(0x7f0000000140)={{0x1, 0x0, 0x7, 0x3, 0x1ff}, 0x0, 0x6, 'id0\x00', 'timer1\x00', 0x0, 0x6, 0x2, 0x1, 0x400}) (async) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f00000000c0)={0x2}) 15:29:46 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee241", 0x9) 15:29:46 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000140)="1f", 0x1) pipe2$watch_queue(&(0x7f0000000100), 0x80) openat$cgroup(r0, &(0x7f0000000000)='syz1\x00', 0x200002, 0x0) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000180), 0x5ed442) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) write$qrtrtun(r1, &(0x7f0000000080)="214ab7cb57917560979ce9afc4fe1f969a1fd93424564186a457db5f50920b32eb1c9aa9abef76646d211c8aa63a4506ccfddac0d55bc4cc9cc68ff622d1f86ac01be6271ddfc02c254b6781212473cd02d79a9fadc2ff4a97ff23be8ee3e54ae92138a18a029ee18fcbe7e99ed62d85a36b4eea88f9fc22", 0x78) 15:29:46 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async, rerun: 64) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (rerun: 64) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) ioctl$BINDER_CTL_ADD(r1, 0xc1086201, &(0x7f00000000c0)={'custom1\x00'}) write$qrtrtun(r0, &(0x7f0000000080)="de7090deea94d9e6fad2ee4a518138", 0xf) 15:29:46 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) ioctl$BINDER_GET_EXTENDED_ERROR(r0, 0xc00c6211, &(0x7f0000000080)) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:46 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000140)="1f", 0x1) pipe2$watch_queue(&(0x7f0000000100), 0x80) openat$cgroup(r0, &(0x7f0000000000)='syz1\x00', 0x200002, 0x0) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000180), 0x5ed442) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) write$qrtrtun(r1, &(0x7f0000000080)="214ab7cb57917560979ce9afc4fe1f969a1fd93424564186a457db5f50920b32eb1c9aa9abef76646d211c8aa63a4506ccfddac0d55bc4cc9cc68ff622d1f86ac01be6271ddfc02c254b6781212473cd02d79a9fadc2ff4a97ff23be8ee3e54ae92138a18a029ee18fcbe7e99ed62d85a36b4eea88f9fc22", 0x78) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000140)="1f", 0x1) (async) pipe2$watch_queue(&(0x7f0000000100), 0x80) (async) openat$cgroup(r0, &(0x7f0000000000)='syz1\x00', 0x200002, 0x0) (async) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000180), 0x5ed442) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) write$qrtrtun(r1, &(0x7f0000000080)="214ab7cb57917560979ce9afc4fe1f969a1fd93424564186a457db5f50920b32eb1c9aa9abef76646d211c8aa63a4506ccfddac0d55bc4cc9cc68ff622d1f86ac01be6271ddfc02c254b6781212473cd02d79a9fadc2ff4a97ff23be8ee3e54ae92138a18a029ee18fcbe7e99ed62d85a36b4eea88f9fc22", 0x78) (async) 15:29:46 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee241", 0x9) 15:29:46 executing program 2: r0 = gettid() r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffa, 0x25a1c1) write$qrtrtun(r1, &(0x7f0000000140)="9f4afef285abdee2412783b6723f0767a0c4f3380003bf481e5782d961784087824be165671856e03147cc46c72bcf8335b9f8f25e30a8c5c4afb3b7e785df13b89ed80f88b4c3876953a330effbc06e0c618ad96270c2eadf3ec48470a755a5", 0x60) write$qrtrtun(r1, &(0x7f0000000080)="de8138", 0x3) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r1, 0x40485404, &(0x7f00000000c0)={{0x3, 0x2, 0x7, 0x3, 0x3}, 0xeae0, 0x4}) setsockopt$MRT_DEL_VIF(0xffffffffffffffff, 0x0, 0xcb, &(0x7f00000001c0)={0x1, 0x1, 0x8, 0x800, @vifc_lcl_addr=@empty, @empty}, 0x10) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder-control\x00', 0x800, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_DISABLE_BEARER(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYRESHEX=r1, @ANYRESDEC=r0, @ANYBLOB="00022abd7000fedb000002410000001000137564703a73797a31000008000000000000000000498f06f3b95919063a67b73b298f60c94df10097db9da5860555d646daa384326b64c898ebac282c26ecb4470f054a67d32509921ba8646767fc926e2fb17d1b433b63c7e50de7a2079254a23ed0924a4b240500000095a7fa4e10d64003a3abcaa49e9e022a75064a35e688383598ebfeffffffffffffff59dcc79242e132ee575a3273a0bb5a07ee0610760ebc4f21b100000000000000", @ANYRES8=r1], 0x2c}, 0x1, 0x0, 0x0, 0x8040}, 0x40) 15:29:46 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) ioctl$BINDER_GET_EXTENDED_ERROR(r0, 0xc00c6211, &(0x7f0000000080)) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:46 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0xf}) 15:29:46 executing program 2: r0 = gettid() (async) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffa, 0x25a1c1) write$qrtrtun(r1, &(0x7f0000000140)="9f4afef285abdee2412783b6723f0767a0c4f3380003bf481e5782d961784087824be165671856e03147cc46c72bcf8335b9f8f25e30a8c5c4afb3b7e785df13b89ed80f88b4c3876953a330effbc06e0c618ad96270c2eadf3ec48470a755a5", 0x60) (async) write$qrtrtun(r1, &(0x7f0000000080)="de8138", 0x3) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r1, 0x40485404, &(0x7f00000000c0)={{0x3, 0x2, 0x7, 0x3, 0x3}, 0xeae0, 0x4}) (async, rerun: 32) setsockopt$MRT_DEL_VIF(0xffffffffffffffff, 0x0, 0xcb, &(0x7f00000001c0)={0x1, 0x1, 0x8, 0x800, @vifc_lcl_addr=@empty, @empty}, 0x10) (async, rerun: 32) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder-control\x00', 0x800, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_DISABLE_BEARER(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYRESHEX=r1, @ANYRESDEC=r0, @ANYBLOB="00022abd7000fedb000002410000001000137564703a73797a31000008000000000000000000498f06f3b95919063a67b73b298f60c94df10097db9da5860555d646daa384326b64c898ebac282c26ecb4470f054a67d32509921ba8646767fc926e2fb17d1b433b63c7e50de7a2079254a23ed0924a4b240500000095a7fa4e10d64003a3abcaa49e9e022a75064a35e688383598ebfeffffffffffffff59dcc79242e132ee575a3273a0bb5a07ee0610760ebc4f21b100000000000000", @ANYRES8=r1], 0x2c}, 0x1, 0x0, 0x0, 0x8040}, 0x40) 15:29:46 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b672", 0xd) 15:29:46 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) ioctl$BINDER_CTL_ADD(r1, 0xc1086201, &(0x7f00000000c0)={'custom1\x00'}) write$qrtrtun(r0, &(0x7f0000000080)="de7090deea94d9e6fad2ee4a518138", 0xf) 15:29:46 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000140)="1f", 0x1) pipe2$watch_queue(&(0x7f0000000100), 0x80) (async) openat$cgroup(r0, &(0x7f0000000000)='syz1\x00', 0x200002, 0x0) (async) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000180), 0x5ed442) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) write$qrtrtun(r1, &(0x7f0000000080)="214ab7cb57917560979ce9afc4fe1f969a1fd93424564186a457db5f50920b32eb1c9aa9abef76646d211c8aa63a4506ccfddac0d55bc4cc9cc68ff622d1f86ac01be6271ddfc02c254b6781212473cd02d79a9fadc2ff4a97ff23be8ee3e54ae92138a18a029ee18fcbe7e99ed62d85a36b4eea88f9fc22", 0x78) 15:29:46 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) ioctl$BINDER_GET_EXTENDED_ERROR(r0, 0xc00c6211, &(0x7f0000000080)) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) ioctl$BINDER_GET_EXTENDED_ERROR(r0, 0xc00c6211, &(0x7f0000000080)) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) 15:29:46 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0xf}) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0xf}) (async) 15:29:46 executing program 2: r0 = gettid() r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffa, 0x25a1c1) write$qrtrtun(r1, &(0x7f0000000140)="9f4afef285abdee2412783b6723f0767a0c4f3380003bf481e5782d961784087824be165671856e03147cc46c72bcf8335b9f8f25e30a8c5c4afb3b7e785df13b89ed80f88b4c3876953a330effbc06e0c618ad96270c2eadf3ec48470a755a5", 0x60) write$qrtrtun(r1, &(0x7f0000000080)="de8138", 0x3) (async) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r1, 0x40485404, &(0x7f00000000c0)={{0x3, 0x2, 0x7, 0x3, 0x3}, 0xeae0, 0x4}) (async) setsockopt$MRT_DEL_VIF(0xffffffffffffffff, 0x0, 0xcb, &(0x7f00000001c0)={0x1, 0x1, 0x8, 0x800, @vifc_lcl_addr=@empty, @empty}, 0x10) (async) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder-control\x00', 0x800, 0x0) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_DISABLE_BEARER(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYRESHEX=r1, @ANYRESDEC=r0, @ANYBLOB="00022abd7000fedb000002410000001000137564703a73797a31000008000000000000000000498f06f3b95919063a67b73b298f60c94df10097db9da5860555d646daa384326b64c898ebac282c26ecb4470f054a67d32509921ba8646767fc926e2fb17d1b433b63c7e50de7a2079254a23ed0924a4b240500000095a7fa4e10d64003a3abcaa49e9e022a75064a35e688383598ebfeffffffffffffff59dcc79242e132ee575a3273a0bb5a07ee0610760ebc4f21b100000000000000", @ANYRES8=r1], 0x2c}, 0x1, 0x0, 0x0, 0x8040}, 0x40) 15:29:46 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x80) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:46 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee24127", 0xa) 15:29:46 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x0) getsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000140), &(0x7f0000000180)=0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) sendmsg$TIPC_CMD_SET_NODE_ADDR(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, 0x0, 0x100, 0x70bd29, 0x25dfdbfe, {{}, {}, {0x8}}}, 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x80) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r1) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000340)={&(0x7f00000001c0), 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x5c, r2, 0x8, 0x70bd28, 0x25dfdbfc, {{}, {@val={0x8, 0x1, 0x27}, @void, @val={0xc, 0x99, {0x6, 0x16}}}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'team_slave_1\x00'}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'ip6tnl0\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4000801}, 0x80) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:46 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0xf}) 15:29:46 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x1, 0x4a801) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) r1 = socket$nl_generic(0x10, 0x3, 0x10) write$tcp_congestion(r0, &(0x7f00000000c0)='htcp\x00', 0x5) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r2, &(0x7f0000000100)={0x8}) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) 15:29:46 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x80) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x80) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) 15:29:46 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abde", 0x7) 15:29:46 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x0) getsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000140), &(0x7f0000000180)=0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) sendmsg$TIPC_CMD_SET_NODE_ADDR(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, 0x0, 0x100, 0x70bd29, 0x25dfdbfe, {{}, {}, {0x8}}}, 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x80) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r1) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000340)={&(0x7f00000001c0), 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x5c, r2, 0x8, 0x70bd28, 0x25dfdbfc, {{}, {@val={0x8, 0x1, 0x27}, @void, @val={0xc, 0x99, {0x6, 0x16}}}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'team_slave_1\x00'}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'ip6tnl0\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4000801}, 0x80) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:46 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abde", 0x7) 15:29:46 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x80) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:46 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x6c, 0x10b8c1) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r2 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f00000000c0)={0x20000000}) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:46 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abde", 0x7) 15:29:46 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x14}, 0x14}}, 0x0) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0x5, 0x20a8c1) io_uring_setup(0x4ded, &(0x7f0000000080)={0x0, 0x7af, 0x2, 0x1, 0x21f, 0x0, r1}) write$qrtrtun(r1, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x3000010, 0x30, r1, 0x8000000) syz_io_uring_setup(0x176f, &(0x7f0000000080)={0x0, 0x0, 0x2, 0xffffffff}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000200)) syz_io_uring_submit(r2, 0x0, &(0x7f0000000180)=@IORING_OP_WRITE_FIXED={0x5, 0x0, 0x0, @fd_index}, 0x8a86c60) openat$cgroup_ro(r1, &(0x7f00000001c0)='cpuset.memory_pressure_enabled\x00', 0x0, 0x0) syz_io_uring_submit(r2, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT={0xb, 0x3, 0x0, 0x0, 0x4, &(0x7f0000000140)={0x77359400}, 0x1, 0x1, 0x1}, 0x101) write$qrtrtun(r1, &(0x7f0000000000)="de8138", 0x3) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)) 15:29:46 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x20000000000ffffc, 0x20a841) r1 = syz_open_dev$vcsa(&(0x7f0000000000), 0x2, 0x44701) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) openat$cgroup_freezer_state(r0, &(0x7f0000000080), 0x2, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x1010, r2, 0x10000000) ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0) openat$cgroup_devices(r1, &(0x7f00000000c0)='devices.allow\x00', 0x2, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r3, &(0x7f0000000880)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x14, 0x0, 0x4}, 0x14}}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r5, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2fb6ca0f97df2acd}]}, 0x1c}}, 0x0) r6 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r6, 0x10000000) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000001c0), r7) getpgid(0xffffffffffffffff) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:46 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x6c, 0x10b8c1) (async) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (async) r2 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f00000000c0)={0x20000000}) (async, rerun: 64) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (rerun: 64) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:46 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0x0) getsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000140), &(0x7f0000000180)=0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) sendmsg$TIPC_CMD_SET_NODE_ADDR(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, 0x0, 0x100, 0x70bd29, 0x25dfdbfe, {{}, {}, {0x8}}}, 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x80) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r1) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000340)={&(0x7f00000001c0), 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x5c, r2, 0x8, 0x70bd28, 0x25dfdbfc, {{}, {@val={0x8, 0x1, 0x27}, @void, @val={0xc, 0x99, {0x6, 0x16}}}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'team_slave_1\x00'}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'ip6tnl0\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4000801}, 0x80) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:46 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x1, 0x4a801) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) write$tcp_congestion(r0, &(0x7f00000000c0)='htcp\x00', 0x5) (async) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async, rerun: 32) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r2, &(0x7f0000000100)={0x8}) (async, rerun: 32) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) 15:29:46 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x14}, 0x14}}, 0x0) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0x5, 0x20a8c1) io_uring_setup(0x4ded, &(0x7f0000000080)={0x0, 0x7af, 0x2, 0x1, 0x21f, 0x0, r1}) (async) write$qrtrtun(r1, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async, rerun: 64) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x3000010, 0x30, r1, 0x8000000) (rerun: 64) syz_io_uring_setup(0x176f, &(0x7f0000000080)={0x0, 0x0, 0x2, 0xffffffff}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000200)) syz_io_uring_submit(r2, 0x0, &(0x7f0000000180)=@IORING_OP_WRITE_FIXED={0x5, 0x0, 0x0, @fd_index}, 0x8a86c60) (async, rerun: 32) openat$cgroup_ro(r1, &(0x7f00000001c0)='cpuset.memory_pressure_enabled\x00', 0x0, 0x0) (async, rerun: 32) syz_io_uring_submit(r2, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT={0xb, 0x3, 0x0, 0x0, 0x4, &(0x7f0000000140)={0x77359400}, 0x1, 0x1, 0x1}, 0x101) write$qrtrtun(r1, &(0x7f0000000000)="de8138", 0x3) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)) 15:29:46 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x6c, 0x10b8c1) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r2 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f00000000c0)={0x20000000}) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) syz_open_dev$vcsa(&(0x7f0000000040), 0x6c, 0x10b8c1) (async) pipe2$watch_queue(&(0x7f0000000080), 0x80) (async) epoll_create1(0x80000) (async) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f00000000c0)={0x20000000}) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) 15:29:46 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x20000000000ffffc, 0x20a841) r1 = syz_open_dev$vcsa(&(0x7f0000000000), 0x2, 0x44701) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) openat$cgroup_freezer_state(r0, &(0x7f0000000080), 0x2, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x1010, r2, 0x10000000) ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0) openat$cgroup_devices(r1, &(0x7f00000000c0)='devices.allow\x00', 0x2, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r3, &(0x7f0000000880)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x14, 0x0, 0x4}, 0x14}}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r5, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2fb6ca0f97df2acd}]}, 0x1c}}, 0x0) r6 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r6, 0x10000000) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000001c0), r7) getpgid(0xffffffffffffffff) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) syz_open_dev$vcsa(&(0x7f0000000040), 0x20000000000ffffc, 0x20a841) (async) syz_open_dev$vcsa(&(0x7f0000000000), 0x2, 0x44701) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) openat$cgroup_freezer_state(r0, &(0x7f0000000080), 0x2, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x1010, r2, 0x10000000) (async) ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0) (async) openat$cgroup_devices(r1, &(0x7f00000000c0)='devices.allow\x00', 0x2, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r3, &(0x7f0000000880)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x14, 0x0, 0x4}, 0x14}}, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), 0xffffffffffffffff) (async) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r5, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2fb6ca0f97df2acd}]}, 0x1c}}, 0x0) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r6, 0x10000000) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000001c0), r7) (async) getpgid(0xffffffffffffffff) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) 15:29:46 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee241", 0x9) 15:29:46 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x1, 0x4a801) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) r1 = socket$nl_generic(0x10, 0x3, 0x10) write$tcp_congestion(r0, &(0x7f00000000c0)='htcp\x00', 0x5) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async, rerun: 32) r2 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r2, &(0x7f0000000100)={0x8}) (async) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) 15:29:46 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2411e5782d961784000"/31, 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) getpeername$l2tp(r0, &(0x7f0000000080)={0x2, 0x0, @remote}, &(0x7f00000000c0)=0x10) recvfrom$unix(r0, &(0x7f0000000100)=""/112, 0x70, 0x40, 0x0, 0x0) 15:29:46 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee241", 0x9) 15:29:46 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000000)={'gretap0\x00', &(0x7f0000000080)={'sit0\x00', 0x0, 0x40, 0x8, 0x0, 0xfffffffb, {{0xa, 0x4, 0x2, 0x18, 0x28, 0x64, 0x0, 0x2, 0x4, 0x0, @empty, @multicast2, {[@ra={0x94, 0x4}, @end, @timestamp={0x44, 0xc, 0x4b, 0x0, 0x7, [0xee7, 0x3]}]}}}}}) 15:29:46 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x14}, 0x14}}, 0x0) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0x5, 0x20a8c1) io_uring_setup(0x4ded, &(0x7f0000000080)={0x0, 0x7af, 0x2, 0x1, 0x21f, 0x0, r1}) (async, rerun: 32) write$qrtrtun(r1, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async, rerun: 32) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x3000010, 0x30, r1, 0x8000000) (async) syz_io_uring_setup(0x176f, &(0x7f0000000080)={0x0, 0x0, 0x2, 0xffffffff}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000200)) syz_io_uring_submit(r2, 0x0, &(0x7f0000000180)=@IORING_OP_WRITE_FIXED={0x5, 0x0, 0x0, @fd_index}, 0x8a86c60) (async) openat$cgroup_ro(r1, &(0x7f00000001c0)='cpuset.memory_pressure_enabled\x00', 0x0, 0x0) (async) syz_io_uring_submit(r2, 0x0, &(0x7f0000000180)=@IORING_OP_TIMEOUT={0xb, 0x3, 0x0, 0x0, 0x4, &(0x7f0000000140)={0x77359400}, 0x1, 0x1, 0x1}, 0x101) (async, rerun: 32) write$qrtrtun(r1, &(0x7f0000000000)="de8138", 0x3) (rerun: 32) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)) 15:29:46 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2411e5782d961784000"/31, 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) getpeername$l2tp(r0, &(0x7f0000000080)={0x2, 0x0, @remote}, &(0x7f00000000c0)=0x10) recvfrom$unix(r0, &(0x7f0000000100)=""/112, 0x70, 0x40, 0x0, 0x0) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2411e5782d961784000"/31, 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) getpeername$l2tp(r0, &(0x7f0000000080)={0x2, 0x0, @remote}, &(0x7f00000000c0)=0x10) (async) recvfrom$unix(r0, &(0x7f0000000100)=""/112, 0x70, 0x40, 0x0, 0x0) (async) 15:29:46 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x20000000000ffffc, 0x20a841) r1 = syz_open_dev$vcsa(&(0x7f0000000000), 0x2, 0x44701) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) openat$cgroup_freezer_state(r0, &(0x7f0000000080), 0x2, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x1010, r2, 0x10000000) ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0) openat$cgroup_devices(r1, &(0x7f00000000c0)='devices.allow\x00', 0x2, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r3, &(0x7f0000000880)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x14, 0x0, 0x4}, 0x14}}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r5, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2fb6ca0f97df2acd}]}, 0x1c}}, 0x0) r6 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r6, 0x10000000) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000001c0), r7) getpgid(0xffffffffffffffff) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) syz_open_dev$vcsa(&(0x7f0000000040), 0x20000000000ffffc, 0x20a841) (async) syz_open_dev$vcsa(&(0x7f0000000000), 0x2, 0x44701) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) openat$cgroup_freezer_state(r0, &(0x7f0000000080), 0x2, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x1010, r2, 0x10000000) (async) ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0) (async) openat$cgroup_devices(r1, &(0x7f00000000c0)='devices.allow\x00', 0x2, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r3, &(0x7f0000000880)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x14, 0x0, 0x4}, 0x14}}, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), 0xffffffffffffffff) (async) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r5, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2fb6ca0f97df2acd}]}, 0x1c}}, 0x0) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r6, 0x10000000) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000001c0), r7) (async) getpgid(0xffffffffffffffff) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) 15:29:46 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee241", 0x9) 15:29:46 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async, rerun: 32) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (rerun: 32) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async, rerun: 32) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000000)={'gretap0\x00', &(0x7f0000000080)={'sit0\x00', 0x0, 0x40, 0x8, 0x0, 0xfffffffb, {{0xa, 0x4, 0x2, 0x18, 0x28, 0x64, 0x0, 0x2, 0x4, 0x0, @empty, @multicast2, {[@ra={0x94, 0x4}, @end, @timestamp={0x44, 0xc, 0x4b, 0x0, 0x7, [0xee7, 0x3]}]}}}}}) (rerun: 32) 15:29:46 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0x1, 0x900) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='blkio.bfq.io_queued_recursive\x00', 0x0, 0x0) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000100)={0x0, 0x0}, 0x8) bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000140)=r2, 0x4) write$qrtrtun(r1, &(0x7f00000000c0)="9d", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:46 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2411e5782d961784000"/31, 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) getpeername$l2tp(r0, &(0x7f0000000080)={0x2, 0x0, @remote}, &(0x7f00000000c0)=0x10) recvfrom$unix(r0, &(0x7f0000000100)=""/112, 0x70, 0x40, 0x0, 0x0) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2411e5782d961784000"/31, 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) getpeername$l2tp(r0, &(0x7f0000000080)={0x2, 0x0, @remote}, &(0x7f00000000c0)=0x10) (async) recvfrom$unix(r0, &(0x7f0000000100)=""/112, 0x70, 0x40, 0x0, 0x0) (async) 15:29:46 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000000)={'gretap0\x00', &(0x7f0000000080)={'sit0\x00', 0x0, 0x40, 0x8, 0x0, 0xfffffffb, {{0xa, 0x4, 0x2, 0x18, 0x28, 0x64, 0x0, 0x2, 0x4, 0x0, @empty, @multicast2, {[@ra={0x94, 0x4}, @end, @timestamp={0x44, 0xc, 0x4b, 0x0, 0x7, [0xee7, 0x3]}]}}}}}) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000000)={'gretap0\x00', &(0x7f0000000080)={'sit0\x00', 0x0, 0x40, 0x8, 0x0, 0xfffffffb, {{0xa, 0x4, 0x2, 0x18, 0x28, 0x64, 0x0, 0x2, 0x4, 0x0, @empty, @multicast2, {[@ra={0x94, 0x4}, @end, @timestamp={0x44, 0xc, 0x4b, 0x0, 0x7, [0xee7, 0x3]}]}}}}}) (async) 15:29:46 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x300000e, 0x810, r1, 0x8000000) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:46 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:46 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup(r0, &(0x7f0000000080)='syz1\x00', 0x200002, 0x0) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r1) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/custom0\x00', 0x2, 0x0) read$qrtrtun(r0, &(0x7f0000000100)=""/152, 0x98) mmap$xdp(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1000000, 0x100010, r0, 0x180000000) 15:29:46 executing program 3: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) 15:29:46 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0x1, 0x900) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='blkio.bfq.io_queued_recursive\x00', 0x0, 0x0) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000100)={0x0, 0x0}, 0x8) bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000140)=r2, 0x4) write$qrtrtun(r1, &(0x7f00000000c0)="9d", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) syz_open_dev$vcsa(&(0x7f0000000080), 0x1, 0x900) (async) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='blkio.bfq.io_queued_recursive\x00', 0x0, 0x0) (async) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000100), 0x8) (async) bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000140)=r2, 0x4) (async) write$qrtrtun(r1, &(0x7f00000000c0)="9d", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) 15:29:46 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000380)="9f4afef285abdee2412783b6723f0767a0c4acb7acd4bf481e5782d961784022f31904f9dd0bdf129f7efa52d2e40130a3e2d393c78b403e58e17d5cfda869159da39b2713eb56a801ad47dd79383da63d182c85109c7ac8b3c2b51f83f3ee81b5a65d69d27301000000ea3b13fd03cd4d80a8329059b657b591e9703bc3d9e17ed7ad92b0c812c230863270499686f2a362e73add91287fd248584b21a0b7e1b8fe53fe682096d3098bd37d93b7d99555c8b54c0d8f4296e6aeced37ecb29ed56a38e79d605009e3a07e96dc6316ea68064c71cf5ee5f91a0e880b465e0487c31445995d425c8a96dc9b42b1ed9aa26bfefd16763a80bf77ff9c625cc916e1104fd1034ac5c0278525f965c2fc8b4823f754f6a31487bc38238844342916b478e05a07656e4d0c3203c8587cd6e1df7e139b86748f45f8a851d6b1f90f66b8cd32c9a2a44cb26a0842f7e3da0f72e72db998b7efbed51381d030f13a9c3926b34ee632f12607998b63e8fe4408764e8c6bafeda3bcbfec46582cdac9553d03ed910e042ec47fad298d9e59a163832665abec955b4bb5729f55beb0b924c2c546fb216e6e817f8660e14963c0a15039aacf5ef059eda1f6ac87ef5050fe21cad0924612325f96d813bf4c5e5f885ebaebf15dc239af1091f66f7060d1d84832497304ea2dfd9c311c8305e1d134f302e8a33057c114968", 0x1f7) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:46 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000080), 0x1, 0x900) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='blkio.bfq.io_queued_recursive\x00', 0x0, 0x0) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000100)={0x0, 0x0}, 0x8) bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000140)=r2, 0x4) write$qrtrtun(r1, &(0x7f00000000c0)="9d", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) syz_open_dev$vcsa(&(0x7f0000000080), 0x1, 0x900) (async) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='blkio.bfq.io_queued_recursive\x00', 0x0, 0x0) (async) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000100), 0x8) (async) bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000140)=r2, 0x4) (async) write$qrtrtun(r1, &(0x7f00000000c0)="9d", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) 15:29:46 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:46 executing program 3: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) 15:29:46 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000380)="9f4afef285abdee2412783b6723f0767a0c4acb7acd4bf481e5782d961784022f31904f9dd0bdf129f7efa52d2e40130a3e2d393c78b403e58e17d5cfda869159da39b2713eb56a801ad47dd79383da63d182c85109c7ac8b3c2b51f83f3ee81b5a65d69d27301000000ea3b13fd03cd4d80a8329059b657b591e9703bc3d9e17ed7ad92b0c812c230863270499686f2a362e73add91287fd248584b21a0b7e1b8fe53fe682096d3098bd37d93b7d99555c8b54c0d8f4296e6aeced37ecb29ed56a38e79d605009e3a07e96dc6316ea68064c71cf5ee5f91a0e880b465e0487c31445995d425c8a96dc9b42b1ed9aa26bfefd16763a80bf77ff9c625cc916e1104fd1034ac5c0278525f965c2fc8b4823f754f6a31487bc38238844342916b478e05a07656e4d0c3203c8587cd6e1df7e139b86748f45f8a851d6b1f90f66b8cd32c9a2a44cb26a0842f7e3da0f72e72db998b7efbed51381d030f13a9c3926b34ee632f12607998b63e8fe4408764e8c6bafeda3bcbfec46582cdac9553d03ed910e042ec47fad298d9e59a163832665abec955b4bb5729f55beb0b924c2c546fb216e6e817f8660e14963c0a15039aacf5ef059eda1f6ac87ef5050fe21cad0924612325f96d813bf4c5e5f885ebaebf15dc239af1091f66f7060d1d84832497304ea2dfd9c311c8305e1d134f302e8a33057c114968", 0x1f7) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:46 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup(r0, &(0x7f0000000080)='syz1\x00', 0x200002, 0x0) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r1) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/custom0\x00', 0x2, 0x0) (async) read$qrtrtun(r0, &(0x7f0000000100)=""/152, 0x98) mmap$xdp(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1000000, 0x100010, r0, 0x180000000) 15:29:46 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x300000e, 0x810, r1, 0x8000000) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x300000e, 0x810, r1, 0x8000000) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) 15:29:46 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:46 executing program 4: write$qrtrtun(0xffffffffffffffff, &(0x7f0000000300)="9f", 0x1) 15:29:46 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000380)="9f4afef285abdee2412783b6723f0767a0c4acb7acd4bf481e5782d961784022f31904f9dd0bdf129f7efa52d2e40130a3e2d393c78b403e58e17d5cfda869159da39b2713eb56a801ad47dd79383da63d182c85109c7ac8b3c2b51f83f3ee81b5a65d69d27301000000ea3b13fd03cd4d80a8329059b657b591e9703bc3d9e17ed7ad92b0c812c230863270499686f2a362e73add91287fd248584b21a0b7e1b8fe53fe682096d3098bd37d93b7d99555c8b54c0d8f4296e6aeced37ecb29ed56a38e79d605009e3a07e96dc6316ea68064c71cf5ee5f91a0e880b465e0487c31445995d425c8a96dc9b42b1ed9aa26bfefd16763a80bf77ff9c625cc916e1104fd1034ac5c0278525f965c2fc8b4823f754f6a31487bc38238844342916b478e05a07656e4d0c3203c8587cd6e1df7e139b86748f45f8a851d6b1f90f66b8cd32c9a2a44cb26a0842f7e3da0f72e72db998b7efbed51381d030f13a9c3926b34ee632f12607998b63e8fe4408764e8c6bafeda3bcbfec46582cdac9553d03ed910e042ec47fad298d9e59a163832665abec955b4bb5729f55beb0b924c2c546fb216e6e817f8660e14963c0a15039aacf5ef059eda1f6ac87ef5050fe21cad0924612325f96d813bf4c5e5f885ebaebf15dc239af1091f66f7060d1d84832497304ea2dfd9c311c8305e1d134f302e8a33057c114968", 0x1f7) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:46 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x300000e, 0x810, r1, 0x8000000) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:46 executing program 4: write$qrtrtun(0xffffffffffffffff, &(0x7f0000000300)="9f", 0x1) 15:29:46 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = openat$cgroup(r0, &(0x7f0000000080)='syz1\x00', 0x200002, 0x0) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r1) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/custom0\x00', 0x2, 0x0) read$qrtrtun(r0, &(0x7f0000000100)=""/152, 0x98) mmap$xdp(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1000000, 0x100010, r0, 0x180000000) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) openat$cgroup(r0, &(0x7f0000000080)='syz1\x00', 0x200002, 0x0) (async) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r1) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/custom0\x00', 0x2, 0x0) (async) read$qrtrtun(r0, &(0x7f0000000100)=""/152, 0x98) (async) mmap$xdp(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1000000, 0x100010, r0, 0x180000000) (async) 15:29:46 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) r1 = syz_open_dev$vcsa(&(0x7f0000000080), 0x2, 0x100) epoll_pwait2(r1, &(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, &(0x7f0000000140)={0x0, 0x3938700}, &(0x7f0000000180)={[0xfffffffffffffffd]}, 0x8) write$tcp_congestion(r0, &(0x7f00000001c0)='scalable\x00', 0x9) 15:29:46 executing program 3: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) 15:29:46 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffe, 0x60001) syz_open_dev$vcsa(&(0x7f0000000140), 0x7ff, 0xc0080) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_COALESCE(r2, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, 0x0, 0x300, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0xffff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x9a) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r1, 0xc0a85352, &(0x7f0000000080)={{0x81, 0x1}, 'port1\x00', 0x5c, 0x8, 0x0, 0x4, 0x20, 0xc9, 0x2, 0x0, 0x4, 0x1f}) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) 15:29:46 executing program 3: setsockopt$MRT_DEL_MFC(0xffffffffffffffff, 0x0, 0xcd, &(0x7f0000000000)={@initdev={0xac, 0x1e, 0x0, 0x0}, @private=0xa010102, 0xffffffffffffffff, "36fbb4021aaf2c2f6c4a4b0adbb740336f3e61c40b97e1e9569055f4d11fca9e", 0xfffffff9, 0x0, 0x2, 0x1}, 0x3c) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:46 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@fda={0x66646185, 0x4, 0x2, 0x16}, @flat=@weak_handle={0x77682a85, 0xb, 0x1}, @flat=@handle={0x73682a85, 0xa, 0x2}}, &(0x7f0000000100)={0x0, 0x20, 0x38}}}], 0xcb, 0x0, &(0x7f00000001c0)="af6c55748c218384c26e476f505fef64b3734384de4dd6256040e08f4dade545addcbd446fa4e097045c956da3b27a96a687f8c0a37f63eb0455818addbc4be9210cc46ba0ad976384bbd6a2510f8fb56a50416d284677e4b7b71313641b327ef8928c7426f68336d5b396a104955a6b70576a9abc2330e3f31d669bffc8b7addf4019b86d328a3791628d5d32c154e7d9e1ddd7984d20a6c8922fb8f906155b038befbab0344af849aae2dbd0891684be4563003d4a795f83e63bd717be70194fbe1e3d6807a99c323773"}) socketpair(0x18, 0x2, 0x1000, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r3, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000480)={&(0x7f00000003c0)={0x90, r3, 0x1, 0x70bd27, 0x25dfdbfc, {{}, {@void, @void, @val={0xc, 0x99, {0x7, 0x66}}}}, [@mon_options=[@NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "f5d23ac9ffc0bd516607badc6cc031932620d964bd424f8e"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "ae4701dcffd7aa4f18bd142900785a5fe1bd44e4b21202f4"}], @NL80211_ATTR_IFNAME={0x14, 0x4, 'virt_wifi0\x00'}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x1}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'rose0\x00'}]}, 0x90}, 0x1, 0x0, 0x0, 0x40040}, 0x4000000) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:46 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r3, &(0x7f0000000440)={&(0x7f0000000240), 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x14, r2, 0x1}, 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r2, 0x100, 0x70bd26, 0x25dfdbfb, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x4) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r6, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r7, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r9, &(0x7f0000000440)={&(0x7f0000000240), 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x14, r8, 0x1}, 0x14}}, 0x0) sendmsg$L2TP_CMD_SESSION_MODIFY(r7, &(0x7f00000004c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1010000}, 0xc, &(0x7f0000000480)={&(0x7f0000000380)={0x28, r8, 0x20, 0x70bd28, 0x25dfdbfe, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @remote}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000}, 0x802) sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(r4, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x50, r6, 0xd00, 0x70bd2b, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x0, 0x200007a}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_ETHERTYPE={0x6, 0x66, 0xe90b}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x50}, 0x1, 0x0, 0x0, 0x20000800}, 0x24000000) 15:29:46 executing program 3: setsockopt$MRT_DEL_MFC(0xffffffffffffffff, 0x0, 0xcd, &(0x7f0000000000)={@initdev={0xac, 0x1e, 0x0, 0x0}, @private=0xa010102, 0xffffffffffffffff, "36fbb4021aaf2c2f6c4a4b0adbb740336f3e61c40b97e1e9569055f4d11fca9e", 0xfffffff9, 0x0, 0x2, 0x1}, 0x3c) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:46 executing program 4: write$qrtrtun(0xffffffffffffffff, &(0x7f0000000300)="9f", 0x1) 15:29:46 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) r1 = syz_open_dev$vcsa(&(0x7f0000000080), 0x2, 0x100) epoll_pwait2(r1, &(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, &(0x7f0000000140)={0x0, 0x3938700}, &(0x7f0000000180)={[0xfffffffffffffffd]}, 0x8) write$tcp_congestion(r0, &(0x7f00000001c0)='scalable\x00', 0x9) 15:29:46 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r3, &(0x7f0000000440)={&(0x7f0000000240), 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x14, r2, 0x1}, 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r2, 0x100, 0x70bd26, 0x25dfdbfb, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x4) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r6, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r7, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r9, &(0x7f0000000440)={&(0x7f0000000240), 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x14, r8, 0x1}, 0x14}}, 0x0) sendmsg$L2TP_CMD_SESSION_MODIFY(r7, &(0x7f00000004c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1010000}, 0xc, &(0x7f0000000480)={&(0x7f0000000380)={0x28, r8, 0x20, 0x70bd28, 0x25dfdbfe, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @remote}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000}, 0x802) sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(r4, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x50, r6, 0xd00, 0x70bd2b, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x0, 0x200007a}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_ETHERTYPE={0x6, 0x66, 0xe90b}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x50}, 0x1, 0x0, 0x0, 0x20000800}, 0x24000000) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$L2TP_CMD_SESSION_CREATE(r3, &(0x7f0000000440)={&(0x7f0000000240), 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x14, r2, 0x1}, 0x14}}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r2, 0x100, 0x70bd26, 0x25dfdbfb, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x4) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$TIPC_CMD_SET_NETID(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) (async) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r6, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}}, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$TIPC_CMD_SET_NETID(r7, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$L2TP_CMD_SESSION_CREATE(r9, &(0x7f0000000440)={&(0x7f0000000240), 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x14, r8, 0x1}, 0x14}}, 0x0) (async) sendmsg$L2TP_CMD_SESSION_MODIFY(r7, &(0x7f00000004c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1010000}, 0xc, &(0x7f0000000480)={&(0x7f0000000380)={0x28, r8, 0x20, 0x70bd28, 0x25dfdbfe, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @remote}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000}, 0x802) (async) sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(r4, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x50, r6, 0xd00, 0x70bd2b, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x0, 0x200007a}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_ETHERTYPE={0x6, 0x66, 0xe90b}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x50}, 0x1, 0x0, 0x0, 0x20000800}, 0x24000000) (async) 15:29:46 executing program 4: r0 = syz_open_dev$vcsa(0x0, 0xffffb, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:46 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@fda={0x66646185, 0x4, 0x2, 0x16}, @flat=@weak_handle={0x77682a85, 0xb, 0x1}, @flat=@handle={0x73682a85, 0xa, 0x2}}, &(0x7f0000000100)={0x0, 0x20, 0x38}}}], 0xcb, 0x0, &(0x7f00000001c0)="af6c55748c218384c26e476f505fef64b3734384de4dd6256040e08f4dade545addcbd446fa4e097045c956da3b27a96a687f8c0a37f63eb0455818addbc4be9210cc46ba0ad976384bbd6a2510f8fb56a50416d284677e4b7b71313641b327ef8928c7426f68336d5b396a104955a6b70576a9abc2330e3f31d669bffc8b7addf4019b86d328a3791628d5d32c154e7d9e1ddd7984d20a6c8922fb8f906155b038befbab0344af849aae2dbd0891684be4563003d4a795f83e63bd717be70194fbe1e3d6807a99c323773"}) (async) socketpair(0x18, 0x2, 0x1000, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r3, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}}, 0x0) (async) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000480)={&(0x7f00000003c0)={0x90, r3, 0x1, 0x70bd27, 0x25dfdbfc, {{}, {@void, @void, @val={0xc, 0x99, {0x7, 0x66}}}}, [@mon_options=[@NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "f5d23ac9ffc0bd516607badc6cc031932620d964bd424f8e"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "ae4701dcffd7aa4f18bd142900785a5fe1bd44e4b21202f4"}], @NL80211_ATTR_IFNAME={0x14, 0x4, 'virt_wifi0\x00'}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x1}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'rose0\x00'}]}, 0x90}, 0x1, 0x0, 0x0, 0x40040}, 0x4000000) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:46 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) r1 = syz_open_dev$vcsa(&(0x7f0000000080), 0x2, 0x100) epoll_pwait2(r1, &(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, &(0x7f0000000140)={0x0, 0x3938700}, &(0x7f0000000180)={[0xfffffffffffffffd]}, 0x8) write$tcp_congestion(r0, &(0x7f00000001c0)='scalable\x00', 0x9) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) syz_open_dev$vcsa(&(0x7f0000000080), 0x2, 0x100) (async) epoll_pwait2(r1, &(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, &(0x7f0000000140)={0x0, 0x3938700}, &(0x7f0000000180)={[0xfffffffffffffffd]}, 0x8) (async) write$tcp_congestion(r0, &(0x7f00000001c0)='scalable\x00', 0x9) (async) 15:29:46 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffe, 0x60001) syz_open_dev$vcsa(&(0x7f0000000140), 0x7ff, 0xc0080) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_COALESCE(r2, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, 0x0, 0x300, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0xffff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x9a) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r1, 0xc0a85352, &(0x7f0000000080)={{0x81, 0x1}, 'port1\x00', 0x5c, 0x8, 0x0, 0x4, 0x20, 0xc9, 0x2, 0x0, 0x4, 0x1f}) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffe, 0x60001) (async) syz_open_dev$vcsa(&(0x7f0000000140), 0x7ff, 0xc0080) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NL80211_CMD_SET_COALESCE(r2, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, 0x0, 0x300, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0xffff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x9a) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r1, 0xc0a85352, &(0x7f0000000080)={{0x81, 0x1}, 'port1\x00', 0x5c, 0x8, 0x0, 0x4, 0x20, 0xc9, 0x2, 0x0, 0x4, 0x1f}) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) 15:29:46 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@fda={0x66646185, 0x4, 0x2, 0x16}, @flat=@weak_handle={0x77682a85, 0xb, 0x1}, @flat=@handle={0x73682a85, 0xa, 0x2}}, &(0x7f0000000100)={0x0, 0x20, 0x38}}}], 0xcb, 0x0, &(0x7f00000001c0)="af6c55748c218384c26e476f505fef64b3734384de4dd6256040e08f4dade545addcbd446fa4e097045c956da3b27a96a687f8c0a37f63eb0455818addbc4be9210cc46ba0ad976384bbd6a2510f8fb56a50416d284677e4b7b71313641b327ef8928c7426f68336d5b396a104955a6b70576a9abc2330e3f31d669bffc8b7addf4019b86d328a3791628d5d32c154e7d9e1ddd7984d20a6c8922fb8f906155b038befbab0344af849aae2dbd0891684be4563003d4a795f83e63bd717be70194fbe1e3d6807a99c323773"}) (async) socketpair(0x18, 0x2, 0x1000, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r3, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000480)={&(0x7f00000003c0)={0x90, r3, 0x1, 0x70bd27, 0x25dfdbfc, {{}, {@void, @void, @val={0xc, 0x99, {0x7, 0x66}}}}, [@mon_options=[@NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "f5d23ac9ffc0bd516607badc6cc031932620d964bd424f8e"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "ae4701dcffd7aa4f18bd142900785a5fe1bd44e4b21202f4"}], @NL80211_ATTR_IFNAME={0x14, 0x4, 'virt_wifi0\x00'}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x1}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'rose0\x00'}]}, 0x90}, 0x1, 0x0, 0x0, 0x40040}, 0x4000000) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:46 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffe, 0x60001) syz_open_dev$vcsa(&(0x7f0000000140), 0x7ff, 0xc0080) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_COALESCE(r2, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, 0x0, 0x300, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0xffff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x9a) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r1, 0xc0a85352, &(0x7f0000000080)={{0x81, 0x1}, 'port1\x00', 0x5c, 0x8, 0x0, 0x4, 0x20, 0xc9, 0x2, 0x0, 0x4, 0x1f}) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffe, 0x60001) (async) syz_open_dev$vcsa(&(0x7f0000000140), 0x7ff, 0xc0080) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NL80211_CMD_SET_COALESCE(r2, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, 0x0, 0x300, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0xffff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x9a) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r1, 0x10000000) (async) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r1, 0xc0a85352, &(0x7f0000000080)={{0x81, 0x1}, 'port1\x00', 0x5c, 0x8, 0x0, 0x4, 0x20, 0xc9, 0x2, 0x0, 0x4, 0x1f}) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) 15:29:46 executing program 4: r0 = syz_open_dev$vcsa(0x0, 0xffffb, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:46 executing program 3: setsockopt$MRT_DEL_MFC(0xffffffffffffffff, 0x0, 0xcd, &(0x7f0000000000)={@initdev={0xac, 0x1e, 0x0, 0x0}, @private=0xa010102, 0xffffffffffffffff, "36fbb4021aaf2c2f6c4a4b0adbb740336f3e61c40b97e1e9569055f4d11fca9e", 0xfffffff9, 0x0, 0x2, 0x1}, 0x3c) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:46 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) (async, rerun: 32) r3 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) sendmsg$L2TP_CMD_SESSION_CREATE(r3, &(0x7f0000000440)={&(0x7f0000000240), 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x14, r2, 0x1}, 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r2, 0x100, 0x70bd26, 0x25dfdbfb, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x4) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async, rerun: 32) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async, rerun: 32) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async, rerun: 32) r5 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r6, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r7, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) (async) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r9, &(0x7f0000000440)={&(0x7f0000000240), 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x14, r8, 0x1}, 0x14}}, 0x0) sendmsg$L2TP_CMD_SESSION_MODIFY(r7, &(0x7f00000004c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1010000}, 0xc, &(0x7f0000000480)={&(0x7f0000000380)={0x28, r8, 0x20, 0x70bd28, 0x25dfdbfe, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @remote}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000}, 0x802) sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(r4, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x50, r6, 0xd00, 0x70bd2b, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x0, 0x200007a}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_ETHERTYPE={0x6, 0x66, 0xe90b}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x50}, 0x1, 0x0, 0x0, 0x20000800}, 0x24000000) 15:29:46 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) socketpair(0x1, 0x80000, 0x3, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x0, 0x10, 0x70bd26, 0x25dfdbfd, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000001}, 0x20004004) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x10, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0d6704bc9ca8d56b84f7aad3109b5e0d670000"], 0xfb, 0x0, &(0x7f00000001c0)="cf36a9e61a4d42a829ab90ada1be9211270a1ca6109e7a8143766a093e85161a24fc2d52bacb0ac36eea914a67eea728728f68d38ca60b5d7ef00e600562f428837ea8f679ba5fbcb221c2d8c51c695a8e8596ddfe8997d95c6b6146f1d8100e781d2bcf6c1e4e9fbf72f59570040ebf146e0d3336453392d8db3b8206ff8255b8be7bbcdd6c8d75e0ae7d410933bf8b71fcce98d51ad017ae7bb0cb5c7def1d9a8a6efed112ba8cb34f8dc4e6763e9b78ed29a15229b691258c6641aa3a2e447f8808635c37974af33cd3aeca0f9bd35a74e303853aae0eb8e8bf6d4d773cfc3f3883a85a7e99c1f177cdaa41e1150a82e7f304c7454410891043"}) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:46 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x0, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [@L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x7f}]}, 0x1c}, 0x1, 0x0, 0x0, 0x34003800}, 0x8880) 15:29:46 executing program 4: r0 = syz_open_dev$vcsa(0x0, 0xffffb, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:46 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f00000002c0), 0x40000000000ffffb, 0x2841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000340)=@flushpolicy={0xd0, 0x1d, 0x100, 0x70bd2d, 0x25dfdbfe, "", [@coaddr={0x14, 0xe, @in=@local}, @policy={0xac, 0x7, {{@in6=@loopback, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x4e24, 0x8, 0x4e24, 0x9, 0x2, 0x0, 0x80, 0x2}, {0x400, 0x9, 0x200, 0x83, 0xffffffffffffe871, 0x1, 0x1, 0x2}, {0x5, 0x0, 0x1, 0x3}, 0x5, 0x6e6bbf, 0x2, 0x0, 0x1, 0x3}}]}, 0xd0}, 0x1, 0x0, 0x0, 0x40}, 0x8010) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000080)="5db5575a70d7dfb8d7ec4b7a5117dcaf0b673fd38be16236ac6b9c1794327b70239be0522f750319183cf3158321848e99f84ba6e9b8d611f725e4c956537a023979f35cabe82d3e3311024709925c976f29ec3530423321260838a3c3ff351f1d3e3a3c", 0x64) ioctl$BINDER_GET_EXTENDED_ERROR(r0, 0xc00c6211, &(0x7f0000000100)) kcmp$KCMP_EPOLL_TFD(0x0, 0x0, 0x7, 0xffffffffffffffff, 0x0) r2 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_MCAST_REPLICAST(r2, 0x10f, 0x86) setsockopt$TIPC_DEST_DROPPABLE(r2, 0x10f, 0x81, &(0x7f0000000280)=0x3, 0x4) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r5, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2fb6ca0f97df2acd}]}, 0x1c}}, 0x0) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, r5, 0x100, 0x70bd26, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x20000000) sendmsg$TIPC_CMD_SET_NETID(r3, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r6, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) kcmp$KCMP_EPOLL_TFD(0x0, 0x0, 0x7, r6, &(0x7f0000000140)={0xffffffffffffffff, r0, 0x3}) 15:29:46 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x0, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [@L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x7f}]}, 0x1c}, 0x1, 0x0, 0x0, 0x34003800}, 0x8880) 15:29:46 executing program 5: syz_open_dev$tty1(0xc, 0x4, 0x1) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)="de8138", 0xf85) r0 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000440)={&(0x7f0000000240), 0xc, &(0x7f0000000400)={&(0x7f00000003c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r0, @ANYBLOB="01000000fbff1200000005000000"], 0x14}}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x401002}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, r0, 0x2, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x32}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x20000040) 15:29:46 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) socketpair(0x1, 0x80000, 0x3, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x0, 0x10, 0x70bd26, 0x25dfdbfd, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000001}, 0x20004004) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x10, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0d6704bc9ca8d56b84f7aad3109b5e0d670000"], 0xfb, 0x0, &(0x7f00000001c0)="cf36a9e61a4d42a829ab90ada1be9211270a1ca6109e7a8143766a093e85161a24fc2d52bacb0ac36eea914a67eea728728f68d38ca60b5d7ef00e600562f428837ea8f679ba5fbcb221c2d8c51c695a8e8596ddfe8997d95c6b6146f1d8100e781d2bcf6c1e4e9fbf72f59570040ebf146e0d3336453392d8db3b8206ff8255b8be7bbcdd6c8d75e0ae7d410933bf8b71fcce98d51ad017ae7bb0cb5c7def1d9a8a6efed112ba8cb34f8dc4e6763e9b78ed29a15229b691258c6641aa3a2e447f8808635c37974af33cd3aeca0f9bd35a74e303853aae0eb8e8bf6d4d773cfc3f3883a85a7e99c1f177cdaa41e1150a82e7f304c7454410891043"}) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:46 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f00000002c0), 0x40000000000ffffb, 0x2841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000340)=@flushpolicy={0xd0, 0x1d, 0x100, 0x70bd2d, 0x25dfdbfe, "", [@coaddr={0x14, 0xe, @in=@local}, @policy={0xac, 0x7, {{@in6=@loopback, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x4e24, 0x8, 0x4e24, 0x9, 0x2, 0x0, 0x80, 0x2}, {0x400, 0x9, 0x200, 0x83, 0xffffffffffffe871, 0x1, 0x1, 0x2}, {0x5, 0x0, 0x1, 0x3}, 0x5, 0x6e6bbf, 0x2, 0x0, 0x1, 0x3}}]}, 0xd0}, 0x1, 0x0, 0x0, 0x40}, 0x8010) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000080)="5db5575a70d7dfb8d7ec4b7a5117dcaf0b673fd38be16236ac6b9c1794327b70239be0522f750319183cf3158321848e99f84ba6e9b8d611f725e4c956537a023979f35cabe82d3e3311024709925c976f29ec3530423321260838a3c3ff351f1d3e3a3c", 0x64) ioctl$BINDER_GET_EXTENDED_ERROR(r0, 0xc00c6211, &(0x7f0000000100)) (async) kcmp$KCMP_EPOLL_TFD(0x0, 0x0, 0x7, 0xffffffffffffffff, 0x0) (async, rerun: 64) r2 = socket$tipc(0x1e, 0x5, 0x0) (rerun: 64) setsockopt$TIPC_MCAST_REPLICAST(r2, 0x10f, 0x86) (async) setsockopt$TIPC_DEST_DROPPABLE(r2, 0x10f, 0x81, &(0x7f0000000280)=0x3, 0x4) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r5, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2fb6ca0f97df2acd}]}, 0x1c}}, 0x0) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, r5, 0x100, 0x70bd26, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x20000000) (async) sendmsg$TIPC_CMD_SET_NETID(r3, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r6, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async, rerun: 64) kcmp$KCMP_EPOLL_TFD(0x0, 0x0, 0x7, r6, &(0x7f0000000140)={0xffffffffffffffff, r0, 0x3}) (rerun: 64) 15:29:46 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) socketpair(0x1, 0x80000, 0x3, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x0, 0x10, 0x70bd26, 0x25dfdbfd, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000001}, 0x20004004) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x10, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0d6704bc9ca8d56b84f7aad3109b5e0d670000"], 0xfb, 0x0, &(0x7f00000001c0)="cf36a9e61a4d42a829ab90ada1be9211270a1ca6109e7a8143766a093e85161a24fc2d52bacb0ac36eea914a67eea728728f68d38ca60b5d7ef00e600562f428837ea8f679ba5fbcb221c2d8c51c695a8e8596ddfe8997d95c6b6146f1d8100e781d2bcf6c1e4e9fbf72f59570040ebf146e0d3336453392d8db3b8206ff8255b8be7bbcdd6c8d75e0ae7d410933bf8b71fcce98d51ad017ae7bb0cb5c7def1d9a8a6efed112ba8cb34f8dc4e6763e9b78ed29a15229b691258c6641aa3a2e447f8808635c37974af33cd3aeca0f9bd35a74e303853aae0eb8e8bf6d4d773cfc3f3883a85a7e99c1f177cdaa41e1150a82e7f304c7454410891043"}) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:46 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:46 executing program 5: syz_open_dev$tty1(0xc, 0x4, 0x1) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)="de8138", 0xf85) r0 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000440)={&(0x7f0000000240), 0xc, &(0x7f0000000400)={&(0x7f00000003c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r0, @ANYBLOB="01000000fbff1200000005000000"], 0x14}}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x401002}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, r0, 0x2, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x32}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x20000040) syz_open_dev$tty1(0xc, 0x4, 0x1) (async) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)="de8138", 0xf85) (async) syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000440)={&(0x7f0000000240), 0xc, &(0x7f0000000400)={&(0x7f00000003c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r0, @ANYBLOB="01000000fbff1200000005000000"], 0x14}}, 0x0) (async) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x401002}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, r0, 0x2, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x32}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x20000040) (async) 15:29:46 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x1) 15:29:46 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x0, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [@L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x7f}]}, 0x1c}, 0x1, 0x0, 0x0, 0x34003800}, 0x8880) 15:29:46 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:46 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:46 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) r1 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x200400) read$qrtrtun(r1, &(0x7f00000000c0)=""/200, 0xc8) setsockopt$TIPC_GROUP_LEAVE(r0, 0x10f, 0x88) 15:29:46 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x1) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x1) (async) 15:29:46 executing program 5: syz_open_dev$tty1(0xc, 0x4, 0x1) (async, rerun: 32) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)="de8138", 0xf85) (async, rerun: 32) r0 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000440)={&(0x7f0000000240), 0xc, &(0x7f0000000400)={&(0x7f00000003c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r0, @ANYBLOB="01000000fbff1200000005000000"], 0x14}}, 0x0) (async, rerun: 64) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x401002}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, r0, 0x2, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x32}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x20000040) (rerun: 64) 15:29:46 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xc41) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) r1 = syz_open_dev$vcsa(&(0x7f0000000000), 0x671, 0xa0000) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$cgroup(r0, &(0x7f0000000180)='syz0\x00', 0x200002, 0x0) openat$cgroup_devices(r4, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r5, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r5, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x24, 0x0, 0x100, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x4}]}, 0x24}}, 0x40001) sendmsg$TIPC_CMD_SHOW_STATS(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r2, 0x2, 0xfffffffe, 0x25dfdbff}, 0x1c}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x3c, r2, 0x400, 0x70bd25, 0x25dfdbfd, {{}, {}, {0x20, 0x17, {0x1e, 0x43a, @l2={'eth', 0x3a, 'batadv_slave_0\x00'}}}}, [""]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000888}, 0x4004090) 15:29:46 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f00000002c0), 0x40000000000ffffb, 0x2841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000340)=@flushpolicy={0xd0, 0x1d, 0x100, 0x70bd2d, 0x25dfdbfe, "", [@coaddr={0x14, 0xe, @in=@local}, @policy={0xac, 0x7, {{@in6=@loopback, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x4e24, 0x8, 0x4e24, 0x9, 0x2, 0x0, 0x80, 0x2}, {0x400, 0x9, 0x200, 0x83, 0xffffffffffffe871, 0x1, 0x1, 0x2}, {0x5, 0x0, 0x1, 0x3}, 0x5, 0x6e6bbf, 0x2, 0x0, 0x1, 0x3}}]}, 0xd0}, 0x1, 0x0, 0x0, 0x40}, 0x8010) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000080)="5db5575a70d7dfb8d7ec4b7a5117dcaf0b673fd38be16236ac6b9c1794327b70239be0522f750319183cf3158321848e99f84ba6e9b8d611f725e4c956537a023979f35cabe82d3e3311024709925c976f29ec3530423321260838a3c3ff351f1d3e3a3c", 0x64) (async) ioctl$BINDER_GET_EXTENDED_ERROR(r0, 0xc00c6211, &(0x7f0000000100)) (async) kcmp$KCMP_EPOLL_TFD(0x0, 0x0, 0x7, 0xffffffffffffffff, 0x0) (async) r2 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_MCAST_REPLICAST(r2, 0x10f, 0x86) setsockopt$TIPC_DEST_DROPPABLE(r2, 0x10f, 0x81, &(0x7f0000000280)=0x3, 0x4) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r5, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2fb6ca0f97df2acd}]}, 0x1c}}, 0x0) (async) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, r5, 0x100, 0x70bd26, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x20000000) (async) sendmsg$TIPC_CMD_SET_NETID(r3, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r6, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) kcmp$KCMP_EPOLL_TFD(0x0, 0x0, 0x7, r6, &(0x7f0000000140)={0xffffffffffffffff, r0, 0x3}) 15:29:46 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0x0) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:46 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x1) 15:29:46 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xc41) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) r1 = syz_open_dev$vcsa(&(0x7f0000000000), 0x671, 0xa0000) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$cgroup(r0, &(0x7f0000000180)='syz0\x00', 0x200002, 0x0) openat$cgroup_devices(r4, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r5, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r5, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x24, 0x0, 0x100, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x4}]}, 0x24}}, 0x40001) (async) sendmsg$TIPC_CMD_SHOW_STATS(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r2, 0x2, 0xfffffffe, 0x25dfdbff}, 0x1c}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x3c, r2, 0x400, 0x70bd25, 0x25dfdbfd, {{}, {}, {0x20, 0x17, {0x1e, 0x43a, @l2={'eth', 0x3a, 'batadv_slave_0\x00'}}}}, [""]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000888}, 0x4004090) 15:29:46 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) setsockopt$MRT_INIT(r0, 0x0, 0xc8, &(0x7f0000000080), 0x4) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:46 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0x0) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:46 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) r1 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x200400) read$qrtrtun(r1, &(0x7f00000000c0)=""/200, 0xc8) setsockopt$TIPC_GROUP_LEAVE(r0, 0x10f, 0x88) 15:29:46 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0xd29c1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0xb, 0x6, &(0x7f0000000140)=@framed={{0x18, 0x0, 0x0, 0x0, 0x91f, 0x0, 0x0, 0x0, 0x3}, [@btf_id={0x18, 0x3, 0x3, 0x0, 0x2}, @generic={0x3f, 0xc, 0x1, 0x9, 0x8}]}, &(0x7f0000000180)='GPL\x00', 0x3f, 0xe9, &(0x7f00000001c0)=""/233, 0x41000, 0x10, '\x00', 0x0, 0x22, r0, 0x8, &(0x7f00000002c0)={0x8, 0x3}, 0x8, 0x10, &(0x7f0000000300)={0x5, 0x2, 0xe6, 0x5}, 0x10, 0xffffffffffffffff, r0, 0x0, &(0x7f0000000340)=[0xffffffffffffffff, r0, r0, r0, r0]}, 0x80) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000440), r0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r2, &(0x7f0000000940)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x58, r4, 0x300, 0x70bd28, 0x25dfdbfe, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x1}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @rand_addr=0x64010102}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x1}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x9}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x4}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x8000}]}, 0x58}, 0x1, 0x0, 0x0, 0x40800}, 0x20000011) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0xd4, 0x0, &(0x7f00000004c0)=[@enter_looper, @increfs={0x40046304, 0x1}, @exit_looper, @request_death={0x400c630e, 0x1}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x32, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000080)={@fd={0x66642a85, 0x0, r1}, @fd={0x66642a85, 0x0, r2}, @flat=@weak_binder={0x77622a85, 0x10b, 0x2}}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x50, 0x18, &(0x7f00000006c0)=ANY=[@ANYBLOB="8561646600000000020000000000000002000000000000002900000000000000852a646600000000", @ANYRES32=r3, @ANYBLOB="000000000000000000000000852a6200000000000000000000000000000002d2a1d4000000000000768811336f97fad6bd6491938ce67110bd85292783f8b3b2404d3580f0d0347c0a5743270115b6c00fedf65de55ddfaaaf1f6ae9db4d8b2e22d1563bd025952e732f840a8a162df71291ff4a5c6077146ceba6e4f5db31ae7ec44d0cfdc9ea8ca47f391b1765ba7c09405711b639b4c7daca2463fcfeaa68360f4ac40558856fc597dc58d12e36175b8e9e087bec8d8ab013a850348d3b08536cda4a4a1bae44"], &(0x7f0000000480)={0x0, 0x20, 0x38}}}, @dead_binder_done, @enter_looper, @enter_looper, @request_death={0x400c630e, 0x3}], 0x90, 0x0, &(0x7f00000005c0)="dd941697203287d83e219c588421d9fb2fb42abeaf94b6e1bb51ff882584e6e7a06692a170baed80a5ab135752ce87f41a49887f850a5a69bdf9de811161dc6b57fb504b05b9125401ac9be67bfd3f32d27cb7dafe874dd35a98c621817288b5a89f334448c5a4719d8adf8d2ac1717dbc87f127a6c4620d330747323e8734d540297d047e0e81444185daede8c68e30"}) 15:29:47 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) setsockopt$MRT_INIT(r0, 0x0, 0xc8, &(0x7f0000000080), 0x4) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) setsockopt$MRT_INIT(r0, 0x0, 0xc8, &(0x7f0000000080), 0x4) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) 15:29:47 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) r1 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x200400) read$qrtrtun(r1, &(0x7f00000000c0)=""/200, 0xc8) (async, rerun: 32) setsockopt$TIPC_GROUP_LEAVE(r0, 0x10f, 0x88) (rerun: 32) 15:29:47 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xc41) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) r1 = syz_open_dev$vcsa(&(0x7f0000000000), 0x671, 0xa0000) (async) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = openat$cgroup(r0, &(0x7f0000000180)='syz0\x00', 0x200002, 0x0) openat$cgroup_devices(r4, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r5, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r5, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x24, 0x0, 0x100, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x4}]}, 0x24}}, 0x40001) (async) sendmsg$TIPC_CMD_SHOW_STATS(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r2, 0x2, 0xfffffffe, 0x25dfdbff}, 0x1c}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x3c, r2, 0x400, 0x70bd25, 0x25dfdbfd, {{}, {}, {0x20, 0x17, {0x1e, 0x43a, @l2={'eth', 0x3a, 'batadv_slave_0\x00'}}}}, [""]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000888}, 0x4004090) 15:29:47 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f00000001c0)={0x80002000}) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) syz_io_uring_setup(0x176f, &(0x7f0000000080)={0x0, 0x0, 0x2, 0x0, 0xffffffff}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)) syz_io_uring_submit(r2, 0x0, &(0x7f0000000180)=@IORING_OP_WRITE_FIXED={0x5, 0x0, 0x0, @fd_index}, 0x8a86c60) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0xb, 0x10010, r0, 0x10000000) syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), r0) syz_io_uring_submit(r2, r3, &(0x7f00000000c0)=@IORING_OP_TIMEOUT={0xb, 0x4, 0x0, 0x0, 0x6, &(0x7f0000000080), 0x1, 0x1}, 0x9) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:47 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0xd29c1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async, rerun: 32) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) (async, rerun: 32) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0xb, 0x6, &(0x7f0000000140)=@framed={{0x18, 0x0, 0x0, 0x0, 0x91f, 0x0, 0x0, 0x0, 0x3}, [@btf_id={0x18, 0x3, 0x3, 0x0, 0x2}, @generic={0x3f, 0xc, 0x1, 0x9, 0x8}]}, &(0x7f0000000180)='GPL\x00', 0x3f, 0xe9, &(0x7f00000001c0)=""/233, 0x41000, 0x10, '\x00', 0x0, 0x22, r0, 0x8, &(0x7f00000002c0)={0x8, 0x3}, 0x8, 0x10, &(0x7f0000000300)={0x5, 0x2, 0xe6, 0x5}, 0x10, 0xffffffffffffffff, r0, 0x0, &(0x7f0000000340)=[0xffffffffffffffff, r0, r0, r0, r0]}, 0x80) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000440), r0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r2, &(0x7f0000000940)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x58, r4, 0x300, 0x70bd28, 0x25dfdbfe, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x1}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @rand_addr=0x64010102}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x1}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x9}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x4}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x8000}]}, 0x58}, 0x1, 0x0, 0x0, 0x40800}, 0x20000011) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0xd4, 0x0, &(0x7f00000004c0)=[@enter_looper, @increfs={0x40046304, 0x1}, @exit_looper, @request_death={0x400c630e, 0x1}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x32, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000080)={@fd={0x66642a85, 0x0, r1}, @fd={0x66642a85, 0x0, r2}, @flat=@weak_binder={0x77622a85, 0x10b, 0x2}}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x50, 0x18, &(0x7f00000006c0)=ANY=[@ANYBLOB="8561646600000000020000000000000002000000000000002900000000000000852a646600000000", @ANYRES32=r3, @ANYBLOB="000000000000000000000000852a6200000000000000000000000000000002d2a1d4000000000000768811336f97fad6bd6491938ce67110bd85292783f8b3b2404d3580f0d0347c0a5743270115b6c00fedf65de55ddfaaaf1f6ae9db4d8b2e22d1563bd025952e732f840a8a162df71291ff4a5c6077146ceba6e4f5db31ae7ec44d0cfdc9ea8ca47f391b1765ba7c09405711b639b4c7daca2463fcfeaa68360f4ac40558856fc597dc58d12e36175b8e9e087bec8d8ab013a850348d3b08536cda4a4a1bae44"], &(0x7f0000000480)={0x0, 0x20, 0x38}}}, @dead_binder_done, @enter_looper, @enter_looper, @request_death={0x400c630e, 0x3}], 0x90, 0x0, &(0x7f00000005c0)="dd941697203287d83e219c588421d9fb2fb42abeaf94b6e1bb51ff882584e6e7a06692a170baed80a5ab135752ce87f41a49887f850a5a69bdf9de811161dc6b57fb504b05b9125401ac9be67bfd3f32d27cb7dafe874dd35a98c621817288b5a89f334448c5a4719d8adf8d2ac1717dbc87f127a6c4620d330747323e8734d540297d047e0e81444185daede8c68e30"}) 15:29:47 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) r1 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f00000001c0)={0x80002000}) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) (async) syz_io_uring_setup(0x176f, &(0x7f0000000080)={0x0, 0x0, 0x2, 0x0, 0xffffffff}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)) syz_io_uring_submit(r2, 0x0, &(0x7f0000000180)=@IORING_OP_WRITE_FIXED={0x5, 0x0, 0x0, @fd_index}, 0x8a86c60) (async) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0xb, 0x10010, r0, 0x10000000) syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), r0) syz_io_uring_submit(r2, r3, &(0x7f00000000c0)=@IORING_OP_TIMEOUT={0xb, 0x4, 0x0, 0x0, 0x6, &(0x7f0000000080), 0x1, 0x1}, 0x9) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:47 executing program 3: ioctl$SNDRV_TIMER_IOCTL_START(0xffffffffffffffff, 0x54a0) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) socket$inet6_udplite(0xa, 0x2, 0x88) write$qrtrtun(r0, &(0x7f0000000000)="01", 0xfffffcf9) sendmsg$L2TP_CMD_SESSION_MODIFY(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, 0x0, 0x800, 0x70bd2d, 0x25dfdbfb, {}, [@L2TP_ATTR_RECV_TIMEOUT={0xc}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}]}, 0x30}, 0x1, 0x0, 0x0, 0x4}, 0x24000880) 15:29:47 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0x0) write$qrtrtun(r0, &(0x7f0000000300)="9f", 0x1) 15:29:47 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) setsockopt$MRT_INIT(r0, 0x0, 0xc8, &(0x7f0000000080), 0x4) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) setsockopt$MRT_INIT(r0, 0x0, 0xc8, &(0x7f0000000080), 0x4) (async) write$qrtrtun(r0, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) (async) 15:29:47 executing program 0: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_wait_time_recursive\x00', 0x0, 0x0) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000240)=0x0, &(0x7f0000000280)=0x4) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) r3 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$BINDER_CTL_ADD(r0, 0xc1086201, &(0x7f0000000400)={'binder0\x00'}) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0xf, 0xb, &(0x7f00000000c0)=ANY=[@ANYBLOB="dc7b0001f0ffffff18540000070000000000000000000000185300000500000000000000000000001a140000", @ANYRES32=r0, @ANYBLOB="00000000000000008520000005000000180000000600000000000000020000005ca1800004000000"], &(0x7f0000000140)='syzkaller\x00', 0x401, 0xa1, &(0x7f0000000180)=""/161, 0x41000, 0xa, '\x00', r1, 0xc, r2, 0x8, &(0x7f00000002c0)={0x5, 0x4}, 0x8, 0x10, &(0x7f0000000340)={0x2, 0x1, 0x8, 0x73ab}, 0x10, 0x0, r3}, 0x80) r4 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r4, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) write$qrtrtun(r4, &(0x7f0000000000)="de8138", 0xf85) 15:29:47 executing program 3: ioctl$SNDRV_TIMER_IOCTL_START(0xffffffffffffffff, 0x54a0) (async) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) socket$inet6_udplite(0xa, 0x2, 0x88) write$qrtrtun(r0, &(0x7f0000000000)="01", 0xfffffcf9) (async) sendmsg$L2TP_CMD_SESSION_MODIFY(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, 0x0, 0x800, 0x70bd2d, 0x25dfdbfb, {}, [@L2TP_ATTR_RECV_TIMEOUT={0xc}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}]}, 0x30}, 0x1, 0x0, 0x0, 0x4}, 0x24000880) 15:29:47 executing program 4: syz_open_dev$vcsa(&(0x7f0000000040), 0xffffb, 0xa841) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000300)="9f", 0x1) 15:29:47 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0xd29c1) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0xb, 0x6, &(0x7f0000000140)=@framed={{0x18, 0x0, 0x0, 0x0, 0x91f, 0x0, 0x0, 0x0, 0x3}, [@btf_id={0x18, 0x3, 0x3, 0x0, 0x2}, @generic={0x3f, 0xc, 0x1, 0x9, 0x8}]}, &(0x7f0000000180)='GPL\x00', 0x3f, 0xe9, &(0x7f00000001c0)=""/233, 0x41000, 0x10, '\x00', 0x0, 0x22, r0, 0x8, &(0x7f00000002c0)={0x8, 0x3}, 0x8, 0x10, &(0x7f0000000300)={0x5, 0x2, 0xe6, 0x5}, 0x10, 0xffffffffffffffff, r0, 0x0, &(0x7f0000000340)=[0xffffffffffffffff, r0, r0, r0, r0]}, 0x80) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000440), r0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r2, &(0x7f0000000940)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x58, r4, 0x300, 0x70bd28, 0x25dfdbfe, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x1}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @rand_addr=0x64010102}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x1}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x9}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x4}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x8000}]}, 0x58}, 0x1, 0x0, 0x0, 0x40800}, 0x20000011) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0xd4, 0x0, &(0x7f00000004c0)=[@enter_looper, @increfs={0x40046304, 0x1}, @exit_looper, @request_death={0x400c630e, 0x1}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x32, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000080)={@fd={0x66642a85, 0x0, r1}, @fd={0x66642a85, 0x0, r2}, @flat=@weak_binder={0x77622a85, 0x10b, 0x2}}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x50, 0x18, &(0x7f00000006c0)=ANY=[@ANYBLOB="8561646600000000020000000000000002000000000000002900000000000000852a646600000000", @ANYRES32=r3, @ANYBLOB="000000000000000000000000852a6200000000000000000000000000000002d2a1d4000000000000768811336f97fad6bd6491938ce67110bd85292783f8b3b2404d3580f0d0347c0a5743270115b6c00fedf65de55ddfaaaf1f6ae9db4d8b2e22d1563bd025952e732f840a8a162df71291ff4a5c6077146ceba6e4f5db31ae7ec44d0cfdc9ea8ca47f391b1765ba7c09405711b639b4c7daca2463fcfeaa68360f4ac40558856fc597dc58d12e36175b8e9e087bec8d8ab013a850348d3b08536cda4a4a1bae44"], &(0x7f0000000480)={0x0, 0x20, 0x38}}}, @dead_binder_done, @enter_looper, @enter_looper, @request_death={0x400c630e, 0x3}], 0x90, 0x0, &(0x7f00000005c0)="dd941697203287d83e219c588421d9fb2fb42abeaf94b6e1bb51ff882584e6e7a06692a170baed80a5ab135752ce87f41a49887f850a5a69bdf9de811161dc6b57fb504b05b9125401ac9be67bfd3f32d27cb7dafe874dd35a98c621817288b5a89f334448c5a4719d8adf8d2ac1717dbc87f127a6c4620d330747323e8734d540297d047e0e81444185daede8c68e30"}) syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0xd29c1) (async) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0xf85) (async) socket$inet6_udplite(0xa, 0x2, 0x88) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0xb, 0x6, &(0x7f0000000140)=@framed={{0x18, 0x0, 0x0, 0x0, 0x91f, 0x0, 0x0, 0x0, 0x3}, [@btf_id={0x18, 0x3, 0x3, 0x0, 0x2}, @generic={0x3f, 0xc, 0x1, 0x9, 0x8}]}, &(0x7f0000000180)='GPL\x00', 0x3f, 0xe9, &(0x7f00000001c0)=""/233, 0x41000, 0x10, '\x00', 0x0, 0x22, r0, 0x8, &(0x7f00000002c0)={0x8, 0x3}, 0x8, 0x10, &(0x7f0000000300)={0x5, 0x2, 0xe6, 0x5}, 0x10, 0xffffffffffffffff, r0, 0x0, &(0x7f0000000340)=[0xffffffffffffffff, r0, r0, r0, r0]}, 0x80) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000440), r0) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r2, &(0x7f0000000940)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x58, r4, 0x300, 0x70bd28, 0x25dfdbfe, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x1}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @rand_addr=0x64010102}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x1}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x9}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x4}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x8000}]}, 0x58}, 0x1, 0x0, 0x0, 0x40800}, 0x20000011) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0xd4, 0x0, &(0x7f00000004c0)=[@enter_looper, @increfs={0x40046304, 0x1}, @exit_looper, @request_death={0x400c630e, 0x1}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x32, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000080)={@fd={0x66642a85, 0x0, r1}, @fd={0x66642a85, 0x0, r2}, @flat=@weak_binder={0x77622a85, 0x10b, 0x2}}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x50, 0x18, &(0x7f00000006c0)=ANY=[@ANYBLOB="8561646600000000020000000000000002000000000000002900000000000000852a646600000000", @ANYRES32=r3, @ANYBLOB="000000000000000000000000852a6200000000000000000000000000000002d2a1d4000000000000768811336f97fad6bd6491938ce67110bd85292783f8b3b2404d3580f0d0347c0a5743270115b6c00fedf65de55ddfaaaf1f6ae9db4d8b2e22d1563bd025952e732f840a8a162df71291ff4a5c6077146ceba6e4f5db31ae7ec44d0cfdc9ea8ca47f391b1765ba7c09405711b639b4c7daca2463fcfeaa68360f4ac40558856fc597dc58d12e36175b8e9e087bec8d8ab013a850348d3b08536cda4a4a1bae44"], &(0x7f0000000480)={0x0, 0x20, 0x38}}}, @dead_binder_done, @enter_looper, @enter_looper, @request_death={0x400c630e, 0x3}], 0x90, 0x0, &(0x7f00000005c0)="dd941697203287d83e219c588421d9fb2fb42abeaf94b6e1bb51ff882584e6e7a06692a170baed80a5ab135752ce87f41a49887f850a5a69bdf9de811161dc6b57fb504b05b9125401ac9be67bfd3f32d27cb7dafe874dd35a98c621817288b5a89f334448c5a4719d8adf8d2ac1717dbc87f127a6c4620d330747323e8734d540297d047e0e81444185daede8c68e30"}) (async) 15:29:47 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) r1 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) pipe2$watch_queue(&(0x7f0000000080), 0x80) openat$qrtrtun(0xffffffffffffff9c, &(0x7f00000000c0), 0x8500) write$qrtrtun(r0, &(0x7f0000000100)="9f4afef2857354653b1babdee2412783b6723f0767a0c4f33808039c51bf48", 0x1f) write$qrtrtun(r0, &(0x7f0000000000)="de8138", 0x3) 15:29:47 executing program 0: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_wait_time_recursive\x00', 0x0, 0x0) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000240)=0x0, &(0x7f0000000280)=0x4) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r2, 0x10000000) (async, rerun: 64) r3 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async, rerun: 64) ioctl$BINDER_CTL_ADD(r0, 0xc1086201, &(0x7f0000000400)={'binder0\x00'}) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, r3, 0x10000000) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0xf, 0xb, &(0x7f00000000c0)=ANY=[@ANYBLOB="dc7b0001f0ffffff18540000070000000000000000000000185300000500000000000000000000001a140000", @ANYRES32=r0, @ANYBLOB="00000000000000008520000005000000180000000600000000000000020000005ca1800004000000"], &(0x7f0000000140)='syzkaller\x00', 0x401, 0xa1, &(0x7f0000000180)=""/161, 0x41000, 0xa, '\x00', r1, 0xc, r2, 0x8, &(0x7f00000002c0)={0x5, 0x4}, 0x8, 0x10, &(0x7f0000000340)={0x2, 0x1, 0x8, 0x73ab}, 0x10, 0x0, r3}, 0x80) r4 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) write$qrtrtun(r4, &(0x7f0000000300)="9f4afef285abdee2412783b6723f0767a0c4f3380803bf481e5782d9617840", 0x1f) (async) write$qrtrtun(r4, &(0x7f0000000000)="de8138", 0xf85) 15:29:47 executing program 3: ioctl$SNDRV_TIMER_IOCTL_START(0xffffffffffffffff, 0x54a0) r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) socket$inet6_udplite(0xa, 0x2, 0x88) write$qrtrtun(r0, &(0x7f0000000000)="01", 0xfffffcf9) sendmsg$L2TP_CMD_SESSION_MODIFY(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, 0x0, 0x800, 0x70bd2d, 0x25dfdbfb, {}, [@L2TP_ATTR_RECV_TIMEOUT={0xc}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}]}, 0x30}, 0x1, 0x0, 0x0, 0x4}, 0x24000880) ioctl$SNDRV_TIMER_IOCTL_START(0xffffffffffffffff, 0x54a0) (async) syz_open_dev$vcsa(&(0x7f0000000040), 0xffffc, 0xa841) (async) socket$inet6_udplite(0xa, 0x2, 0x88) (async) write$qrtrtun(r0, &(0x7f0000000000)="01", 0xfffffcf9) (async) sendmsg$L2TP_CMD_SESSION_MODIFY(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, 0x0, 0x800, 0x70bd2d, 0x25dfdbfb, {}, [@L2TP_ATTR_RECV_TIMEOUT={0xc}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0