ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x7bffffff, 0x0, 0x2000}) 02:52:25 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x10001, 0x0, 0x2, 0x0, 0x2000}) 02:52:25 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_VFIO_IOMMU_MAP_DMA(r0, 0x3b71, &(0x7f0000000180)={0x20, 0x2, &(0x7f0000000100)="41945eed059fcc2e2fbc29169ac508771e3793fa8e15fff1e0f545cda7c98f9db669420d4433bc9d2f6c5e035cd2a599293b816bf7587a1482a06056e259c1f9", 0x5}) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x242080, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r2, 0x3ba0, &(0x7f00000000c0)={0x38, 0x1, r3, 0x0, 0x5, 0x7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) r5 = dup2(r2, r4) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r5, 0x3ba0, &(0x7f00000001c0)={0x38, 0x2, r3}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$IOMMU_VFIO_IOMMU_MAP_DMA(r0, 0x3b71, &(0x7f0000000180)={0x20, 0x2, &(0x7f0000000100)="41945eed059fcc2e2fbc29169ac508771e3793fa8e15fff1e0f545cda7c98f9db669420d4433bc9d2f6c5e035cd2a599293b816bf7587a1482a06056e259c1f9", 0x5}) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x242080, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000000)={0xc}) (async) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r2, 0x3ba0, &(0x7f00000000c0)={0x38, 0x1, r3, 0x0, 0x5, 0x7}) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1}) (async) dup2(r2, r4) (async) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r5, 0x3ba0, &(0x7f00000001c0)={0x38, 0x2, r3}) (async) 02:52:25 executing program 2: openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f0000000080)={0xc}) (async) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f0000000080)={0xc, 0x0}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r0, 0x3ba0, &(0x7f0000000100)={0x38, 0x1, r2, 0x0, 0x8000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r4, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r5, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r6, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r5, r6) 02:52:25 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x3, 0x2000}) 02:52:26 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xd, 0x2000}) 02:52:26 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0xf0ffffff, 0x0, 0x2000}) 02:52:26 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_VFIO_IOMMU_MAP_DMA(r0, 0x3b71, &(0x7f0000000180)={0x20, 0x2, &(0x7f0000000100)="41945eed059fcc2e2fbc29169ac508771e3793fa8e15fff1e0f545cda7c98f9db669420d4433bc9d2f6c5e035cd2a599293b816bf7587a1482a06056e259c1f9", 0x5}) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x242080, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r2, 0x3ba0, &(0x7f00000000c0)={0x38, 0x1, r3, 0x0, 0x5, 0x7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) r5 = dup2(r2, r4) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r5, 0x3ba0, &(0x7f00000001c0)={0x38, 0x2, r3}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$IOMMU_VFIO_IOMMU_MAP_DMA(r0, 0x3b71, &(0x7f0000000180)={0x20, 0x2, &(0x7f0000000100)="41945eed059fcc2e2fbc29169ac508771e3793fa8e15fff1e0f545cda7c98f9db669420d4433bc9d2f6c5e035cd2a599293b816bf7587a1482a06056e259c1f9", 0x5}) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x242080, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000000)={0xc}) (async) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r2, 0x3ba0, &(0x7f00000000c0)={0x38, 0x1, r3, 0x0, 0x5, 0x7}) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1}) (async) dup2(r2, r4) (async) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r5, 0x3ba0, &(0x7f00000001c0)={0x38, 0x2, r3}) (async) 02:52:26 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x10001, 0x0, 0x2, 0x0, 0x2000}) 02:52:26 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x24000, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) r6 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0), 0x21c00, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000100)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r6, 0x3b85, &(0x7f0000000180)={0x28, 0x5, r7, 0x0, &(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x400}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r4, r5) 02:52:26 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x4, 0x2000}) 02:52:26 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xe, 0x2000}) 02:52:26 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000100), 0x400001, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_RW(r2, 0x3ba0, &(0x7f00000001c0)={0x38, 0x8, r3, 0x0, 0x7, 0x3f, &(0x7f0000000180)="009c1f35f20708ce9c148fcb035ec15477fd60ddcaac7fedcdf37f6fa8d0092b81ac1482f0ca51a66801bd68e401fd0dcc70c8eca5a2ad7e694962aab41bf7"}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r4, r5) ioctl$IOMMU_VFIO_IOAS$GET(r5, 0x3b88, &(0x7f0000000080)={0xc, 0x0}) ioctl$IOMMU_VFIO_IOAS$SET(r0, 0x3b88, &(0x7f00000000c0)={0xc, r6}) 02:52:26 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0xf2ffffff, 0x0, 0x2000}) 02:52:26 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x2, 0x0, 0x2000}) 02:52:26 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x10, 0x2000}) 02:52:26 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x24000, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) r6 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0), 0x21c00, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000100)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r6, 0x3b85, &(0x7f0000000180)={0x28, 0x5, r7, 0x0, &(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x400}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r4, r5) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x24000, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) (async) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) (async) openat$zero(0xffffffffffffff9c, &(0x7f00000000c0), 0x21c00, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000100)={0xc}) (async) ioctl$IOMMU_IOAS_MAP$PAGES(r6, 0x3b85, &(0x7f0000000180)={0x28, 0x5, r7, 0x0, &(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x400}) (async) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) dup2(r4, r5) (async) 02:52:26 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x5, 0x2000}) 02:52:26 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0xfdfdffff, 0x0, 0x2000}) 02:52:26 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x11, 0x2000}) 02:52:26 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0xff3f0000, 0x0, 0x2000}) 02:52:26 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000100), 0x400001, 0x0) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000140)=ANY=[], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_RW(r2, 0x3ba0, &(0x7f00000001c0)={0x38, 0x8, r3, 0x0, 0x7, 0x3f, &(0x7f0000000180)="009c1f35f20708ce9c148fcb035ec15477fd60ddcaac7fedcdf37f6fa8d0092b81ac1482f0ca51a66801bd68e401fd0dcc70c8eca5a2ad7e694962aab41bf7"}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r4, r5) ioctl$IOMMU_VFIO_IOAS$GET(r5, 0x3b88, &(0x7f0000000080)={0xc, 0x0}) ioctl$IOMMU_VFIO_IOAS$SET(r0, 0x3b88, &(0x7f00000000c0)={0xc, r6}) 02:52:26 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x6, 0x2000}) 02:52:26 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x2, 0x0, 0x2000}) 02:52:26 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x24000, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) r6 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0), 0x21c00, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000100)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r6, 0x3b85, &(0x7f0000000180)={0x28, 0x5, r7, 0x0, &(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x400}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) dup2(r4, r5) 02:52:26 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x2, 0x0, 0x2000}) 02:52:26 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0xfffffdfd, 0x0, 0x2000}) 02:52:26 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x12, 0x2000}) 02:52:26 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x7, 0x2000}) 02:52:26 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000100), 0x400001, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_RW(r2, 0x3ba0, &(0x7f00000001c0)={0x38, 0x8, r3, 0x0, 0x7, 0x3f, &(0x7f0000000180)="009c1f35f20708ce9c148fcb035ec15477fd60ddcaac7fedcdf37f6fa8d0092b81ac1482f0ca51a66801bd68e401fd0dcc70c8eca5a2ad7e694962aab41bf7"}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r4, r5) ioctl$IOMMU_VFIO_IOAS$GET(r5, 0x3b88, &(0x7f0000000080)={0xc, 0x0}) ioctl$IOMMU_VFIO_IOAS$SET(r0, 0x3b88, &(0x7f00000000c0)={0xc, r6}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000000100), 0x400001, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) write$binfmt_script(r3, &(0x7f0000000140)=ANY=[], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) (async) ioctl$IOMMU_TEST_OP_ACCESS_RW(r2, 0x3ba0, &(0x7f00000001c0)={0x38, 0x8, r3, 0x0, 0x7, 0x3f, &(0x7f0000000180)="009c1f35f20708ce9c148fcb035ec15477fd60ddcaac7fedcdf37f6fa8d0092b81ac1482f0ca51a66801bd68e401fd0dcc70c8eca5a2ad7e694962aab41bf7"}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1}) (async) dup2(r4, r5) (async) ioctl$IOMMU_VFIO_IOAS$GET(r5, 0x3b88, &(0x7f0000000080)={0xc}) (async) ioctl$IOMMU_VFIO_IOAS$SET(r0, 0x3b88, &(0x7f00000000c0)={0xc, r6}) (async) 02:52:26 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r5, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r5, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r6, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r6, r6) 02:52:26 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x2, 0x0, 0x2000}) 02:52:26 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0xffffff7b, 0x0, 0x2000}) 02:52:26 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x8, 0x2000}) 02:52:26 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x18, 0x2000}) 02:52:26 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x2, 0x0, 0x2000}) 02:52:26 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0xffffff7f, 0x0, 0x2000}) 02:52:26 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x9, 0x2000}) 02:52:26 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r5, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r5, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r6, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r6, r6) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) (async) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) write$binfmt_script(r5, &(0x7f0000000140)=ANY=[], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r5, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r5, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1}) (async) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r6, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) dup2(r6, r6) (async) 02:52:26 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x25, 0x2000}) 02:52:26 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0xfffffff0, 0x0, 0x2000}) 02:52:26 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x20002, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) 02:52:26 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x2, 0x0, 0x2000}) 02:52:26 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xa, 0x2000}) 02:52:26 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x41, 0x2000}) 02:52:26 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0xfffffff2, 0x0, 0x2000}) 02:52:26 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x2, 0x0, 0x2000}) 02:52:26 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xb, 0x2000}) 02:52:26 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x20002, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1}) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) 02:52:27 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x5c, 0x2000}) 02:52:27 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000140)=ANY=[], 0x208e24b) (async, rerun: 64) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r5, 0x0) (async, rerun: 64) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r5, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r6, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async, rerun: 32) dup2(r6, r6) (rerun: 32) 02:52:27 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xc, 0x2000}) 02:52:27 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x2, 0x0, 0x2000}) 02:52:27 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x7b, 0x2000}) 02:52:27 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x20002, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x20002, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1}) (async) dup2(r2, r3) (async) 02:52:27 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0xffffffff, 0x0, 0x2000}) 02:52:27 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xd, 0x2000}) 02:52:27 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x2, 0x0, 0x2000}) 02:52:27 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xf0, 0x2000}) 02:52:27 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) 02:52:27 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, 0x0) 02:52:27 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xe, 0x2000}) 02:52:27 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xf2, 0x2000}) 02:52:27 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x2, 0x2000}) 02:52:27 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, 0x0) 02:52:27 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r5, 0x0) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r6, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r7}) ioctl$IOMMU_IOAS_ALLOW_IOVAS(r5, 0x3b82, &(0x7f0000000100)={0x18, r7, 0x4, 0x0, &(0x7f0000000080)=[{0x8, 0x9}, {0x7}, {0xffffffff, 0x5}, {0xd9, 0x12}]}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r8, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r4, r8) 02:52:27 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x10, 0x2000}) 02:52:27 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x300, 0x2000}) 02:52:27 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f00000000c0)={&(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x6, 0x80800, 0x0, 0xffffffffffffffff}) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r5, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r5, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r6}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000100)={0x38, 0x5, r6}) 02:52:27 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x3, 0x2000}) 02:52:27 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, 0x0) 02:52:27 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x11, 0x2000}) 02:52:27 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f00000000c0)={&(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x6, 0x80800, 0x0, 0xffffffffffffffff}) (async) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r5, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r5, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r6}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000100)={0x38, 0x5, r6}) 02:52:27 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x500, 0x2000}) 02:52:27 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r5, 0x0) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r6, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r7}) ioctl$IOMMU_IOAS_ALLOW_IOVAS(r5, 0x3b82, &(0x7f0000000100)={0x18, r7, 0x4, 0x0, &(0x7f0000000080)=[{0x8, 0x9}, {0x7}, {0xffffffff, 0x5}, {0xd9, 0x12}]}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r8, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r4, r8) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) (async) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) write$binfmt_script(r5, &(0x7f0000000140)=ANY=[], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r5, 0x0) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000000)={0xc}) (async) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r6, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r7}) (async) ioctl$IOMMU_IOAS_ALLOW_IOVAS(r5, 0x3b82, &(0x7f0000000100)={0x18, r7, 0x4, 0x0, &(0x7f0000000080)=[{0x8, 0x9}, {0x7}, {0xffffffff, 0x5}, {0xd9, 0x12}]}) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) (async) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r8, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) dup2(r4, r8) (async) 02:52:27 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x4, 0x2000}) 02:52:27 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x10001, 0x0, 0x2, 0x0, 0x2000}) 02:52:27 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x12, 0x2000}) 02:52:27 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) (async) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f00000000c0)={&(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x6, 0x80800, 0x0, 0xffffffffffffffff}) (async) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r5, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r5, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r6}) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000100)={0x38, 0x5, r6}) 02:52:27 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x600, 0x2000}) 02:52:27 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x10001, 0x0, 0x2, 0x0, 0x2000}) 02:52:27 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x18, 0x2000}) 02:52:27 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x5, 0x2000}) 02:52:27 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x700, 0x2000}) 02:52:27 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x2b05c0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000040)={0xc}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) 02:52:27 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x6, 0x2000}) 02:52:27 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000140)=ANY=[], 0x208e24b) (async, rerun: 64) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r5, 0x0) (async, rerun: 64) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r6, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r7}) ioctl$IOMMU_IOAS_ALLOW_IOVAS(r5, 0x3b82, &(0x7f0000000100)={0x18, r7, 0x4, 0x0, &(0x7f0000000080)=[{0x8, 0x9}, {0x7}, {0xffffffff, 0x5}, {0xd9, 0x12}]}) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r8, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r4, r8) 02:52:27 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x10001, 0x0, 0x2, 0x0, 0x2000}) 02:52:27 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x25, 0x2000}) 02:52:27 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x900, 0x2000}) 02:52:27 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x7, 0x2000}) 02:52:28 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2000}) 02:52:28 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x2b05c0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000040)={0xc}) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) 02:52:28 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x41, 0x2000}) 02:52:28 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x8, 0x2000}) 02:52:28 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xa00, 0x2000}) 02:52:28 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x2b05c0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000040)={0xc}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x2b05c0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000040)={0xc}) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1}) (async) dup2(r2, r3) (async) 02:52:28 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2000}) 02:52:28 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x9, 0x2000}) 02:52:28 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x5c, 0x2000}) 02:52:28 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xb00, 0x2000}) 02:52:28 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0xfffffffffffffe7b, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) 02:52:28 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2000}) 02:52:28 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2, 0x28011, 0xffffffffffffffff, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(0xffffffffffffffff, 0x3ba0, &(0x7f0000000080)={0x38, 0x2, r1}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r4, r3, 0x0, 0x100000002) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000001c0)={0xc}) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r5, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r7, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) r8 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x618800, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r8, 0x3ba0, &(0x7f0000000180)={0x38}) dup2(r6, r7) 02:52:28 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x7b, 0x2000}) 02:52:28 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xa, 0x2000}) 02:52:28 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xc00, 0x2000}) 02:52:28 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) 02:52:28 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2, 0x28011, 0xffffffffffffffff, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(0xffffffffffffffff, 0x3ba0, &(0x7f0000000080)={0x38, 0x2, r1}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r4, r3, 0x0, 0x100000002) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000001c0)={0xc}) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r5, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r7, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) r8 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x618800, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r8, 0x3ba0, &(0x7f0000000180)={0x38}) dup2(r6, r7) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x208e24b) (async) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2, 0x28011, 0xffffffffffffffff, 0x0) (async) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(0xffffffffffffffff, 0x3ba0, &(0x7f0000000080)={0x38, 0x2, r1}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendfile(r4, r3, 0x0, 0x100000002) (async) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000001c0)={0xc}) (async) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) (async) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r5, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) (async) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r7, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x618800, 0x0) (async) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r8, 0x3ba0, &(0x7f0000000180)={0x38}) (async) dup2(r6, r7) (async) 02:52:28 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xb, 0x2000}) 02:52:28 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xd00, 0x2000}) 02:52:28 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) 02:52:28 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xf0, 0x2000}) 02:52:28 executing program 1: openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0xfffffffffffffe7b, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) 02:52:28 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xc, 0x2000}) 02:52:28 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xe00, 0x2000}) 02:52:28 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2, 0x28011, 0xffffffffffffffff, 0x0) (async) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2, 0x28011, 0xffffffffffffffff, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(0xffffffffffffffff, 0x3ba0, &(0x7f0000000080)={0x38, 0x2, r1}) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r4, r3, 0x0, 0x100000002) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000001c0)={0xc}) (async) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000001c0)={0xc}) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r5, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r7, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) r8 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x618800, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r8, 0x3ba0, &(0x7f0000000180)={0x38}) (async) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r8, 0x3ba0, &(0x7f0000000180)={0x38}) dup2(r6, r7) 02:52:28 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xf2, 0x2000}) 02:52:28 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) 02:52:28 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x300, 0x2000}) 02:52:28 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x1100, 0x2000}) 02:52:28 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xd, 0x2000}) 02:52:28 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x2}) 02:52:28 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x400}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000080)={0xc}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000100)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x2, 0x2000}) r6 = dup2(r4, r5) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f00000002c0)={0xc}) ioctl$IOMMU_IOAS_IOVA_RANGES(r0, 0x3b84, &(0x7f0000000280)={0x20, r1, 0x10000000000002b9, 0x0, &(0x7f0000000300)}) 02:52:28 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xe, 0x2000}) 02:52:29 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0xfffffffffffffe7b, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) 02:52:29 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x1200, 0x2000}) 02:52:29 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x400}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000080)={0xc}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000100)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x2, 0x2000}) dup2(r4, r5) (async) r6 = dup2(r4, r5) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f00000002c0)={0xc}) ioctl$IOMMU_IOAS_IOVA_RANGES(r0, 0x3b84, &(0x7f0000000280)={0x20, r1, 0x10000000000002b9, 0x0, &(0x7f0000000300)}) 02:52:29 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x500, 0x2000}) 02:52:29 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x2}) 02:52:29 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x10, 0x2000}) 02:52:29 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x1800, 0x2000}) 02:52:29 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x2}) 02:52:29 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x400}) (async) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000080)={0xc}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000100)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x2, 0x2000}) (async) r6 = dup2(r4, r5) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f00000002c0)={0xc}) ioctl$IOMMU_IOAS_IOVA_RANGES(r0, 0x3b84, &(0x7f0000000280)={0x20, r1, 0x10000000000002b9, 0x0, &(0x7f0000000300)}) 02:52:29 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x600, 0x2000}) 02:52:29 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x11, 0x2000}) 02:52:29 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:29 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_proto_private(r1, 0x89e6, &(0x7f0000000040)="d602d790454e87e70cf00c119e3a") ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r2, 0x0, 0xffffffffffffffff}) dup2(r3, r4) 02:52:29 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x400}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000080)={0xc}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000100)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x2, 0x2000}) r6 = dup2(r4, r5) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f00000002c0)={0xc}) ioctl$IOMMU_IOAS_IOVA_RANGES(r0, 0x3b84, &(0x7f0000000280)={0x20, r1, 0x10000000000002b9, 0x0, &(0x7f0000000300)}) 02:52:29 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x700, 0x2000}) 02:52:29 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x12, 0x2000}) 02:52:29 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, &(0x7f0000000080)={0x38}) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r4, r5) 02:52:29 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x2500, 0x2000}) 02:52:29 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x18, 0x2000}) 02:52:29 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x900, 0x2000}) 02:52:29 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x3fff, 0x2000}) 02:52:29 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) [ 606.976411][T15841] iommufd_mock iommufd_mock0: Adding to iommu group 0 02:52:29 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_proto_private(r1, 0x89e6, &(0x7f0000000040)="d602d790454e87e70cf00c119e3a") (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r2, 0x0, 0xffffffffffffffff}) dup2(r3, r4) [ 607.045024][T15841] iommufd_mock iommufd_mock0: Removing from iommu group 0 02:52:29 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x4000, 0x2000}) 02:52:29 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x25, 0x2000}) 02:52:29 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xa00, 0x2000}) 02:52:29 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, &(0x7f0000000080)={0x38}) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) (async) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r4, r5) 02:52:29 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:29 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_proto_private(r1, 0x89e6, &(0x7f0000000040)="d602d790454e87e70cf00c119e3a") (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r2, 0x0, 0xffffffffffffffff}) dup2(r3, r4) 02:52:29 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x41, 0x2000}) 02:52:29 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x4100, 0x2000}) 02:52:29 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xb00, 0x2000}) [ 607.269091][T15865] iommufd_mock iommufd_mock0: Adding to iommu group 0 02:52:30 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:30 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x5c, 0x2000}) 02:52:30 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xc00, 0x2000}) 02:52:30 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) fchdir(r0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) 02:52:30 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x5c00, 0x2000}) [ 607.318087][T15865] iommufd_mock iommufd_mock0: Removing from iommu group 0 02:52:30 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, &(0x7f0000000080)={0x38}) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r4, r5) (async) dup2(r4, r5) 02:52:30 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:30 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async) fchdir(r0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) 02:52:30 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x7bff, 0x2000}) 02:52:30 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x7b, 0x2000}) 02:52:30 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:30 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xd00, 0x2000}) [ 607.484774][T15892] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 607.506400][T15892] iommufd_mock iommufd_mock0: Removing from iommu group 0 02:52:30 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) fchdir(r0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) 02:52:30 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r2, 0xc0c89425, &(0x7f00000003c0)={"84ce832355dc668d9285faa7c06fee05", 0x0, 0x0, {0x2, 0x1}, {0x1000, 0x7}, 0x4, [0xdf1b925, 0x0, 0x8, 0xfff, 0x1, 0x8, 0x9, 0x1, 0xffffffffffff0000, 0xbfd, 0x0, 0x590, 0x3, 0x7ff, 0x3, 0x422]}) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r6, 0x0) ioctl$IOMMU_IOAS_MAP(r6, 0x3b85, &(0x7f0000000080)={0x28, 0x1, 0x0, 0x0, &(0x7f00000002c0)="44b2182d584a6849edaafcea301deca59c016339bb8c07810bc3ae64fad38ce368eb654d27fecef3bf8cf7a21b2e7ece834e6333d3ce8ed577e2ac20eb41460609225481a6ee5275c452d595b69d0c8a09826c435ad62b3a8a8457a13122a98ce16e4a7ae8becc059efab63b0ad81fed8e529ff700c0e1ed39fff39f9acc660e9e2389b07e0e101553cebd68b28566e31f6dbddc6ee71ffa82f2cfa4cf56cde2ea36129fdf691c6033fd6e3898256d0f30967e7a7c6ecb3d29e2f8cffa380ce17e63840f257e524d03c28cadb6c41512a688f2", 0xd3, 0x89b0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) r7 = getpid() sched_setscheduler(r7, 0x2, &(0x7f0000000200)=0x4) r8 = getpid() sched_setscheduler(r8, 0x2, &(0x7f0000000200)=0x4) r9 = getpid() sched_setscheduler(r9, 0x2, &(0x7f0000000200)=0x4) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r11, r10, 0x0, 0x100000002) syz_clone3(&(0x7f00000006c0)={0xc9050290f7f3b599, &(0x7f0000000180), &(0x7f00000004c0), &(0x7f0000000500), {0x19}, &(0x7f0000000540)=""/50, 0x32, &(0x7f0000000580)=""/226, &(0x7f0000000680)=[r7, 0xffffffffffffffff, r8, 0x0, r9], 0x5, {r10}}, 0x58) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000100), 0x210000, 0x0) 02:52:30 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xf0ff, 0x2000}) 02:52:30 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xf0, 0x2000}) 02:52:30 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:30 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xe00, 0x2000}) 02:52:30 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xf2ff, 0x2000}) 02:52:30 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xf2, 0x2000}) 02:52:30 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:30 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xff3f, 0x2000}) 02:52:30 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x1100, 0x2000}) [ 607.814318][ T27] audit: type=1804 audit(1683773550.485:132): pid=15912 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir2584099632/syzkaller.rk9O0G/706/cgroup.controllers" dev="sda1" ino=1966 res=1 errno=0 02:52:30 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x300, 0x2000}) 02:52:30 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f000005a700)={0x0, ""/256, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f00000745c0)={0x5af, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0}], 0x0, "7464fbe08eb369"}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000000280)={0xeeb, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r3}, {}, {}, {0x0, r4}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r3}, {r2}, {}, {}, {}, {}, {}, {}, {}, {0x0, r7}, {}, {}, {}, {}, {}, {}, {}, {0x0, r4}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r3}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r2}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r5}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r6}], 0x0, "285c4d007ecdfb"}) ioctl$BTRFS_IOC_TREE_SEARCH_V2(r0, 0xc0709411, &(0x7f0000000080)={{r3, 0x8001, 0x1, 0x0, 0xe0000000000, 0x6, 0x0, 0xffff, 0xffffffff, 0x4fbd, 0x3, 0x9, 0xe5, 0xffffffff, 0x1}, 0x18, [0x0, 0x0, 0x0]}) r8 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r8, r9) 02:52:30 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) (async) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r2, 0xc0c89425, &(0x7f00000003c0)={"84ce832355dc668d9285faa7c06fee05", 0x0, 0x0, {0x2, 0x1}, {0x1000, 0x7}, 0x4, [0xdf1b925, 0x0, 0x8, 0xfff, 0x1, 0x8, 0x9, 0x1, 0xffffffffffff0000, 0xbfd, 0x0, 0x590, 0x3, 0x7ff, 0x3, 0x422]}) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000140)=ANY=[], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r6, 0x0) ioctl$IOMMU_IOAS_MAP(r6, 0x3b85, &(0x7f0000000080)={0x28, 0x1, 0x0, 0x0, &(0x7f00000002c0)="44b2182d584a6849edaafcea301deca59c016339bb8c07810bc3ae64fad38ce368eb654d27fecef3bf8cf7a21b2e7ece834e6333d3ce8ed577e2ac20eb41460609225481a6ee5275c452d595b69d0c8a09826c435ad62b3a8a8457a13122a98ce16e4a7ae8becc059efab63b0ad81fed8e529ff700c0e1ed39fff39f9acc660e9e2389b07e0e101553cebd68b28566e31f6dbddc6ee71ffa82f2cfa4cf56cde2ea36129fdf691c6033fd6e3898256d0f30967e7a7c6ecb3d29e2f8cffa380ce17e63840f257e524d03c28cadb6c41512a688f2", 0xd3, 0x89b0}) (async) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) r7 = getpid() sched_setscheduler(r7, 0x2, &(0x7f0000000200)=0x4) (async) r8 = getpid() sched_setscheduler(r8, 0x2, &(0x7f0000000200)=0x4) r9 = getpid() sched_setscheduler(r9, 0x2, &(0x7f0000000200)=0x4) (async) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r11, r10, 0x0, 0x100000002) syz_clone3(&(0x7f00000006c0)={0xc9050290f7f3b599, &(0x7f0000000180), &(0x7f00000004c0), &(0x7f0000000500), {0x19}, &(0x7f0000000540)=""/50, 0x32, &(0x7f0000000580)=""/226, &(0x7f0000000680)=[r7, 0xffffffffffffffff, r8, 0x0, r9], 0x5, {r10}}, 0x58) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000100), 0x210000, 0x0) 02:52:30 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:30 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x1200, 0x2000}) 02:52:30 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xff7b, 0x2000}) 02:52:30 executing program 1: openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f000005a700)={0x0, ""/256, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f00000745c0)={0x5af, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0}], 0x0, "7464fbe08eb369"}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000000280)={0xeeb, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r3}, {}, {}, {0x0, r4}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r3}, {r2}, {}, {}, {}, {}, {}, {}, {}, {0x0, r7}, {}, {}, {}, {}, {}, {}, {}, {0x0, r4}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r3}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r2}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r5}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r6}], 0x0, "285c4d007ecdfb"}) (async) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000000280)={0xeeb, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r3}, {}, {}, {0x0, r4}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r3}, {r2}, {}, {}, {}, {}, {}, {}, {}, {0x0, r7}, {}, {}, {}, {}, {}, {}, {}, {0x0, r4}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r3}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r2}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r5}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r6}], 0x0, "285c4d007ecdfb"}) ioctl$BTRFS_IOC_TREE_SEARCH_V2(r0, 0xc0709411, &(0x7f0000000080)={{r3, 0x8001, 0x1, 0x0, 0xe0000000000, 0x6, 0x0, 0xffff, 0xffffffff, 0x4fbd, 0x3, 0x9, 0xe5, 0xffffffff, 0x1}, 0x18, [0x0, 0x0, 0x0]}) r8 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1}) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r8, r9) 02:52:30 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x500, 0x2000}) 02:52:30 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x600, 0x2000}) 02:52:30 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xfff0, 0x2000}) 02:52:30 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x1800, 0x2000}) 02:52:30 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f000005a700)={0x0, ""/256, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f00000745c0)={0x5af, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0}], 0x0, "7464fbe08eb369"}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000000280)={0xeeb, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r3}, {}, {}, {0x0, r4}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r3}, {r2}, {}, {}, {}, {}, {}, {}, {}, {0x0, r7}, {}, {}, {}, {}, {}, {}, {}, {0x0, r4}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r3}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r2}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r5}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r6}], 0x0, "285c4d007ecdfb"}) ioctl$BTRFS_IOC_TREE_SEARCH_V2(r0, 0xc0709411, &(0x7f0000000080)={{r3, 0x8001, 0x1, 0x0, 0xe0000000000, 0x6, 0x0, 0xffff, 0xffffffff, 0x4fbd, 0x3, 0x9, 0xe5, 0xffffffff, 0x1}, 0x18, [0x0, 0x0, 0x0]}) (async, rerun: 64) r8 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async, rerun: 64) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r8, r9) 02:52:30 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:31 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:31 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r2, 0xc0c89425, &(0x7f00000003c0)={"84ce832355dc668d9285faa7c06fee05", 0x0, 0x0, {0x2, 0x1}, {0x1000, 0x7}, 0x4, [0xdf1b925, 0x0, 0x8, 0xfff, 0x1, 0x8, 0x9, 0x1, 0xffffffffffff0000, 0xbfd, 0x0, 0x590, 0x3, 0x7ff, 0x3, 0x422]}) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000140)=ANY=[], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r6, 0x0) (async) ioctl$IOMMU_IOAS_MAP(r6, 0x3b85, &(0x7f0000000080)={0x28, 0x1, 0x0, 0x0, &(0x7f00000002c0)="44b2182d584a6849edaafcea301deca59c016339bb8c07810bc3ae64fad38ce368eb654d27fecef3bf8cf7a21b2e7ece834e6333d3ce8ed577e2ac20eb41460609225481a6ee5275c452d595b69d0c8a09826c435ad62b3a8a8457a13122a98ce16e4a7ae8becc059efab63b0ad81fed8e529ff700c0e1ed39fff39f9acc660e9e2389b07e0e101553cebd68b28566e31f6dbddc6ee71ffa82f2cfa4cf56cde2ea36129fdf691c6033fd6e3898256d0f30967e7a7c6ecb3d29e2f8cffa380ce17e63840f257e524d03c28cadb6c41512a688f2", 0xd3, 0x89b0}) (async) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) r7 = getpid() sched_setscheduler(r7, 0x2, &(0x7f0000000200)=0x4) r8 = getpid() sched_setscheduler(r8, 0x2, &(0x7f0000000200)=0x4) r9 = getpid() sched_setscheduler(r9, 0x2, &(0x7f0000000200)=0x4) (async) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r11, r10, 0x0, 0x100000002) syz_clone3(&(0x7f00000006c0)={0xc9050290f7f3b599, &(0x7f0000000180), &(0x7f00000004c0), &(0x7f0000000500), {0x19}, &(0x7f0000000540)=""/50, 0x32, &(0x7f0000000580)=""/226, &(0x7f0000000680)=[r7, 0xffffffffffffffff, r8, 0x0, r9], 0x5, {r10}}, 0x58) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000100), 0x210000, 0x0) 02:52:31 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x700, 0x2000}) 02:52:31 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:31 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xfff2, 0x2000}) 02:52:31 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x2500, 0x2000}) 02:52:31 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:31 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x200000, 0x2000}) 02:52:31 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x900, 0x2000}) 02:52:31 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x40000, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) 02:52:31 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x3fff, 0x2000}) 02:52:31 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:31 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x1000000, 0x2000}) 02:52:31 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x40000, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x40000, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1}) (async) dup2(r2, r3) (async) 02:52:31 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xa00, 0x2000}) 02:52:31 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, 0x0, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r3, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:31 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x4000, 0x2000}) 02:52:31 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x2000000, 0x2000}) 02:52:31 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000000, 0x28011, r1, 0xbea95000) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r4, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000300), 0x20b41, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r2, 0x0, 0xffffffffffffffff, 0x1}) fcntl$setstatus(r5, 0x4, 0xc00) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000480)={0xc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r5, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r6, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r5, r3) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_VFIO_IOAS$GET(r7, 0x3b88, &(0x7f0000000500)={0xc, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r7, 0x3b87, &(0x7f00000004c0)={0x18, 0x1, 0x0, 0x0, r9, 0x2}) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000002c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r3, 0x3b85, &(0x7f0000000440)={0x28, 0x2, r10, 0x0, &(0x7f0000000340)="81c495df5e5e327843cd65e97e0b8f3ce6bcd2162b5140642639ba8aa43e6c89d5fdfe9a0850577545dcef756c99500b150a192857ba3ccc1f41cc07fe21d53fdee915e1ad9414d1ede7748902599acffdd51f2c891f4c0013650910b5f3988a4da6cc284b18a50bd22741b7bdda45985adaaaec39ddf2203d422fb54bcd87e3c7440f30b4b843d0b846fe5eae45c9d28153101668fc554c9469c8fc199bac7eb3a33c8c8832883dd018e94f13d91c6bd43035717bc2ceffaeb304fe96900ffd151272a11863b55bf8ed136e4cf7bfaaaa184bbe2966202c", 0xd8, 0x5}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000180)={0x28, 0x2, r8, 0x0, &(0x7f0000000100)="b5ac22375617af7c2724decda6ec31a998435c8fea1332fa4632bbbbbaf09e839f04ef184f55d8822638ae0535b110004cd035d408af57176496f3ad1aa6ad27bd7ca6744b260e", 0x47, 0x1}) 02:52:31 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x40000, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) 02:52:31 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xb00, 0x2000}) 02:52:31 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, 0x0, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r3, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:31 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x4100, 0x2000}) 02:52:31 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x3000000, 0x2000}) 02:52:31 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r2, 0x3b88, &(0x7f0000000080)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r2, 0x3b85, &(0x7f00000000c0)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x9ed5b9d}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r4) 02:52:31 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xc00, 0x2000}) 02:52:31 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, 0x0, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r3, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:31 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x5c00, 0x2000}) 02:52:31 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x208e24b) (async) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000000, 0x28011, r1, 0xbea95000) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000080)={0xc}) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r4, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r4, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000300), 0x20b41, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r2, 0x0, 0xffffffffffffffff, 0x1}) fcntl$setstatus(r5, 0x4, 0xc00) (async) fcntl$setstatus(r5, 0x4, 0xc00) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000480)={0xc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r5, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r6, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r5, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r6, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r5, r3) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_VFIO_IOAS$GET(r7, 0x3b88, &(0x7f0000000500)={0xc, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r7, 0x3b87, &(0x7f00000004c0)={0x18, 0x1, 0x0, 0x0, r9, 0x2}) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000002c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r3, 0x3b85, &(0x7f0000000440)={0x28, 0x2, r10, 0x0, &(0x7f0000000340)="81c495df5e5e327843cd65e97e0b8f3ce6bcd2162b5140642639ba8aa43e6c89d5fdfe9a0850577545dcef756c99500b150a192857ba3ccc1f41cc07fe21d53fdee915e1ad9414d1ede7748902599acffdd51f2c891f4c0013650910b5f3988a4da6cc284b18a50bd22741b7bdda45985adaaaec39ddf2203d422fb54bcd87e3c7440f30b4b843d0b846fe5eae45c9d28153101668fc554c9469c8fc199bac7eb3a33c8c8832883dd018e94f13d91c6bd43035717bc2ceffaeb304fe96900ffd151272a11863b55bf8ed136e4cf7bfaaaa184bbe2966202c", 0xd8, 0x5}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000180)={0x28, 0x2, r8, 0x0, &(0x7f0000000100)="b5ac22375617af7c2724decda6ec31a998435c8fea1332fa4632bbbbbaf09e839f04ef184f55d8822638ae0535b110004cd035d408af57176496f3ad1aa6ad27bd7ca6744b260e", 0x47, 0x1}) (async) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000180)={0x28, 0x2, r8, 0x0, &(0x7f0000000100)="b5ac22375617af7c2724decda6ec31a998435c8fea1332fa4632bbbbbaf09e839f04ef184f55d8822638ae0535b110004cd035d408af57176496f3ad1aa6ad27bd7ca6744b260e", 0x47, 0x1}) 02:52:31 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x4000000, 0x2000}) 02:52:31 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xd00, 0x2000}) 02:52:31 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r2, 0x3b88, &(0x7f0000000080)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r2, 0x3b85, &(0x7f00000000c0)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x9ed5b9d}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r4) 02:52:31 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:31 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x7bff, 0x2000}) 02:52:31 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xe00, 0x2000}) 02:52:31 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x5000000, 0x2000}) 02:52:31 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000000, 0x28011, r1, 0xbea95000) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r4, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000300), 0x20b41, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r2, 0x0, 0xffffffffffffffff, 0x1}) fcntl$setstatus(r5, 0x4, 0xc00) (async) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000480)={0xc}) (async) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r5, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r6, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) dup2(r5, r3) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_VFIO_IOAS$GET(r7, 0x3b88, &(0x7f0000000500)={0xc, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r7, 0x3b87, &(0x7f00000004c0)={0x18, 0x1, 0x0, 0x0, r9, 0x2}) (async) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f00000002c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r3, 0x3b85, &(0x7f0000000440)={0x28, 0x2, r10, 0x0, &(0x7f0000000340)="81c495df5e5e327843cd65e97e0b8f3ce6bcd2162b5140642639ba8aa43e6c89d5fdfe9a0850577545dcef756c99500b150a192857ba3ccc1f41cc07fe21d53fdee915e1ad9414d1ede7748902599acffdd51f2c891f4c0013650910b5f3988a4da6cc284b18a50bd22741b7bdda45985adaaaec39ddf2203d422fb54bcd87e3c7440f30b4b843d0b846fe5eae45c9d28153101668fc554c9469c8fc199bac7eb3a33c8c8832883dd018e94f13d91c6bd43035717bc2ceffaeb304fe96900ffd151272a11863b55bf8ed136e4cf7bfaaaa184bbe2966202c", 0xd8, 0x5}) (async, rerun: 32) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000180)={0x28, 0x2, r8, 0x0, &(0x7f0000000100)="b5ac22375617af7c2724decda6ec31a998435c8fea1332fa4632bbbbbaf09e839f04ef184f55d8822638ae0535b110004cd035d408af57176496f3ad1aa6ad27bd7ca6744b260e", 0x47, 0x1}) (rerun: 32) 02:52:31 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xf0ff, 0x2000}) 02:52:31 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:31 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async, rerun: 64) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) (rerun: 64) ioctl$IOMMU_VFIO_IOAS$GET(r2, 0x3b88, &(0x7f0000000080)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r2, 0x3b85, &(0x7f00000000c0)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x9ed5b9d}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r4) 02:52:31 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x1100, 0x2000}) 02:52:31 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xf2ff, 0x2000}) 02:52:31 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x6000000, 0x2000}) 02:52:32 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:32 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x1200, 0x2000}) 02:52:32 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xff3f, 0x2000}) 02:52:32 executing program 1: ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000080)=0x0) sched_setscheduler(r0, 0x6, &(0x7f00000000c0)=0x10001) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000140)={0xfffffffffffffecf, 0x0, 0x0}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r3, 0x0, 0xffffffffffffffff}) dup2(r4, r5) 02:52:32 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x7000000, 0x2000}) 02:52:32 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r3, r2, 0x0, 0x100000002) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r5, r4, 0x0, 0x100000002) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r6, 0x0) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000100)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r7, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r8 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r8, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r9, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r8, r9) 02:52:32 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:32 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x1800, 0x2000}) 02:52:32 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xff7b, 0x2000}) 02:52:32 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x8000000, 0x2000}) 02:52:32 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:32 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:32 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xfff0, 0x2000}) 02:52:32 executing program 1: ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000080)=0x0) sched_setscheduler(r0, 0x6, &(0x7f00000000c0)=0x10001) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000140)={0xfffffffffffffecf, 0x0, 0x0}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r3, 0x0, 0xffffffffffffffff}) dup2(r4, r5) 02:52:32 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:32 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r3, r2, 0x0, 0x100000002) (async) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r5, r4, 0x0, 0x100000002) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r6, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000100)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r7, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) r8 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r8, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r9, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) dup2(r8, r9) 02:52:32 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x2500, 0x2000}) 02:52:32 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x9000000, 0x2000}) 02:52:32 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xfff2, 0x2000}) 02:52:32 executing program 5: ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(0xffffffffffffffff, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:32 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xa000000, 0x2000}) 02:52:32 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x3fff, 0x2000}) 02:52:32 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r3, r2, 0x0, 0x100000002) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r5, r4, 0x0, 0x100000002) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r6, 0x0) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000100)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r7, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r8 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r8, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r9, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r8, r9) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendfile(r3, r2, 0x0, 0x100000002) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendfile(r5, r4, 0x0, 0x100000002) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) write$binfmt_script(r6, &(0x7f0000000140)=ANY=[], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r6, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000100)={0xc}) (async) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r7, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) (async) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r8, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r9, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) dup2(r8, r9) (async) 02:52:32 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x200000, 0x2000}) 02:52:32 executing program 1: ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000080)=0x0) sched_setscheduler(r0, 0x6, &(0x7f00000000c0)=0x10001) (async) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000140)={0xfffffffffffffecf, 0x0, 0x0}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r3, 0x0, 0xffffffffffffffff}) dup2(r4, r5) 02:52:32 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xb000000, 0x2000}) 02:52:32 executing program 5: ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(0xffffffffffffffff, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:32 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x4000, 0x2000}) 02:52:32 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x1000000, 0x2000}) 02:52:32 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xc000000, 0x2000}) 02:52:32 executing program 5: ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(0xffffffffffffffff, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:32 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = signalfd(r0, &(0x7f0000000080)={[0x7c1b4cff]}, 0x8) sendmsg$nl_generic(r1, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000180)={&(0x7f00000002c0)={0x104, 0x14, 0x400, 0x70bd27, 0x25dfdbfb, {0x4}, [@typed={0xee, 0x5f, 0x0, 0x0, @binary="f36957c3013e8710d73ac899a208e79197785176d8aa69a8026dc91cbdde5f894044de1eff9e2a704a180ab53eea10b21bddbfb8689473d149ac2b229c51425e0ebf0b7bc6fa110bd32fb19c7ebacc7ce48e1fb855bcab3769ba92f568fa3977947ba681223583f232170197b20198f0f2b9d67f77c454d4108ba646bb83bba6160b3313036a06889278fdee2c44f1d0115f760cd9d11a292359399400e9f93b39eedc0de67903e864f44a2187da6945ecc1c063f64f06fd555889cb463da20253867f2319552b1e631032361f6e8ecc4bcca7da2a72ae18ba432f3530edfb667c8f98f68ecf74e73d71"}]}, 0x104}, 0x1, 0x0, 0x0, 0x4}, 0x4004) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r4, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r7, r6, 0x0, 0x100000002) ioctl$IOMMU_IOAS_MAP(r6, 0x3b85, &(0x7f0000000480)={0x28, 0x3, r2, 0x0, &(0x7f0000000400)="c1d1ac7af07b5c36a0e78f965d12b769d185334eaf770249ce5d2c5ee5f3f721e9fc8ac97a50c429d0ff8a47e0f3ed131b807937e6760d2cac08fedb847f21bcfbc6a404d9c04b350b5b6adb9412932ce8b189d3fa2e8888574adbd2cfaf686893640a48f279b67b230e49a61e8161caa0a347", 0x73, 0x6}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r2, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r5, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r8, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r5, r8) 02:52:32 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x2000000, 0x2000}) 02:52:32 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:32 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x4100, 0x2000}) 02:52:32 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xd000000, 0x2000}) 02:52:32 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_ALLOW_IOVAS(r0, 0x3b82, &(0x7f0000000180)={0x18, r4, 0x5, 0x0, &(0x7f00000000c0)=[{0x4, 0x1ff}, {0x1, 0x2189f0fd}, {0x6, 0x4}, {0x12, 0xffffffffffffffff}, {0x5, 0x8000000000000001}]}) dup2(r2, r3) 02:52:32 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x3000000, 0x2000}) 02:52:32 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = signalfd(r0, &(0x7f0000000080)={[0x7c1b4cff]}, 0x8) sendmsg$nl_generic(r1, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000180)={&(0x7f00000002c0)={0x104, 0x14, 0x400, 0x70bd27, 0x25dfdbfb, {0x4}, [@typed={0xee, 0x5f, 0x0, 0x0, @binary="f36957c3013e8710d73ac899a208e79197785176d8aa69a8026dc91cbdde5f894044de1eff9e2a704a180ab53eea10b21bddbfb8689473d149ac2b229c51425e0ebf0b7bc6fa110bd32fb19c7ebacc7ce48e1fb855bcab3769ba92f568fa3977947ba681223583f232170197b20198f0f2b9d67f77c454d4108ba646bb83bba6160b3313036a06889278fdee2c44f1d0115f760cd9d11a292359399400e9f93b39eedc0de67903e864f44a2187da6945ecc1c063f64f06fd555889cb463da20253867f2319552b1e631032361f6e8ecc4bcca7da2a72ae18ba432f3530edfb667c8f98f68ecf74e73d71"}]}, 0x104}, 0x1, 0x0, 0x0, 0x4}, 0x4004) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async, rerun: 64) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (rerun: 64) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r4, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r7, r6, 0x0, 0x100000002) (async) ioctl$IOMMU_IOAS_MAP(r6, 0x3b85, &(0x7f0000000480)={0x28, 0x3, r2, 0x0, &(0x7f0000000400)="c1d1ac7af07b5c36a0e78f965d12b769d185334eaf770249ce5d2c5ee5f3f721e9fc8ac97a50c429d0ff8a47e0f3ed131b807937e6760d2cac08fedb847f21bcfbc6a404d9c04b350b5b6adb9412932ce8b189d3fa2e8888574adbd2cfaf686893640a48f279b67b230e49a61e8161caa0a347", 0x73, 0x6}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r2, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r5, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r8, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) dup2(r5, r8) 02:52:32 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x5c00, 0x2000}) 02:52:32 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:32 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xe000000, 0x2000}) 02:52:32 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) (async) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_ALLOW_IOVAS(r0, 0x3b82, &(0x7f0000000180)={0x18, r4, 0x5, 0x0, &(0x7f00000000c0)=[{0x4, 0x1ff}, {0x1, 0x2189f0fd}, {0x6, 0x4}, {0x12, 0xffffffffffffffff}, {0x5, 0x8000000000000001}]}) (async) dup2(r2, r3) 02:52:33 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x4000000, 0x2000}) 02:52:33 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x7bff, 0x2000}) 02:52:33 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x10000000, 0x2000}) 02:52:33 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_ALLOW_IOVAS(r0, 0x3b82, &(0x7f0000000180)={0x18, r4, 0x5, 0x0, &(0x7f00000000c0)=[{0x4, 0x1ff}, {0x1, 0x2189f0fd}, {0x6, 0x4}, {0x12, 0xffffffffffffffff}, {0x5, 0x8000000000000001}]}) dup2(r2, r3) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1}) (async) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000080)={0xc}) (async) ioctl$IOMMU_IOAS_ALLOW_IOVAS(r0, 0x3b82, &(0x7f0000000180)={0x18, r4, 0x5, 0x0, &(0x7f00000000c0)=[{0x4, 0x1ff}, {0x1, 0x2189f0fd}, {0x6, 0x4}, {0x12, 0xffffffffffffffff}, {0x5, 0x8000000000000001}]}) (async) dup2(r2, r3) (async) 02:52:33 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = signalfd(r0, &(0x7f0000000080)={[0x7c1b4cff]}, 0x8) sendmsg$nl_generic(r1, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000180)={&(0x7f00000002c0)={0x104, 0x14, 0x400, 0x70bd27, 0x25dfdbfb, {0x4}, [@typed={0xee, 0x5f, 0x0, 0x0, @binary="f36957c3013e8710d73ac899a208e79197785176d8aa69a8026dc91cbdde5f894044de1eff9e2a704a180ab53eea10b21bddbfb8689473d149ac2b229c51425e0ebf0b7bc6fa110bd32fb19c7ebacc7ce48e1fb855bcab3769ba92f568fa3977947ba681223583f232170197b20198f0f2b9d67f77c454d4108ba646bb83bba6160b3313036a06889278fdee2c44f1d0115f760cd9d11a292359399400e9f93b39eedc0de67903e864f44a2187da6945ecc1c063f64f06fd555889cb463da20253867f2319552b1e631032361f6e8ecc4bcca7da2a72ae18ba432f3530edfb667c8f98f68ecf74e73d71"}]}, 0x104}, 0x1, 0x0, 0x0, 0x4}, 0x4004) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r4, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r7, r6, 0x0, 0x100000002) ioctl$IOMMU_IOAS_MAP(r6, 0x3b85, &(0x7f0000000480)={0x28, 0x3, r2, 0x0, &(0x7f0000000400)="c1d1ac7af07b5c36a0e78f965d12b769d185334eaf770249ce5d2c5ee5f3f721e9fc8ac97a50c429d0ff8a47e0f3ed131b807937e6760d2cac08fedb847f21bcfbc6a404d9c04b350b5b6adb9412932ce8b189d3fa2e8888574adbd2cfaf686893640a48f279b67b230e49a61e8161caa0a347", 0x73, 0x6}) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r2, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r5, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r8, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) dup2(r5, r8) 02:52:33 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:33 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xf0ff, 0x2000}) 02:52:33 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x5000000, 0x2000}) 02:52:33 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x11000000, 0x2000}) 02:52:33 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:33 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x900, 0x0) syz_open_dev$mouse(&(0x7f0000000080), 0x5, 0x101000) ioctl$F2FS_IOC_MOVE_RANGE(r2, 0xc020f509, &(0x7f0000000180)={r2, 0x20, 0x7f8, 0x200}) openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000100), 0x408280, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000002c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r4, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r5, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r6, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r5, r6) 02:52:33 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xf2ff, 0x2000}) 02:52:33 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x6000000, 0x2000}) 02:52:33 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_UNMAP$ALL(r1, 0x3b86, &(0x7f00000000c0)={0x18, r2}) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r3, 0x0, 0xffffffffffffffff}) dup2(r4, r5) 02:52:33 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x12000000, 0x2000}) 02:52:33 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:33 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xff3f, 0x2000}) 02:52:33 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x7000000, 0x2000}) 02:52:33 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x900, 0x0) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x900, 0x0) syz_open_dev$mouse(&(0x7f0000000080), 0x5, 0x101000) ioctl$F2FS_IOC_MOVE_RANGE(r2, 0xc020f509, &(0x7f0000000180)={r2, 0x20, 0x7f8, 0x200}) openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000100), 0x408280, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000002c0)={0xc}) (async) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000002c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r4, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r4, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r5, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r6, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r5, r6) (async) dup2(r5, r6) 02:52:33 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x18000000, 0x2000}) 02:52:33 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:33 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_UNMAP$ALL(r1, 0x3b86, &(0x7f00000000c0)={0x18, r2}) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r3, 0x0, 0xffffffffffffffff}) dup2(r4, r5) 02:52:33 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xff7b, 0x2000}) 02:52:33 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x8000000, 0x2000}) 02:52:33 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:33 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x900, 0x0) syz_open_dev$mouse(&(0x7f0000000080), 0x5, 0x101000) (async) ioctl$F2FS_IOC_MOVE_RANGE(r2, 0xc020f509, &(0x7f0000000180)={r2, 0x20, 0x7f8, 0x200}) openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000100), 0x408280, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000002c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r4, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r5, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r6, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r5, r6) 02:52:33 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x20000000, 0x2000}) 02:52:33 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xfff0, 0x2000}) 02:52:33 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x25000000, 0x2000}) 02:52:33 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:33 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x9000000, 0x2000}) 02:52:33 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async, rerun: 32) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (rerun: 32) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_UNMAP$ALL(r1, 0x3b86, &(0x7f00000000c0)={0x18, r2}) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r3, 0x0, 0xffffffffffffffff}) dup2(r4, r5) 02:52:33 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000080)={0xc}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r4, r5) 02:52:33 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xfff2, 0x2000}) 02:52:33 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x40000000, 0x2000}) 02:52:33 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xa000000, 0x2000}) 02:52:33 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:33 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000080)={0xc}) (async) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) dup2(r4, r5) 02:52:33 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x200000, 0x2000}) 02:52:33 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000180)={0x28, 0x4, r1, 0x0, &(0x7f0000000080)="0cc393b3596e79dd62442ab2f0ed3aa492b1aca3ae417bb9889b02eeba6ed3d173580e6ead6bee682a1157a3eb88e3ac42edd35d9a322334ea38f9ba7be7e598f7069b244928cc70396a1c12cb31bc59d31906e20f9ab7cc4a89881f9d003fe80296421a84b9aaf7a0682e77fd278f1dc862933e1c2cf46dc4e1b4c7b5212b46166dd82bcaede7699e4f07f224223667c1633541af46d04fe391e9c3f6005beb2866de82865406abdff618723816d8", 0xaf, 0x2}) dup2(r2, r3) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r4, 0x0) r5 = openat$vcsu(0xffffffffffffff9c, &(0x7f00000001c0), 0x80, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_RW(r4, 0x3ba0, &(0x7f0000000200)={0x38, 0x8, r5, 0x0, 0x0, 0x74, &(0x7f0000000280)="ec8afa2ecbd0a5f1d53763ec0c788a2ab450e202c834cb9da99875e169faae019de9294841187be18f0c6d0dda1ea63ac9d6d422e6375029cfa48d0bacc1af8984b3e050a5f4bb1349d7ab82a00a46567d81819a8d44945f4462cac32b09d8a07475fe886a9b02546f2678fbd4947d8bff3bbc31", 0x5}) 02:52:33 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x41000000, 0x2000}) 02:52:33 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:33 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xb000000, 0x2000}) 02:52:33 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x1000000, 0x2000}) 02:52:33 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) (async) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000080)={0xc}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r4, r5) 02:52:34 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:34 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x5c000000, 0x2000}) 02:52:34 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xc000000, 0x2000}) 02:52:34 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_ALLOW_IOVAS(r0, 0x3b82, &(0x7f0000000080)={0x18, r1, 0x6, 0x0, &(0x7f0000000180)=[{0x100, 0x1f}, {0x1, 0xb9f3}, {0x401, 0x5}, {0x9, 0x6}, {0xc00000000000000, 0x9}, {0x40, 0xffffffffffffffff}]}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r4, r5) 02:52:34 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000180)={0x28, 0x4, r1, 0x0, &(0x7f0000000080)="0cc393b3596e79dd62442ab2f0ed3aa492b1aca3ae417bb9889b02eeba6ed3d173580e6ead6bee682a1157a3eb88e3ac42edd35d9a322334ea38f9ba7be7e598f7069b244928cc70396a1c12cb31bc59d31906e20f9ab7cc4a89881f9d003fe80296421a84b9aaf7a0682e77fd278f1dc862933e1c2cf46dc4e1b4c7b5212b46166dd82bcaede7699e4f07f224223667c1633541af46d04fe391e9c3f6005beb2866de82865406abdff618723816d8", 0xaf, 0x2}) (async) dup2(r2, r3) (async, rerun: 32) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (rerun: 32) write$binfmt_script(r4, &(0x7f0000000140)=ANY=[], 0x208e24b) (async, rerun: 32) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r4, 0x0) (rerun: 32) r5 = openat$vcsu(0xffffffffffffff9c, &(0x7f00000001c0), 0x80, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_RW(r4, 0x3ba0, &(0x7f0000000200)={0x38, 0x8, r5, 0x0, 0x0, 0x74, &(0x7f0000000280)="ec8afa2ecbd0a5f1d53763ec0c788a2ab450e202c834cb9da99875e169faae019de9294841187be18f0c6d0dda1ea63ac9d6d422e6375029cfa48d0bacc1af8984b3e050a5f4bb1349d7ab82a00a46567d81819a8d44945f4462cac32b09d8a07475fe886a9b02546f2678fbd4947d8bff3bbc31", 0x5}) 02:52:34 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x2000000, 0x2000}) 02:52:34 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:34 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x7bffffff, 0x2000}) 02:52:34 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xd000000, 0x2000}) 02:52:34 executing program 2: openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_ALLOW_IOVAS(r0, 0x3b82, &(0x7f0000000080)={0x18, r1, 0x6, 0x0, &(0x7f0000000180)=[{0x100, 0x1f}, {0x1, 0xb9f3}, {0x401, 0x5}, {0x9, 0x6}, {0xc00000000000000, 0x9}, {0x40, 0xffffffffffffffff}]}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r4, r5) 02:52:34 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x3000000, 0x2000}) 02:52:34 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:34 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xf0ffffff, 0x2000}) 02:52:34 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xe000000, 0x2000}) 02:52:34 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x4000000, 0x2000}) 02:52:34 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_ALLOW_IOVAS(r0, 0x3b82, &(0x7f0000000080)={0x18, r1, 0x6, 0x0, &(0x7f0000000180)=[{0x100, 0x1f}, {0x1, 0xb9f3}, {0x401, 0x5}, {0x9, 0x6}, {0xc00000000000000, 0x9}, {0x40, 0xffffffffffffffff}]}) (async) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) dup2(r4, r5) 02:52:34 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) (async) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000180)={0x28, 0x4, r1, 0x0, &(0x7f0000000080)="0cc393b3596e79dd62442ab2f0ed3aa492b1aca3ae417bb9889b02eeba6ed3d173580e6ead6bee682a1157a3eb88e3ac42edd35d9a322334ea38f9ba7be7e598f7069b244928cc70396a1c12cb31bc59d31906e20f9ab7cc4a89881f9d003fe80296421a84b9aaf7a0682e77fd278f1dc862933e1c2cf46dc4e1b4c7b5212b46166dd82bcaede7699e4f07f224223667c1633541af46d04fe391e9c3f6005beb2866de82865406abdff618723816d8", 0xaf, 0x2}) dup2(r2, r3) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000140)=ANY=[], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r4, 0x0) r5 = openat$vcsu(0xffffffffffffff9c, &(0x7f00000001c0), 0x80, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_RW(r4, 0x3ba0, &(0x7f0000000200)={0x38, 0x8, r5, 0x0, 0x0, 0x74, &(0x7f0000000280)="ec8afa2ecbd0a5f1d53763ec0c788a2ab450e202c834cb9da99875e169faae019de9294841187be18f0c6d0dda1ea63ac9d6d422e6375029cfa48d0bacc1af8984b3e050a5f4bb1349d7ab82a00a46567d81819a8d44945f4462cac32b09d8a07475fe886a9b02546f2678fbd4947d8bff3bbc31", 0x5}) 02:52:34 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xf2ffffff, 0x2000}) 02:52:34 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:34 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x10000000, 0x2000}) 02:52:34 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x5000000, 0x2000}) 02:52:34 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r7, r6, 0x0, 0x100000002) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000100)={0xc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x0, 0x0, 0x3000000, 0x0, 0x2000}) dup2(r4, r5) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x68000, 0x0) 02:52:34 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) bind$bt_l2cap(r0, &(0x7f00000000c0)={0x1f, 0x3ff, @none, 0x7, 0x2}, 0xe) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r5, r4, 0x0, 0x100000002) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000080)={0xc}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r2, 0x0, 0xffffffffffffffff}) dup2(r3, r6) 02:52:34 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:34 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xfdfdffff, 0x2000}) 02:52:34 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x11000000, 0x2000}) 02:52:34 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x6000000, 0x2000}) 02:52:34 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r7, r6, 0x0, 0x100000002) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000100)={0xc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x0, 0x0, 0x3000000, 0x0, 0x2000}) (async) dup2(r4, r5) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x68000, 0x0) 02:52:34 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x12000000, 0x2000}) 02:52:34 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xff3f0000, 0x2000}) 02:52:34 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, 0x0, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:34 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x7000000, 0x2000}) 02:52:34 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xfffffdfd, 0x2000}) 02:52:34 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x18000000, 0x2000}) [ 612.011660][ T27] audit: type=1804 audit(1683773554.675:133): pid=16339 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir2433829832/syzkaller.5SOzay/750/cgroup.controllers" dev="sda1" ino=1946 res=1 errno=0 02:52:34 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) bind$bt_l2cap(r0, &(0x7f00000000c0)={0x1f, 0x3ff, @none, 0x7, 0x2}, 0xe) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r5, r4, 0x0, 0x100000002) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000080)={0xc}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r2, 0x0, 0xffffffffffffffff}) dup2(r3, r6) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) write$binfmt_script(r0, &(0x7f0000000140)=ANY=[], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) (async) bind$bt_l2cap(r0, &(0x7f00000000c0)={0x1f, 0x3ff, @none, 0x7, 0x2}, 0xe) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000140)={0xc}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendfile(r5, r4, 0x0, 0x100000002) (async) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000080)={0xc}) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r2}) (async) dup2(r3, r6) (async) 02:52:34 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r7, r6, 0x0, 0x100000002) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000100)={0xc}) (async) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x0, 0x0, 0x3000000, 0x0, 0x2000}) (async) dup2(r4, r5) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x68000, 0x0) 02:52:34 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, 0x0, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:34 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x8000000, 0x2000}) 02:52:34 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xffffff7b, 0x2000}) 02:52:34 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x20000000, 0x2000}) 02:52:34 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x25000000, 0x2000}) 02:52:34 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x9000000, 0x2000}) 02:52:34 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, 0x0, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:34 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xffffff7f, 0x2000}) 02:52:35 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000180)={0x26, 'hash\x00', 0x0, 0x0, 'poly1305\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x0) sendto$unix(r2, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r5, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r3, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r7, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) r8 = dup2(r6, r7) r9 = socket$rxrpc(0x21, 0x2, 0xa) r10 = syz_genetlink_get_family_id$batadv(&(0x7f0000007580), 0xffffffffffffffff) recvmmsg(r8, &(0x7f0000001f40)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f00000002c0)=""/127, 0x7f}, {&(0x7f0000000080)=""/38, 0x26}], 0x2, &(0x7f0000000380)=""/218, 0xda}, 0x2}, {{&(0x7f0000000480)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @private0}}}, 0x80, &(0x7f0000001b40)=[{&(0x7f0000000500)=""/60, 0x3c}, {&(0x7f0000000540)=""/134, 0x86}, {&(0x7f0000000600)=""/148, 0x94}, {&(0x7f0000002140)=""/199, 0xc7}, {&(0x7f0000000780)=""/25, 0x19}, {&(0x7f00000007c0)=""/113, 0x71}, {&(0x7f0000000840)=""/254, 0xfe}, {&(0x7f0000000940)=""/200, 0xc8}, {&(0x7f0000000a40)=""/211, 0xd3}, {&(0x7f0000000b40)=""/4096, 0x1000}], 0xa, &(0x7f0000001c00)=""/127, 0x7f}, 0x1}, {{&(0x7f0000001c80)=@ieee802154={0x24, @short}, 0x80, &(0x7f0000001e40)=[{&(0x7f0000001d00)=""/100, 0x64}, {&(0x7f0000001d80)=""/10, 0xa}, {&(0x7f0000001dc0)=""/126, 0x7e}], 0x3, &(0x7f0000001e80)=""/172, 0xac}, 0x7f}], 0x3, 0x20, &(0x7f0000002000)={0x0, 0x3938700}) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000007640)={&(0x7f0000000000)=ANY=[@ANYBLOB="46040000", @ANYRES16=r10, @ANYBLOB="ff830500000000000000", @ANYRES32=r9], 0x4}}, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r7, 0xc018937e, &(0x7f0000000180)={{0x1, 0x1, 0x18, r9, {0x4}}, './file1\x00'}) r12 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r13 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r13, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r13, 0x0) r14 = openat$mice(0xffffffffffffff9c, &(0x7f0000002040), 0x220000) ioctl$IOMMU_TEST_OP_ACCESS_RW(r13, 0x3ba0, &(0x7f0000002100)={0x38, 0x8, r14, 0x0, 0x0, 0x79, &(0x7f0000002080)="6fdb13f53fb842daaec7d4c955380d13cb656487afedcd169eac6f8f7fed0805c58f17c7d64c9f79b3116161d57eddd9eaa66d4e9c62267f4d280b85fb972509317421480eae1661149bfd325b63aba9981fadc66d0445e776942e4c6e535651a93deaa85338b5384f07696bf199d6745beda1724e67349478", 0x4}) write$binfmt_script(r12, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xe, 0x28011, r12, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r11, 0x3ba0, &(0x7f0000000100)={0x38, 0x7, r12, 0x0, 0x10001, 0x0, 0x8, 0x3c6c94, 0x304df0}) 02:52:35 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x40000000, 0x2000}) [ 612.393139][ T27] audit: type=1804 audit(1683773555.055:134): pid=16376 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir2433829832/syzkaller.5SOzay/751/cgroup.controllers" dev="sda1" ino=1951 res=1 errno=0 [ 612.579074][ T27] audit: type=1804 audit(1683773555.245:135): pid=16381 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir2433829832/syzkaller.5SOzay/751/cgroup.controllers" dev="sda1" ino=1951 res=1 errno=0 02:52:35 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000140)=ANY=[], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) bind$bt_l2cap(r0, &(0x7f00000000c0)={0x1f, 0x3ff, @none, 0x7, 0x2}, 0xe) (async) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r5, r4, 0x0, 0x100000002) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000080)={0xc}) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r2, 0x0, 0xffffffffffffffff}) dup2(r3, r6) 02:52:35 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(0xffffffffffffffff, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:35 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xfffffff0, 0x2000}) 02:52:35 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xa000000, 0x2000}) 02:52:35 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x41000000, 0x2000}) 02:52:35 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(0xffffffffffffffff, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:35 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xb000000, 0x2000}) 02:52:35 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xfffffff2, 0x2000}) 02:52:35 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x5c000000, 0x2000}) 02:52:35 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x200000, 0x0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) 02:52:35 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000180)={0x26, 'hash\x00', 0x0, 0x0, 'poly1305\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x0) sendto$unix(r2, 0x0, 0x0, 0x0, 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r5, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r3, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r7, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) r8 = dup2(r6, r7) (async) r9 = socket$rxrpc(0x21, 0x2, 0xa) r10 = syz_genetlink_get_family_id$batadv(&(0x7f0000007580), 0xffffffffffffffff) recvmmsg(r8, &(0x7f0000001f40)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f00000002c0)=""/127, 0x7f}, {&(0x7f0000000080)=""/38, 0x26}], 0x2, &(0x7f0000000380)=""/218, 0xda}, 0x2}, {{&(0x7f0000000480)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @private0}}}, 0x80, &(0x7f0000001b40)=[{&(0x7f0000000500)=""/60, 0x3c}, {&(0x7f0000000540)=""/134, 0x86}, {&(0x7f0000000600)=""/148, 0x94}, {&(0x7f0000002140)=""/199, 0xc7}, {&(0x7f0000000780)=""/25, 0x19}, {&(0x7f00000007c0)=""/113, 0x71}, {&(0x7f0000000840)=""/254, 0xfe}, {&(0x7f0000000940)=""/200, 0xc8}, {&(0x7f0000000a40)=""/211, 0xd3}, {&(0x7f0000000b40)=""/4096, 0x1000}], 0xa, &(0x7f0000001c00)=""/127, 0x7f}, 0x1}, {{&(0x7f0000001c80)=@ieee802154={0x24, @short}, 0x80, &(0x7f0000001e40)=[{&(0x7f0000001d00)=""/100, 0x64}, {&(0x7f0000001d80)=""/10, 0xa}, {&(0x7f0000001dc0)=""/126, 0x7e}], 0x3, &(0x7f0000001e80)=""/172, 0xac}, 0x7f}], 0x3, 0x20, &(0x7f0000002000)={0x0, 0x3938700}) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000007640)={&(0x7f0000000000)=ANY=[@ANYBLOB="46040000", @ANYRES16=r10, @ANYBLOB="ff830500000000000000", @ANYRES32=r9], 0x4}}, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r7, 0xc018937e, &(0x7f0000000180)={{0x1, 0x1, 0x18, r9, {0x4}}, './file1\x00'}) (async, rerun: 32) r12 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async, rerun: 32) r13 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r13, &(0x7f0000000140)=ANY=[], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r13, 0x0) (async) r14 = openat$mice(0xffffffffffffff9c, &(0x7f0000002040), 0x220000) ioctl$IOMMU_TEST_OP_ACCESS_RW(r13, 0x3ba0, &(0x7f0000002100)={0x38, 0x8, r14, 0x0, 0x0, 0x79, &(0x7f0000002080)="6fdb13f53fb842daaec7d4c955380d13cb656487afedcd169eac6f8f7fed0805c58f17c7d64c9f79b3116161d57eddd9eaa66d4e9c62267f4d280b85fb972509317421480eae1661149bfd325b63aba9981fadc66d0445e776942e4c6e535651a93deaa85338b5384f07696bf199d6745beda1724e67349478", 0x4}) write$binfmt_script(r12, &(0x7f0000000140)=ANY=[], 0x208e24b) (async, rerun: 32) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xe, 0x28011, r12, 0x0) (async, rerun: 32) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r11, 0x3ba0, &(0x7f0000000100)={0x38, 0x7, r12, 0x0, 0x10001, 0x0, 0x8, 0x3c6c94, 0x304df0}) 02:52:35 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xc000000, 0x2000}) 02:52:35 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(0xffffffffffffffff, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:35 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xffffffff, 0x2000}) 02:52:35 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x7bffffff, 0x2000}) 02:52:35 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x200000, 0x0) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) 02:52:35 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1a00}) 02:52:35 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:36 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x200000, 0x0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async, rerun: 64) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) (rerun: 64) dup2(r2, r3) 02:52:36 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xd000000, 0x2000}) 02:52:36 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xf0ffffff, 0x2000}) 02:52:36 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xe000000, 0x2000}) 02:52:36 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000180)={0x26, 'hash\x00', 0x0, 0x0, 'poly1305\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x0) sendto$unix(r2, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r5, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r5, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r3, 0x0, 0xffffffffffffffff, 0x1}) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r3, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r7, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) r8 = dup2(r6, r7) r9 = socket$rxrpc(0x21, 0x2, 0xa) syz_genetlink_get_family_id$batadv(&(0x7f0000007580), 0xffffffffffffffff) (async) r10 = syz_genetlink_get_family_id$batadv(&(0x7f0000007580), 0xffffffffffffffff) recvmmsg(r8, &(0x7f0000001f40)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f00000002c0)=""/127, 0x7f}, {&(0x7f0000000080)=""/38, 0x26}], 0x2, &(0x7f0000000380)=""/218, 0xda}, 0x2}, {{&(0x7f0000000480)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @private0}}}, 0x80, &(0x7f0000001b40)=[{&(0x7f0000000500)=""/60, 0x3c}, {&(0x7f0000000540)=""/134, 0x86}, {&(0x7f0000000600)=""/148, 0x94}, {&(0x7f0000002140)=""/199, 0xc7}, {&(0x7f0000000780)=""/25, 0x19}, {&(0x7f00000007c0)=""/113, 0x71}, {&(0x7f0000000840)=""/254, 0xfe}, {&(0x7f0000000940)=""/200, 0xc8}, {&(0x7f0000000a40)=""/211, 0xd3}, {&(0x7f0000000b40)=""/4096, 0x1000}], 0xa, &(0x7f0000001c00)=""/127, 0x7f}, 0x1}, {{&(0x7f0000001c80)=@ieee802154={0x24, @short}, 0x80, &(0x7f0000001e40)=[{&(0x7f0000001d00)=""/100, 0x64}, {&(0x7f0000001d80)=""/10, 0xa}, {&(0x7f0000001dc0)=""/126, 0x7e}], 0x3, &(0x7f0000001e80)=""/172, 0xac}, 0x7f}], 0x3, 0x20, &(0x7f0000002000)={0x0, 0x3938700}) (async) recvmmsg(r8, &(0x7f0000001f40)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f00000002c0)=""/127, 0x7f}, {&(0x7f0000000080)=""/38, 0x26}], 0x2, &(0x7f0000000380)=""/218, 0xda}, 0x2}, {{&(0x7f0000000480)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @private0}}}, 0x80, &(0x7f0000001b40)=[{&(0x7f0000000500)=""/60, 0x3c}, {&(0x7f0000000540)=""/134, 0x86}, {&(0x7f0000000600)=""/148, 0x94}, {&(0x7f0000002140)=""/199, 0xc7}, {&(0x7f0000000780)=""/25, 0x19}, {&(0x7f00000007c0)=""/113, 0x71}, {&(0x7f0000000840)=""/254, 0xfe}, {&(0x7f0000000940)=""/200, 0xc8}, {&(0x7f0000000a40)=""/211, 0xd3}, {&(0x7f0000000b40)=""/4096, 0x1000}], 0xa, &(0x7f0000001c00)=""/127, 0x7f}, 0x1}, {{&(0x7f0000001c80)=@ieee802154={0x24, @short}, 0x80, &(0x7f0000001e40)=[{&(0x7f0000001d00)=""/100, 0x64}, {&(0x7f0000001d80)=""/10, 0xa}, {&(0x7f0000001dc0)=""/126, 0x7e}], 0x3, &(0x7f0000001e80)=""/172, 0xac}, 0x7f}], 0x3, 0x20, &(0x7f0000002000)={0x0, 0x3938700}) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000007640)={&(0x7f0000000000)=ANY=[@ANYBLOB="46040000", @ANYRES16=r10, @ANYBLOB="ff830500000000000000", @ANYRES32=r9], 0x4}}, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000007640)={&(0x7f0000000000)=ANY=[@ANYBLOB="46040000", @ANYRES16=r10, @ANYBLOB="ff830500000000000000", @ANYRES32=r9], 0x4}}, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r7, 0xc018937e, &(0x7f0000000180)={{0x1, 0x1, 0x18, r9, {0x4}}, './file1\x00'}) r12 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) r13 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r13, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r13, 0x0) r14 = openat$mice(0xffffffffffffff9c, &(0x7f0000002040), 0x220000) ioctl$IOMMU_TEST_OP_ACCESS_RW(r13, 0x3ba0, &(0x7f0000002100)={0x38, 0x8, r14, 0x0, 0x0, 0x79, &(0x7f0000002080)="6fdb13f53fb842daaec7d4c955380d13cb656487afedcd169eac6f8f7fed0805c58f17c7d64c9f79b3116161d57eddd9eaa66d4e9c62267f4d280b85fb972509317421480eae1661149bfd325b63aba9981fadc66d0445e776942e4c6e535651a93deaa85338b5384f07696bf199d6745beda1724e67349478", 0x4}) write$binfmt_script(r12, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xe, 0x28011, r12, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r11, 0x3ba0, &(0x7f0000000100)={0x38, 0x7, r12, 0x0, 0x10001, 0x0, 0x8, 0x3c6c94, 0x304df0}) (async) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r11, 0x3ba0, &(0x7f0000000100)={0x38, 0x7, r12, 0x0, 0x10001, 0x0, 0x8, 0x3c6c94, 0x304df0}) 02:52:36 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:36 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1b00}) 02:52:36 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xf2ffffff, 0x2000}) 02:52:36 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x10000000, 0x2000}) 02:52:36 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r0, 0x3b83, &(0x7f00000000c0)={0x28, 0x4, r1, r4, 0x669c3, 0x401, 0x9, 0x20587a}) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r5, 0x0) ioctl$IOMMU_IOAS_ALLOW_IOVAS(r5, 0x3b82, &(0x7f0000000100)={0x18, r1, 0x5, 0x0, &(0x7f0000000180)=[{0x1f, 0xfffffffffffffffc}, {0x7fff, 0x8}, {0x8, 0x8000000000000000}, {0x5, 0x101}, {0x8000, 0x100}]}) 02:52:36 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x11000000, 0x2000}) 02:52:36 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:36 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xfdfdffff, 0x2000}) 02:52:36 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2002}) 02:52:36 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:36 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x12000000, 0x2000}) 02:52:36 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) (async) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r0, 0x3b83, &(0x7f00000000c0)={0x28, 0x4, r1, r4, 0x669c3, 0x401, 0x9, 0x20587a}) (async, rerun: 32) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (rerun: 32) write$binfmt_script(r5, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r5, 0x0) (async) ioctl$IOMMU_IOAS_ALLOW_IOVAS(r5, 0x3b82, &(0x7f0000000100)={0x18, r1, 0x5, 0x0, &(0x7f0000000180)=[{0x1f, 0xfffffffffffffffc}, {0x7fff, 0x8}, {0x8, 0x8000000000000000}, {0x5, 0x101}, {0x8000, 0x100}]}) 02:52:36 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xff3f0000, 0x2000}) 02:52:36 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2003}) 02:52:36 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x18000000, 0x2000}) 02:52:36 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, 0x0, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:36 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, 0x0, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:36 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2004}) 02:52:36 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xfffffdfd, 0x2000}) 02:52:36 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x20000000, 0x2000}) 02:52:36 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) (async) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r0, 0x3b83, &(0x7f00000000c0)={0x28, 0x4, r1, r4, 0x669c3, 0x401, 0x9, 0x20587a}) (async) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000140)=ANY=[], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r5, 0x0) (async) ioctl$IOMMU_IOAS_ALLOW_IOVAS(r5, 0x3b82, &(0x7f0000000100)={0x18, r1, 0x5, 0x0, &(0x7f0000000180)=[{0x1f, 0xfffffffffffffffc}, {0x7fff, 0x8}, {0x8, 0x8000000000000000}, {0x5, 0x101}, {0x8000, 0x100}]}) 02:52:36 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000080), 0x153800, 0x0) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r6, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r5, 0x3ba0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r8, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r4, r8) 02:52:36 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2005}) 02:52:36 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, 0x0, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:36 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xffffff7b, 0x2000}) 02:52:36 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x25000000, 0x2000}) 02:52:36 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000080), 0x153800, 0x0) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r6, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r5, 0x3ba0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r8, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r4, r8) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) (async) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) openat$vcsu(0xffffffffffffff9c, &(0x7f0000000080), 0x153800, 0x0) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000000)={0xc}) (async) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r6, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r7}) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r5, 0x3ba0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) (async) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r8, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) dup2(r4, r8) (async) 02:52:36 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2006}) 02:52:37 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:37 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xffffff7f, 0x2000}) 02:52:37 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x40000000, 0x2000}) 02:52:37 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2007}) 02:52:37 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:37 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) r4 = dup2(r2, r3) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r5, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r5, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r6}) ioctl$IOMMU_IOAS_COPY(r0, 0x3b83, &(0x7f0000000080)={0x28, 0x4, r6, r1, 0x7, 0x4, 0x7}) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000100)={0xc}) 02:52:37 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000080), 0x153800, 0x0) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r6, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r7}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r5, 0x3ba0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r8, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r4, r8) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) (async) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) openat$vcsu(0xffffffffffffff9c, &(0x7f0000000080), 0x153800, 0x0) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000000)={0xc}) (async) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r6, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r7}) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r5, 0x3ba0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) (async) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r8, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) dup2(r4, r8) (async) 02:52:37 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x41000000, 0x2000}) 02:52:37 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2008}) 02:52:37 executing program 1: openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) (async) r4 = dup2(r2, r3) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r5, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r5, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r6}) ioctl$IOMMU_IOAS_COPY(r0, 0x3b83, &(0x7f0000000080)={0x28, 0x4, r6, r1, 0x7, 0x4, 0x7}) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000100)={0xc}) 02:52:37 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xfffffff0, 0x2000}) 02:52:37 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:37 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r4, r5) 02:52:37 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x5c000000, 0x2000}) 02:52:37 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xfffffff2, 0x2000}) 02:52:37 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2009}) 02:52:37 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) r4 = dup2(r2, r3) (async) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r5, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r5, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r6}) (async) ioctl$IOMMU_IOAS_COPY(r0, 0x3b83, &(0x7f0000000080)={0x28, 0x4, r6, r1, 0x7, 0x4, 0x7}) (async) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000100)={0xc}) 02:52:37 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:37 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) dup2(r4, r5) 02:52:37 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x7bffffff, 0x2000}) 02:52:37 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xffffffff, 0x2000}) 02:52:37 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000040), 0x32, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) 02:52:37 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x200a}) 02:52:37 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:37 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xf0ffffff, 0x2000}) 02:52:37 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) dup2(r4, r5) 02:52:37 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1a00}) 02:52:37 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000040), 0x32, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) syz_open_dev$vcsn(&(0x7f0000000040), 0x32, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1}) (async) dup2(r2, r3) (async) 02:52:37 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x200b}) 02:52:37 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:37 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xf2ffffff, 0x2000}) 02:52:37 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x2000, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r4, r5) 02:52:37 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000040), 0x32, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) 02:52:37 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1b00}) 02:52:37 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x200c}) 02:52:37 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:37 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x2000, 0x0) (async) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) dup2(r4, r5) 02:52:37 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xfdfdffff, 0x2000}) 02:52:37 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r7, r6, 0x0, 0x100000002) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000100)={0xc}) sendfile(r5, r4, 0x0, 0x100000002) getsockopt$inet_sctp6_SCTP_EVENTS(r4, 0x84, 0xb, &(0x7f0000000080), &(0x7f00000000c0)=0xe) 02:52:37 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2002}) 02:52:37 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x200d}) 02:52:37 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:37 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2003}) 02:52:37 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xff3f0000, 0x2000}) 02:52:37 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) (async) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r7, r6, 0x0, 0x100000002) (async) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000100)={0xc}) sendfile(r5, r4, 0x0, 0x100000002) (async) getsockopt$inet_sctp6_SCTP_EVENTS(r4, 0x84, 0xb, &(0x7f0000000080), &(0x7f00000000c0)=0xe) 02:52:37 executing program 2: openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x2000, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r4, r5) 02:52:37 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x200e}) 02:52:38 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:38 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xfffffdfd, 0x2000}) 02:52:38 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2004}) 02:52:38 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r7, r6, 0x0, 0x100000002) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000100)={0xc}) sendfile(r5, r4, 0x0, 0x100000002) getsockopt$inet_sctp6_SCTP_EVENTS(r4, 0x84, 0xb, &(0x7f0000000080), &(0x7f00000000c0)=0xe) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1}) (async) dup2(r2, r3) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendfile(r7, r6, 0x0, 0x100000002) (async) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000100)={0xc}) (async) sendfile(r5, r4, 0x0, 0x100000002) (async) getsockopt$inet_sctp6_SCTP_EVENTS(r4, 0x84, 0xb, &(0x7f0000000080), &(0x7f00000000c0)=0xe) (async) 02:52:38 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2010}) 02:52:38 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:38 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2005}) 02:52:38 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xffffff7b, 0x2000}) 02:52:38 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2011}) 02:52:38 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:38 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2006}) 02:52:38 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xffffff7f, 0x2000}) 02:52:38 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2012}) 02:52:38 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:38 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2007}) 02:52:38 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xfffffff0, 0x2000}) 02:52:38 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2018}) 02:52:38 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:38 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2008}) 02:52:38 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r5, r4, 0x0, 0x100000002) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r6, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r7}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r4, 0x3ba0, &(0x7f0000000080)={0x38, 0x2, r7}) 02:52:38 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000180), 0x700001, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f0000000100)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r4, 0x3b85, &(0x7f00000001c0)={0x28, 0x5, r7, 0x0, &(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x6}) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r6, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r8}) ioctl$IOMMU_IOAS_COPY$syz(r4, 0x3b83, &(0x7f0000000080)={0x28, 0x4, r8, r1, 0x80fd9, 0x72, 0x7, 0x37cb63}) pwrite64(0xffffffffffffffff, &(0x7f00000002c0)="b742f9f10174a80babcdc91e95a6c10b78742f5ddcff11395040eabfdb0f6e96a91aebe045e25589cf831f5a5853d62942f26e8201905912f5417460b2a2b1f80971bbfb3f85f39a623ffa78df8021427e25aedf8227142b65c6ab42ad79c72c58e9e9d3b47f496480436061388cedffdb00ca47e8003aa7c17faacd18179a7aeddeca7ce7e986dc6cdcba6fdde5a65176d4fc40831e5c6166b4b42f2ec82be55e9f5bf17d936c71d6b89bf80b6d9576438c2d94c1a4fedcab2bfc8ad59931a54102e9ddb5ca163077305e492157e5b7b2d753ca1896c970573488f8cd8be4ad8e2ba6af96b3aecf15a0c4a31440ceac812deafdcfd46ba9fb6e89f3320078e130c4864cfd2d8001ea6cfddf7590f07f07df74c90b104e7e3b652d26e881e25ed85db7f9eba96c73a2aedb6e6963eb335564c816250a7197c6d26a0d5b230a95b94c617055bdcc7895f711e98ce154297131ce8b703c13736f7b26a8a810a3be9ac6e1ed6e0058a36b04efa3b2a3e36896b270834d7c4ddfffd9eb2604f0feeb96cbc7fa286504a57a42112e461d6ca3e9d68b5152be99c29e875952d86dd84127cecefbec5ea5102b65e528eeaef466268a60bb575f7e310478f04cc9f85883e524bcc1ceb53789d6e791f5a4aa07c2bed9a2d8b5c6740b285945fcceb837ca225b08d48d822973a6779efd10ff484495a4edbf5bf8d053ea5d9b01dad089b3d3a26e04b04c1e38d21d1eec7fd61c618c9a96dac9a4452e8f0fc4629b5e7d933b97645cb95575b13241da3de6516d0961318870b953f6e4abd0da808da9a0c532f7a87c9e6405712ffda2be471a68ae6ebd711a8ed3e81f87f03ca69d6bad0c6b6b22cfff1848bf413899bc4f691c1c33c923bded8039a9e356c3cbb220398c828192b665a2051d621e34437ada1941de054ec88a8177f9e6efa3c4d0f8157615a4d2cbd64558fc02980038d2fab05666d5ad502301890bd6d7a892a1b6db4c50105e153aa1c3ff7464d929d9b7f83483b06ca4c1085cf80881b5aa0d3e25f4a089558ac23ba2e1e8e2c923e2750aae9f1f9c8cf2eae48f275ba7ccc63ce4a6e3f1956a53c869a70c8656a66e7047cd3f013630a9ae28c963cfa8f486b17b5e6476774ba4dfd5bc5eee59e5b981162f6a8e627cf282c5cde5ba3aa7c8cafefb3408e01f2368230b847073efc05b5522f21df477500a0d00dfb9f0d4bec0fb9873f50a6e470fd5d28b84cfb2368debb4ebdf342edf4e9784256f5f813d31c8f479eac30f675af3dc57bfc42c2e9d548ff04b98b8c1d63acbefcd2c90678470d38e3f75a48656f90df1f8d82fa6252287a8e3304308eab9c8772841a84976b84a1c48c31c507ba4f50fc67a5a36851e71fec193ab918880c2d85f8bdd1ad7a28eff4aab9409c6add73a1aaffbc77ae20ecb2cdaa7485cfe41694134a291bbb6317d6d1b88ea98fb0ff50c83967bbaa20b3144acedc9d1f96d1ffdd2209fc7f32df2fcc204e5e037ffb1f5c44d9e8d733a37074f2d1219eafd15a4eb279ef14c388b7363f0ff1cf56c4583b84ba7100e93a021c73c17f4bc0d6920724ec04a0e29c46121a4c36e42e01efea66fabdb22883209cfd3128c3d64e250e76b11b421264c503ced8455ffc9c6ffac45d2ab3b2926025a7c625e3f9fac323f51d6cf63868699c7361cc6486ac8918b74aacf33de90ff5904786e7680fd2e9e769b53328ef2cbb3305c50aafa0111e490126592eb144006b09c8a24874bd3912c7b7011a1f39177f84e96a5e2e10da305b8341981934e13351581c093c6ddde80f4ddf0f7b39df7b1eda15800d96979079c41111d072abe3e8a73a4d1e69e9f244c5606f31b8f59e78f8cd06ed2f826abd798fb77de5ea1830d42d84080669fd28bc48213c38d911168b5fbd2e0dfc8ce9ca99feb5827ff56dae3ac1dc7ec507e878bb7f285368c1a04809bc893c0c7e0be08174e2afb91ca53ec38a6b0c7f22d20273987feaa5474b3e8489c533b36a1ed28e48bb5aecd2f6f4923e48300a77510d1a76f3107217ee58569c310202200ad2bf256a37b1018412ac72723b9664a34a668a6d39b6ea1144d410105cde1d40487071e6d26fa937ef3d5cf6a609222c2da590cd6d74f6d0b90667c471000c0cacfff02ec8b4938cf896294b00d9d0b8a2807a8c109f2998c0f8eb18c9f0d84a6166499dbe3e0009ca769d0291b12c37e558b2d66ca470eb92e68b49760f8d6aa6bc705b4ae3bea6f0f4fa9ce5dd640837a27fbc289f3ab49ba1a135a2f62674c6ed34d3f9e34da6d67f664141581598953da1d5873afe9efd5f3a2294b83cb382a97e936312455ecfeedbac565e066a8b235094aec0077ab8aebe99b751491ba9461718e4dd7668e9ee55e413e63d59339616fff199ecc4b65b668683c4c4e851f654791f9433872a192d3e4826fe34abb54b6b7c520d486840be626ca281126572e9aafa36e812d51b22352ec39f38925ae536eaa147ee87dbc9bcf16a565cefd04800e3054b1cb4a2f13af8661d6902d55869bb4c266ff17f32b263b8247dabd0798a71b0e6a08028f8ce02a15a9d7d8a456648e133d5146a26ae10dac252811419f6e6c7be499ddb6b487298d7346bb0cba962ca78a8115f231b672638e749dfcba49d6bf082d094ee0f138af56443c6686eb374f227cc567d0ce8e1d1e9b9a71e24817b1395d93a7d940c970d0213f1db2788f18b3e2bd6dc0b3ec10b8ffa42a1368ec6f0dba83cb6b503b47a0563da725fe205e401b8971c63e0a0dff7e3324b996fe6f79b0f7827e55b9bad3da3d11ea7d1d1347b80e6a2693ab622deb610a7eb2499074c0bf2abbad18f7493860df2c450417226976ee055f898e271b6db164023cda84c80b62409b768bb536756d35872faf3937350e3f33d1860e018283f902accc0390c73f17e48c86b7ee4264da3315bc22b74904955ac1ff1a30dff6127d5e21913026160cca73306eff821d1777bdda8674ff5afdc487ea584246bef946e0647613e3a9a23f537deeb67c45bdc43c6f4b18bbbbda80ffbd556ca9d5416acb37ebc9e59690ebe1519b7326c8d7ac8f256a68c5473f3a38a01a3be944d261b47a88c232673c1d892c9333269fec9c5b97b9c7d497259bb2a2930e298ae7c333fbcba712ee85dbbf63965359507d2c46e85f4ea399acc9d884f3fe7126481ca1730046a6c9308b74120be0206b546bb2c03bfeaca9c630c1aab2dd9ad16d7a1c6ba6c04fd53044c25e21607cdcb07da00925e97e74ca7ce8c411d59bbdff2eca6821dbca09f2c1a2b5d1ca56393bbf238053889bad65e10c9eac0e1cdd137da296ea746a6d578294b5883fdf3365bc92dd0a0fedc1e52270d9ff6c04022c48cb6fa6d1a4120984255e7a8698cd59ad0946648e060ed0dec19b58acbd14ecd9d3a6774da7489b0496a9952e10003ad07d0989326b50779e970679acb4c636442873bf481f7acf68c8ace6d547a4dbfe093efb9db4631dae8117a1312fe1e9c25b64c5c216b5895e4b08e7d075b0751e125677910ee2bd14f9ddff31c43b9894dd8045f2f67dd97539a8a6331c239fd7355556bdb3667c1c9c2c12af0a33d341dac07abfc918f901776200ef85bfcf8dd85d86303215133a52c2dd55853573afed19b91d6bfcc98437bb9f4fe6853b1d4212202f45f09c9e24d0a032d4d4eb844f974113b2575b7ed856d70ded49221895c4ff606370cde010bbd0f6f04335a19616a516712d5d5cae260f74da39895bf704a6dcdfd62bcd1df35c64788a9b1098470295f55ec1523da25d04b0da7424237e99f20f39af49781aebcf0606fbcacc3df41eaee8bfa21c3e565221ef2c9441ebbb637f51de4756a3712c6fce1d76eda52532a67c807df035891ba07591a6b71a4156fe1f5c289fce9e65945126fa9ce727ba47e90b3a35b8121653e39078ee855351bd178824f0840649305f384ff7d02ed994884e57efb3aba40b7129796c830389a404991eb7f1d39ee81536a50261b9974c685db617c5a1092bba10752ea2dd904359c7f9757c11b130b0c19e29409e448b96eebc79881d288a3471de5bc33f833c854e3593b58f3f321b4dd2a1c0d6aabc00248a3caa4621bffbaa32d96854c419df71e5d1a6e890dcffb6364550f386cd9572d933ff00fa1187a6792416ea987f69c82fa9bf36128df0b9a88adf1076fc1e26712e9a8bc4ce720afef6140963c57f8dd2aba164b5cda787faeeeff401c70e58ed1734640d841b8c3262c678cbaaf424c919f5cc32b0cf8591e087974adf318bac9f3e66a5df4105ed30e0109b79900885099e80bffc292b3553ed8e924c5accec429e061eea618f1938ba2b929e579e03e04dfeb48cdbe6d9ef8b965900d5137bdccceab19d1ad9713d963f3adc3f5edb908dff49af5ed7341506d732e6000d2e7591183dc3dfbbf5716a1b5ebf4b6006b57a007f2979b931aee99c9d0a6cb76449ce07511c87a0834650adef64d96b2053c0e102c00ee2306ef6ab67e44925618270cab9300fd38b21c9a08bc7e047ca34b1d756d11e74f09c3cacaf98e0cd39fc89d0f1e283e1fcde2b76271b128f54cf8b48b1d4434d4488520c0d0aa15f711886ac9815cab118caf46901d8f3dc75e07399dd97202c2579655c6e2a6c46616b76fa7d0d25f4a80f797aa7848f7a04c78b0d6cacdb0cd12a25ffbe84beb10a6ac53b1ed729bd6d200f500ee42ba2228fb4cb75ec08d77cbf5decd20f1fd58f3969699f291d829ef430e195795d5eb34a7b317f02c414765965518723e7799493a3a3522d40d6c5b96858944a6f25fdb27bda489dfb2fb2c5a044afe60da24fba611f0bf052f325b4b17241a1a38b6f551c6cf067532da3e400e7fa57c29083e6f5c90dbcd18411d24b87eec1ac429add9321fb69f1adfdcbc00e2c21b59dc05252da618a43fdd0b4dbbfe834e71660ee8cc9030d305682bdb4d633273f9dcbfe15ac08ad7e7526addd1625ed7c87301701168898cb00f769bd7a37964acd0f74e06eab643e99513c64fddcd8f39bef21a288876dc6cd7e8820ef76c5aa01a99e5250dbdfb7d903e63388c43e110adec52715be493523ab5c1410181c3c18b957f4c15091793a3a43382997c733e8ee84069c196fafae63268c7bc0c60509fef1b02111c107b144566901ca172b6c823214629f7b597529b348fba5ef165c679cb899c5a92d15676df133e2068511829db915abe7d72ce2b04b0b7278b51f673b3fcd0a0a40c56b3a243ac339b69d2110e53f796b93059917a97e6eefcedab82cf6d1e4db25e71f68e61ecd7782bc533b52d103db4374abb95178ca55eb4b5f2ef5dee68badb39cd26ba33a0c9260f08ce0176c178fafe31d5844fb6f13dd09a0e2ba47986b5622c00a484217de1402c04c363fc9d92f358de81396bca52c9879f1946b0a4ec3abaaff470b8955ffd034e704241e2cfc6156f34193669d82226572c02a89fb4eed9fc615e80cf8b2f92df1d15970be9fb49f9fa654030e9554647e83a93f6358bedca033ff504109d18afe1dcdeccdd9dc6a562885034a5030e224b610c939c695380356dfd09138ec1c672e86cd81aad4c55ac44202db144bec06593fc96975201392e084cfd76869e26dbfcfce1eb61fd08bab5eabb34a31c5b4386cb94159bf02703ec8de14cb8d33073e6fe00ad7acbfac9605db19d276b45b5ec255cf69295d2b921a6de05ba07c9be54539b850989dba65fbfc9d1547e555edd43d9ba0812fa54605a7b1adbb9dc2dd2339456822e3ce", 0xff3, 0x62e) dup2(r4, r5) 02:52:38 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xfffffff2, 0x2000}) 02:52:38 executing program 1: openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r5, r4, 0x0, 0x100000002) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r6, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r7}) (async) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r6, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r7}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r4, 0x3ba0, &(0x7f0000000080)={0x38, 0x2, r7}) 02:52:38 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:38 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2025}) 02:52:38 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000180), 0x700001, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f0000000100)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r4, 0x3b85, &(0x7f00000001c0)={0x28, 0x5, r7, 0x0, &(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x6}) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r6, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r8}) ioctl$IOMMU_IOAS_COPY$syz(r4, 0x3b83, &(0x7f0000000080)={0x28, 0x4, r8, r1, 0x80fd9, 0x72, 0x7, 0x37cb63}) pwrite64(0xffffffffffffffff, &(0x7f00000002c0)="b742f9f10174a80babcdc91e95a6c10b78742f5ddcff11395040eabfdb0f6e96a91aebe045e25589cf831f5a5853d62942f26e8201905912f5417460b2a2b1f80971bbfb3f85f39a623ffa78df8021427e25aedf8227142b65c6ab42ad79c72c58e9e9d3b47f496480436061388cedffdb00ca47e8003aa7c17faacd18179a7aeddeca7ce7e986dc6cdcba6fdde5a65176d4fc40831e5c6166b4b42f2ec82be55e9f5bf17d936c71d6b89bf80b6d9576438c2d94c1a4fedcab2bfc8ad59931a54102e9ddb5ca163077305e492157e5b7b2d753ca1896c970573488f8cd8be4ad8e2ba6af96b3aecf15a0c4a31440ceac812deafdcfd46ba9fb6e89f3320078e130c4864cfd2d8001ea6cfddf7590f07f07df74c90b104e7e3b652d26e881e25ed85db7f9eba96c73a2aedb6e6963eb335564c816250a7197c6d26a0d5b230a95b94c617055bdcc7895f711e98ce154297131ce8b703c13736f7b26a8a810a3be9ac6e1ed6e0058a36b04efa3b2a3e36896b270834d7c4ddfffd9eb2604f0feeb96cbc7fa286504a57a42112e461d6ca3e9d68b5152be99c29e875952d86dd84127cecefbec5ea5102b65e528eeaef466268a60bb575f7e310478f04cc9f85883e524bcc1ceb53789d6e791f5a4aa07c2bed9a2d8b5c6740b285945fcceb837ca225b08d48d822973a6779efd10ff484495a4edbf5bf8d053ea5d9b01dad089b3d3a26e04b04c1e38d21d1eec7fd61c618c9a96dac9a4452e8f0fc4629b5e7d933b97645cb95575b13241da3de6516d0961318870b953f6e4abd0da808da9a0c532f7a87c9e6405712ffda2be471a68ae6ebd711a8ed3e81f87f03ca69d6bad0c6b6b22cfff1848bf413899bc4f691c1c33c923bded8039a9e356c3cbb220398c828192b665a2051d621e34437ada1941de054ec88a8177f9e6efa3c4d0f8157615a4d2cbd64558fc02980038d2fab05666d5ad502301890bd6d7a892a1b6db4c50105e153aa1c3ff7464d929d9b7f83483b06ca4c1085cf80881b5aa0d3e25f4a089558ac23ba2e1e8e2c923e2750aae9f1f9c8cf2eae48f275ba7ccc63ce4a6e3f1956a53c869a70c8656a66e7047cd3f013630a9ae28c963cfa8f486b17b5e6476774ba4dfd5bc5eee59e5b981162f6a8e627cf282c5cde5ba3aa7c8cafefb3408e01f2368230b847073efc05b5522f21df477500a0d00dfb9f0d4bec0fb9873f50a6e470fd5d28b84cfb2368debb4ebdf342edf4e9784256f5f813d31c8f479eac30f675af3dc57bfc42c2e9d548ff04b98b8c1d63acbefcd2c90678470d38e3f75a48656f90df1f8d82fa6252287a8e3304308eab9c8772841a84976b84a1c48c31c507ba4f50fc67a5a36851e71fec193ab918880c2d85f8bdd1ad7a28eff4aab9409c6add73a1aaffbc77ae20ecb2cdaa7485cfe41694134a291bbb6317d6d1b88ea98fb0ff50c83967bbaa20b3144acedc9d1f96d1ffdd2209fc7f32df2fcc204e5e037ffb1f5c44d9e8d733a37074f2d1219eafd15a4eb279ef14c388b7363f0ff1cf56c4583b84ba7100e93a021c73c17f4bc0d6920724ec04a0e29c46121a4c36e42e01efea66fabdb22883209cfd3128c3d64e250e76b11b421264c503ced8455ffc9c6ffac45d2ab3b2926025a7c625e3f9fac323f51d6cf63868699c7361cc6486ac8918b74aacf33de90ff5904786e7680fd2e9e769b53328ef2cbb3305c50aafa0111e490126592eb144006b09c8a24874bd3912c7b7011a1f39177f84e96a5e2e10da305b8341981934e13351581c093c6ddde80f4ddf0f7b39df7b1eda15800d96979079c41111d072abe3e8a73a4d1e69e9f244c5606f31b8f59e78f8cd06ed2f826abd798fb77de5ea1830d42d84080669fd28bc48213c38d911168b5fbd2e0dfc8ce9ca99feb5827ff56dae3ac1dc7ec507e878bb7f285368c1a04809bc893c0c7e0be08174e2afb91ca53ec38a6b0c7f22d20273987feaa5474b3e8489c533b36a1ed28e48bb5aecd2f6f4923e48300a77510d1a76f3107217ee58569c310202200ad2bf256a37b1018412ac72723b9664a34a668a6d39b6ea1144d410105cde1d40487071e6d26fa937ef3d5cf6a609222c2da590cd6d74f6d0b90667c471000c0cacfff02ec8b4938cf896294b00d9d0b8a2807a8c109f2998c0f8eb18c9f0d84a6166499dbe3e0009ca769d0291b12c37e558b2d66ca470eb92e68b49760f8d6aa6bc705b4ae3bea6f0f4fa9ce5dd640837a27fbc289f3ab49ba1a135a2f62674c6ed34d3f9e34da6d67f664141581598953da1d5873afe9efd5f3a2294b83cb382a97e936312455ecfeedbac565e066a8b235094aec0077ab8aebe99b751491ba9461718e4dd7668e9ee55e413e63d59339616fff199ecc4b65b668683c4c4e851f654791f9433872a192d3e4826fe34abb54b6b7c520d486840be626ca281126572e9aafa36e812d51b22352ec39f38925ae536eaa147ee87dbc9bcf16a565cefd04800e3054b1cb4a2f13af8661d6902d55869bb4c266ff17f32b263b8247dabd0798a71b0e6a08028f8ce02a15a9d7d8a456648e133d5146a26ae10dac252811419f6e6c7be499ddb6b487298d7346bb0cba962ca78a8115f231b672638e749dfcba49d6bf082d094ee0f138af56443c6686eb374f227cc567d0ce8e1d1e9b9a71e24817b1395d93a7d940c970d0213f1db2788f18b3e2bd6dc0b3ec10b8ffa42a1368ec6f0dba83cb6b503b47a0563da725fe205e401b8971c63e0a0dff7e3324b996fe6f79b0f7827e55b9bad3da3d11ea7d1d1347b80e6a2693ab622deb610a7eb2499074c0bf2abbad18f7493860df2c450417226976ee055f898e271b6db164023cda84c80b62409b768bb536756d35872faf3937350e3f33d1860e018283f902accc0390c73f17e48c86b7ee4264da3315bc22b74904955ac1ff1a30dff6127d5e21913026160cca73306eff821d1777bdda8674ff5afdc487ea584246bef946e0647613e3a9a23f537deeb67c45bdc43c6f4b18bbbbda80ffbd556ca9d5416acb37ebc9e59690ebe1519b7326c8d7ac8f256a68c5473f3a38a01a3be944d261b47a88c232673c1d892c9333269fec9c5b97b9c7d497259bb2a2930e298ae7c333fbcba712ee85dbbf63965359507d2c46e85f4ea399acc9d884f3fe7126481ca1730046a6c9308b74120be0206b546bb2c03bfeaca9c630c1aab2dd9ad16d7a1c6ba6c04fd53044c25e21607cdcb07da00925e97e74ca7ce8c411d59bbdff2eca6821dbca09f2c1a2b5d1ca56393bbf238053889bad65e10c9eac0e1cdd137da296ea746a6d578294b5883fdf3365bc92dd0a0fedc1e52270d9ff6c04022c48cb6fa6d1a4120984255e7a8698cd59ad0946648e060ed0dec19b58acbd14ecd9d3a6774da7489b0496a9952e10003ad07d0989326b50779e970679acb4c636442873bf481f7acf68c8ace6d547a4dbfe093efb9db4631dae8117a1312fe1e9c25b64c5c216b5895e4b08e7d075b0751e125677910ee2bd14f9ddff31c43b9894dd8045f2f67dd97539a8a6331c239fd7355556bdb3667c1c9c2c12af0a33d341dac07abfc918f901776200ef85bfcf8dd85d86303215133a52c2dd55853573afed19b91d6bfcc98437bb9f4fe6853b1d4212202f45f09c9e24d0a032d4d4eb844f974113b2575b7ed856d70ded49221895c4ff606370cde010bbd0f6f04335a19616a516712d5d5cae260f74da39895bf704a6dcdfd62bcd1df35c64788a9b1098470295f55ec1523da25d04b0da7424237e99f20f39af49781aebcf0606fbcacc3df41eaee8bfa21c3e565221ef2c9441ebbb637f51de4756a3712c6fce1d76eda52532a67c807df035891ba07591a6b71a4156fe1f5c289fce9e65945126fa9ce727ba47e90b3a35b8121653e39078ee855351bd178824f0840649305f384ff7d02ed994884e57efb3aba40b7129796c830389a404991eb7f1d39ee81536a50261b9974c685db617c5a1092bba10752ea2dd904359c7f9757c11b130b0c19e29409e448b96eebc79881d288a3471de5bc33f833c854e3593b58f3f321b4dd2a1c0d6aabc00248a3caa4621bffbaa32d96854c419df71e5d1a6e890dcffb6364550f386cd9572d933ff00fa1187a6792416ea987f69c82fa9bf36128df0b9a88adf1076fc1e26712e9a8bc4ce720afef6140963c57f8dd2aba164b5cda787faeeeff401c70e58ed1734640d841b8c3262c678cbaaf424c919f5cc32b0cf8591e087974adf318bac9f3e66a5df4105ed30e0109b79900885099e80bffc292b3553ed8e924c5accec429e061eea618f1938ba2b929e579e03e04dfeb48cdbe6d9ef8b965900d5137bdccceab19d1ad9713d963f3adc3f5edb908dff49af5ed7341506d732e6000d2e7591183dc3dfbbf5716a1b5ebf4b6006b57a007f2979b931aee99c9d0a6cb76449ce07511c87a0834650adef64d96b2053c0e102c00ee2306ef6ab67e44925618270cab9300fd38b21c9a08bc7e047ca34b1d756d11e74f09c3cacaf98e0cd39fc89d0f1e283e1fcde2b76271b128f54cf8b48b1d4434d4488520c0d0aa15f711886ac9815cab118caf46901d8f3dc75e07399dd97202c2579655c6e2a6c46616b76fa7d0d25f4a80f797aa7848f7a04c78b0d6cacdb0cd12a25ffbe84beb10a6ac53b1ed729bd6d200f500ee42ba2228fb4cb75ec08d77cbf5decd20f1fd58f3969699f291d829ef430e195795d5eb34a7b317f02c414765965518723e7799493a3a3522d40d6c5b96858944a6f25fdb27bda489dfb2fb2c5a044afe60da24fba611f0bf052f325b4b17241a1a38b6f551c6cf067532da3e400e7fa57c29083e6f5c90dbcd18411d24b87eec1ac429add9321fb69f1adfdcbc00e2c21b59dc05252da618a43fdd0b4dbbfe834e71660ee8cc9030d305682bdb4d633273f9dcbfe15ac08ad7e7526addd1625ed7c87301701168898cb00f769bd7a37964acd0f74e06eab643e99513c64fddcd8f39bef21a288876dc6cd7e8820ef76c5aa01a99e5250dbdfb7d903e63388c43e110adec52715be493523ab5c1410181c3c18b957f4c15091793a3a43382997c733e8ee84069c196fafae63268c7bc0c60509fef1b02111c107b144566901ca172b6c823214629f7b597529b348fba5ef165c679cb899c5a92d15676df133e2068511829db915abe7d72ce2b04b0b7278b51f673b3fcd0a0a40c56b3a243ac339b69d2110e53f796b93059917a97e6eefcedab82cf6d1e4db25e71f68e61ecd7782bc533b52d103db4374abb95178ca55eb4b5f2ef5dee68badb39cd26ba33a0c9260f08ce0176c178fafe31d5844fb6f13dd09a0e2ba47986b5622c00a484217de1402c04c363fc9d92f358de81396bca52c9879f1946b0a4ec3abaaff470b8955ffd034e704241e2cfc6156f34193669d82226572c02a89fb4eed9fc615e80cf8b2f92df1d15970be9fb49f9fa654030e9554647e83a93f6358bedca033ff504109d18afe1dcdeccdd9dc6a562885034a5030e224b610c939c695380356dfd09138ec1c672e86cd81aad4c55ac44202db144bec06593fc96975201392e084cfd76869e26dbfcfce1eb61fd08bab5eabb34a31c5b4386cb94159bf02703ec8de14cb8d33073e6fe00ad7acbfac9605db19d276b45b5ec255cf69295d2b921a6de05ba07c9be54539b850989dba65fbfc9d1547e555edd43d9ba0812fa54605a7b1adbb9dc2dd2339456822e3ce", 0xff3, 0x62e) dup2(r4, r5) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000180), 0x700001, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) (async) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) (async) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f0000000100)={0xc}) (async) ioctl$IOMMU_IOAS_MAP$PAGES(r4, 0x3b85, &(0x7f00000001c0)={0x28, 0x5, r7, 0x0, &(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x6}) (async) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000000)={0xc}) (async) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r6, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r8}) (async) ioctl$IOMMU_IOAS_COPY$syz(r4, 0x3b83, &(0x7f0000000080)={0x28, 0x4, r8, r1, 0x80fd9, 0x72, 0x7, 0x37cb63}) (async) pwrite64(0xffffffffffffffff, &(0x7f00000002c0)="b742f9f10174a80babcdc91e95a6c10b78742f5ddcff11395040eabfdb0f6e96a91aebe045e25589cf831f5a5853d62942f26e8201905912f5417460b2a2b1f80971bbfb3f85f39a623ffa78df8021427e25aedf8227142b65c6ab42ad79c72c58e9e9d3b47f496480436061388cedffdb00ca47e8003aa7c17faacd18179a7aeddeca7ce7e986dc6cdcba6fdde5a65176d4fc40831e5c6166b4b42f2ec82be55e9f5bf17d936c71d6b89bf80b6d9576438c2d94c1a4fedcab2bfc8ad59931a54102e9ddb5ca163077305e492157e5b7b2d753ca1896c970573488f8cd8be4ad8e2ba6af96b3aecf15a0c4a31440ceac812deafdcfd46ba9fb6e89f3320078e130c4864cfd2d8001ea6cfddf7590f07f07df74c90b104e7e3b652d26e881e25ed85db7f9eba96c73a2aedb6e6963eb335564c816250a7197c6d26a0d5b230a95b94c617055bdcc7895f711e98ce154297131ce8b703c13736f7b26a8a810a3be9ac6e1ed6e0058a36b04efa3b2a3e36896b270834d7c4ddfffd9eb2604f0feeb96cbc7fa286504a57a42112e461d6ca3e9d68b5152be99c29e875952d86dd84127cecefbec5ea5102b65e528eeaef466268a60bb575f7e310478f04cc9f85883e524bcc1ceb53789d6e791f5a4aa07c2bed9a2d8b5c6740b285945fcceb837ca225b08d48d822973a6779efd10ff484495a4edbf5bf8d053ea5d9b01dad089b3d3a26e04b04c1e38d21d1eec7fd61c618c9a96dac9a4452e8f0fc4629b5e7d933b97645cb95575b13241da3de6516d0961318870b953f6e4abd0da808da9a0c532f7a87c9e6405712ffda2be471a68ae6ebd711a8ed3e81f87f03ca69d6bad0c6b6b22cfff1848bf413899bc4f691c1c33c923bded8039a9e356c3cbb220398c828192b665a2051d621e34437ada1941de054ec88a8177f9e6efa3c4d0f8157615a4d2cbd64558fc02980038d2fab05666d5ad502301890bd6d7a892a1b6db4c50105e153aa1c3ff7464d929d9b7f83483b06ca4c1085cf80881b5aa0d3e25f4a089558ac23ba2e1e8e2c923e2750aae9f1f9c8cf2eae48f275ba7ccc63ce4a6e3f1956a53c869a70c8656a66e7047cd3f013630a9ae28c963cfa8f486b17b5e6476774ba4dfd5bc5eee59e5b981162f6a8e627cf282c5cde5ba3aa7c8cafefb3408e01f2368230b847073efc05b5522f21df477500a0d00dfb9f0d4bec0fb9873f50a6e470fd5d28b84cfb2368debb4ebdf342edf4e9784256f5f813d31c8f479eac30f675af3dc57bfc42c2e9d548ff04b98b8c1d63acbefcd2c90678470d38e3f75a48656f90df1f8d82fa6252287a8e3304308eab9c8772841a84976b84a1c48c31c507ba4f50fc67a5a36851e71fec193ab918880c2d85f8bdd1ad7a28eff4aab9409c6add73a1aaffbc77ae20ecb2cdaa7485cfe41694134a291bbb6317d6d1b88ea98fb0ff50c83967bbaa20b3144acedc9d1f96d1ffdd2209fc7f32df2fcc204e5e037ffb1f5c44d9e8d733a37074f2d1219eafd15a4eb279ef14c388b7363f0ff1cf56c4583b84ba7100e93a021c73c17f4bc0d6920724ec04a0e29c46121a4c36e42e01efea66fabdb22883209cfd3128c3d64e250e76b11b421264c503ced8455ffc9c6ffac45d2ab3b2926025a7c625e3f9fac323f51d6cf63868699c7361cc6486ac8918b74aacf33de90ff5904786e7680fd2e9e769b53328ef2cbb3305c50aafa0111e490126592eb144006b09c8a24874bd3912c7b7011a1f39177f84e96a5e2e10da305b8341981934e13351581c093c6ddde80f4ddf0f7b39df7b1eda15800d96979079c41111d072abe3e8a73a4d1e69e9f244c5606f31b8f59e78f8cd06ed2f826abd798fb77de5ea1830d42d84080669fd28bc48213c38d911168b5fbd2e0dfc8ce9ca99feb5827ff56dae3ac1dc7ec507e878bb7f285368c1a04809bc893c0c7e0be08174e2afb91ca53ec38a6b0c7f22d20273987feaa5474b3e8489c533b36a1ed28e48bb5aecd2f6f4923e48300a77510d1a76f3107217ee58569c310202200ad2bf256a37b1018412ac72723b9664a34a668a6d39b6ea1144d410105cde1d40487071e6d26fa937ef3d5cf6a609222c2da590cd6d74f6d0b90667c471000c0cacfff02ec8b4938cf896294b00d9d0b8a2807a8c109f2998c0f8eb18c9f0d84a6166499dbe3e0009ca769d0291b12c37e558b2d66ca470eb92e68b49760f8d6aa6bc705b4ae3bea6f0f4fa9ce5dd640837a27fbc289f3ab49ba1a135a2f62674c6ed34d3f9e34da6d67f664141581598953da1d5873afe9efd5f3a2294b83cb382a97e936312455ecfeedbac565e066a8b235094aec0077ab8aebe99b751491ba9461718e4dd7668e9ee55e413e63d59339616fff199ecc4b65b668683c4c4e851f654791f9433872a192d3e4826fe34abb54b6b7c520d486840be626ca281126572e9aafa36e812d51b22352ec39f38925ae536eaa147ee87dbc9bcf16a565cefd04800e3054b1cb4a2f13af8661d6902d55869bb4c266ff17f32b263b8247dabd0798a71b0e6a08028f8ce02a15a9d7d8a456648e133d5146a26ae10dac252811419f6e6c7be499ddb6b487298d7346bb0cba962ca78a8115f231b672638e749dfcba49d6bf082d094ee0f138af56443c6686eb374f227cc567d0ce8e1d1e9b9a71e24817b1395d93a7d940c970d0213f1db2788f18b3e2bd6dc0b3ec10b8ffa42a1368ec6f0dba83cb6b503b47a0563da725fe205e401b8971c63e0a0dff7e3324b996fe6f79b0f7827e55b9bad3da3d11ea7d1d1347b80e6a2693ab622deb610a7eb2499074c0bf2abbad18f7493860df2c450417226976ee055f898e271b6db164023cda84c80b62409b768bb536756d35872faf3937350e3f33d1860e018283f902accc0390c73f17e48c86b7ee4264da3315bc22b74904955ac1ff1a30dff6127d5e21913026160cca73306eff821d1777bdda8674ff5afdc487ea584246bef946e0647613e3a9a23f537deeb67c45bdc43c6f4b18bbbbda80ffbd556ca9d5416acb37ebc9e59690ebe1519b7326c8d7ac8f256a68c5473f3a38a01a3be944d261b47a88c232673c1d892c9333269fec9c5b97b9c7d497259bb2a2930e298ae7c333fbcba712ee85dbbf63965359507d2c46e85f4ea399acc9d884f3fe7126481ca1730046a6c9308b74120be0206b546bb2c03bfeaca9c630c1aab2dd9ad16d7a1c6ba6c04fd53044c25e21607cdcb07da00925e97e74ca7ce8c411d59bbdff2eca6821dbca09f2c1a2b5d1ca56393bbf238053889bad65e10c9eac0e1cdd137da296ea746a6d578294b5883fdf3365bc92dd0a0fedc1e52270d9ff6c04022c48cb6fa6d1a4120984255e7a8698cd59ad0946648e060ed0dec19b58acbd14ecd9d3a6774da7489b0496a9952e10003ad07d0989326b50779e970679acb4c636442873bf481f7acf68c8ace6d547a4dbfe093efb9db4631dae8117a1312fe1e9c25b64c5c216b5895e4b08e7d075b0751e125677910ee2bd14f9ddff31c43b9894dd8045f2f67dd97539a8a6331c239fd7355556bdb3667c1c9c2c12af0a33d341dac07abfc918f901776200ef85bfcf8dd85d86303215133a52c2dd55853573afed19b91d6bfcc98437bb9f4fe6853b1d4212202f45f09c9e24d0a032d4d4eb844f974113b2575b7ed856d70ded49221895c4ff606370cde010bbd0f6f04335a19616a516712d5d5cae260f74da39895bf704a6dcdfd62bcd1df35c64788a9b1098470295f55ec1523da25d04b0da7424237e99f20f39af49781aebcf0606fbcacc3df41eaee8bfa21c3e565221ef2c9441ebbb637f51de4756a3712c6fce1d76eda52532a67c807df035891ba07591a6b71a4156fe1f5c289fce9e65945126fa9ce727ba47e90b3a35b8121653e39078ee855351bd178824f0840649305f384ff7d02ed994884e57efb3aba40b7129796c830389a404991eb7f1d39ee81536a50261b9974c685db617c5a1092bba10752ea2dd904359c7f9757c11b130b0c19e29409e448b96eebc79881d288a3471de5bc33f833c854e3593b58f3f321b4dd2a1c0d6aabc00248a3caa4621bffbaa32d96854c419df71e5d1a6e890dcffb6364550f386cd9572d933ff00fa1187a6792416ea987f69c82fa9bf36128df0b9a88adf1076fc1e26712e9a8bc4ce720afef6140963c57f8dd2aba164b5cda787faeeeff401c70e58ed1734640d841b8c3262c678cbaaf424c919f5cc32b0cf8591e087974adf318bac9f3e66a5df4105ed30e0109b79900885099e80bffc292b3553ed8e924c5accec429e061eea618f1938ba2b929e579e03e04dfeb48cdbe6d9ef8b965900d5137bdccceab19d1ad9713d963f3adc3f5edb908dff49af5ed7341506d732e6000d2e7591183dc3dfbbf5716a1b5ebf4b6006b57a007f2979b931aee99c9d0a6cb76449ce07511c87a0834650adef64d96b2053c0e102c00ee2306ef6ab67e44925618270cab9300fd38b21c9a08bc7e047ca34b1d756d11e74f09c3cacaf98e0cd39fc89d0f1e283e1fcde2b76271b128f54cf8b48b1d4434d4488520c0d0aa15f711886ac9815cab118caf46901d8f3dc75e07399dd97202c2579655c6e2a6c46616b76fa7d0d25f4a80f797aa7848f7a04c78b0d6cacdb0cd12a25ffbe84beb10a6ac53b1ed729bd6d200f500ee42ba2228fb4cb75ec08d77cbf5decd20f1fd58f3969699f291d829ef430e195795d5eb34a7b317f02c414765965518723e7799493a3a3522d40d6c5b96858944a6f25fdb27bda489dfb2fb2c5a044afe60da24fba611f0bf052f325b4b17241a1a38b6f551c6cf067532da3e400e7fa57c29083e6f5c90dbcd18411d24b87eec1ac429add9321fb69f1adfdcbc00e2c21b59dc05252da618a43fdd0b4dbbfe834e71660ee8cc9030d305682bdb4d633273f9dcbfe15ac08ad7e7526addd1625ed7c87301701168898cb00f769bd7a37964acd0f74e06eab643e99513c64fddcd8f39bef21a288876dc6cd7e8820ef76c5aa01a99e5250dbdfb7d903e63388c43e110adec52715be493523ab5c1410181c3c18b957f4c15091793a3a43382997c733e8ee84069c196fafae63268c7bc0c60509fef1b02111c107b144566901ca172b6c823214629f7b597529b348fba5ef165c679cb899c5a92d15676df133e2068511829db915abe7d72ce2b04b0b7278b51f673b3fcd0a0a40c56b3a243ac339b69d2110e53f796b93059917a97e6eefcedab82cf6d1e4db25e71f68e61ecd7782bc533b52d103db4374abb95178ca55eb4b5f2ef5dee68badb39cd26ba33a0c9260f08ce0176c178fafe31d5844fb6f13dd09a0e2ba47986b5622c00a484217de1402c04c363fc9d92f358de81396bca52c9879f1946b0a4ec3abaaff470b8955ffd034e704241e2cfc6156f34193669d82226572c02a89fb4eed9fc615e80cf8b2f92df1d15970be9fb49f9fa654030e9554647e83a93f6358bedca033ff504109d18afe1dcdeccdd9dc6a562885034a5030e224b610c939c695380356dfd09138ec1c672e86cd81aad4c55ac44202db144bec06593fc96975201392e084cfd76869e26dbfcfce1eb61fd08bab5eabb34a31c5b4386cb94159bf02703ec8de14cb8d33073e6fe00ad7acbfac9605db19d276b45b5ec255cf69295d2b921a6de05ba07c9be54539b850989dba65fbfc9d1547e555edd43d9ba0812fa54605a7b1adbb9dc2dd2339456822e3ce", 0xff3, 0x62e) (async) dup2(r4, r5) (async) 02:52:38 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2009}) 02:52:38 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0xffffffff, 0x2000}) 02:52:38 executing program 1: openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1}) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) (async) dup2(r2, r3) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r5, r4, 0x0, 0x100000002) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r6, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r7}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r4, 0x3ba0, &(0x7f0000000080)={0x38, 0x2, r7}) 02:52:38 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2041}) 02:52:38 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:38 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x200a}) 02:52:38 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) r4 = dup2(r2, r3) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f00000000c0)={0x38, 0x7, r3, 0x0, 0x8000, 0x0, 0x0, 0x2c36cf, 0x2670e3}) ioctl$BTRFS_IOC_QGROUP_CREATE(r4, 0x4010942a, &(0x7f0000000080)={0x0, 0x5}) 02:52:38 executing program 2: openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000180), 0x700001, 0x0) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000180), 0x700001, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f0000000100)={0xc}) (async) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f0000000100)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r4, 0x3b85, &(0x7f00000001c0)={0x28, 0x5, r7, 0x0, &(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x6}) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r6, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r8}) ioctl$IOMMU_IOAS_COPY$syz(r4, 0x3b83, &(0x7f0000000080)={0x28, 0x4, r8, r1, 0x80fd9, 0x72, 0x7, 0x37cb63}) (async) ioctl$IOMMU_IOAS_COPY$syz(r4, 0x3b83, &(0x7f0000000080)={0x28, 0x4, r8, r1, 0x80fd9, 0x72, 0x7, 0x37cb63}) pwrite64(0xffffffffffffffff, &(0x7f00000002c0)="b742f9f10174a80babcdc91e95a6c10b78742f5ddcff11395040eabfdb0f6e96a91aebe045e25589cf831f5a5853d62942f26e8201905912f5417460b2a2b1f80971bbfb3f85f39a623ffa78df8021427e25aedf8227142b65c6ab42ad79c72c58e9e9d3b47f496480436061388cedffdb00ca47e8003aa7c17faacd18179a7aeddeca7ce7e986dc6cdcba6fdde5a65176d4fc40831e5c6166b4b42f2ec82be55e9f5bf17d936c71d6b89bf80b6d9576438c2d94c1a4fedcab2bfc8ad59931a54102e9ddb5ca163077305e492157e5b7b2d753ca1896c970573488f8cd8be4ad8e2ba6af96b3aecf15a0c4a31440ceac812deafdcfd46ba9fb6e89f3320078e130c4864cfd2d8001ea6cfddf7590f07f07df74c90b104e7e3b652d26e881e25ed85db7f9eba96c73a2aedb6e6963eb335564c816250a7197c6d26a0d5b230a95b94c617055bdcc7895f711e98ce154297131ce8b703c13736f7b26a8a810a3be9ac6e1ed6e0058a36b04efa3b2a3e36896b270834d7c4ddfffd9eb2604f0feeb96cbc7fa286504a57a42112e461d6ca3e9d68b5152be99c29e875952d86dd84127cecefbec5ea5102b65e528eeaef466268a60bb575f7e310478f04cc9f85883e524bcc1ceb53789d6e791f5a4aa07c2bed9a2d8b5c6740b285945fcceb837ca225b08d48d822973a6779efd10ff484495a4edbf5bf8d053ea5d9b01dad089b3d3a26e04b04c1e38d21d1eec7fd61c618c9a96dac9a4452e8f0fc4629b5e7d933b97645cb95575b13241da3de6516d0961318870b953f6e4abd0da808da9a0c532f7a87c9e6405712ffda2be471a68ae6ebd711a8ed3e81f87f03ca69d6bad0c6b6b22cfff1848bf413899bc4f691c1c33c923bded8039a9e356c3cbb220398c828192b665a2051d621e34437ada1941de054ec88a8177f9e6efa3c4d0f8157615a4d2cbd64558fc02980038d2fab05666d5ad502301890bd6d7a892a1b6db4c50105e153aa1c3ff7464d929d9b7f83483b06ca4c1085cf80881b5aa0d3e25f4a089558ac23ba2e1e8e2c923e2750aae9f1f9c8cf2eae48f275ba7ccc63ce4a6e3f1956a53c869a70c8656a66e7047cd3f013630a9ae28c963cfa8f486b17b5e6476774ba4dfd5bc5eee59e5b981162f6a8e627cf282c5cde5ba3aa7c8cafefb3408e01f2368230b847073efc05b5522f21df477500a0d00dfb9f0d4bec0fb9873f50a6e470fd5d28b84cfb2368debb4ebdf342edf4e9784256f5f813d31c8f479eac30f675af3dc57bfc42c2e9d548ff04b98b8c1d63acbefcd2c90678470d38e3f75a48656f90df1f8d82fa6252287a8e3304308eab9c8772841a84976b84a1c48c31c507ba4f50fc67a5a36851e71fec193ab918880c2d85f8bdd1ad7a28eff4aab9409c6add73a1aaffbc77ae20ecb2cdaa7485cfe41694134a291bbb6317d6d1b88ea98fb0ff50c83967bbaa20b3144acedc9d1f96d1ffdd2209fc7f32df2fcc204e5e037ffb1f5c44d9e8d733a37074f2d1219eafd15a4eb279ef14c388b7363f0ff1cf56c4583b84ba7100e93a021c73c17f4bc0d6920724ec04a0e29c46121a4c36e42e01efea66fabdb22883209cfd3128c3d64e250e76b11b421264c503ced8455ffc9c6ffac45d2ab3b2926025a7c625e3f9fac323f51d6cf63868699c7361cc6486ac8918b74aacf33de90ff5904786e7680fd2e9e769b53328ef2cbb3305c50aafa0111e490126592eb144006b09c8a24874bd3912c7b7011a1f39177f84e96a5e2e10da305b8341981934e13351581c093c6ddde80f4ddf0f7b39df7b1eda15800d96979079c41111d072abe3e8a73a4d1e69e9f244c5606f31b8f59e78f8cd06ed2f826abd798fb77de5ea1830d42d84080669fd28bc48213c38d911168b5fbd2e0dfc8ce9ca99feb5827ff56dae3ac1dc7ec507e878bb7f285368c1a04809bc893c0c7e0be08174e2afb91ca53ec38a6b0c7f22d20273987feaa5474b3e8489c533b36a1ed28e48bb5aecd2f6f4923e48300a77510d1a76f3107217ee58569c310202200ad2bf256a37b1018412ac72723b9664a34a668a6d39b6ea1144d410105cde1d40487071e6d26fa937ef3d5cf6a609222c2da590cd6d74f6d0b90667c471000c0cacfff02ec8b4938cf896294b00d9d0b8a2807a8c109f2998c0f8eb18c9f0d84a6166499dbe3e0009ca769d0291b12c37e558b2d66ca470eb92e68b49760f8d6aa6bc705b4ae3bea6f0f4fa9ce5dd640837a27fbc289f3ab49ba1a135a2f62674c6ed34d3f9e34da6d67f664141581598953da1d5873afe9efd5f3a2294b83cb382a97e936312455ecfeedbac565e066a8b235094aec0077ab8aebe99b751491ba9461718e4dd7668e9ee55e413e63d59339616fff199ecc4b65b668683c4c4e851f654791f9433872a192d3e4826fe34abb54b6b7c520d486840be626ca281126572e9aafa36e812d51b22352ec39f38925ae536eaa147ee87dbc9bcf16a565cefd04800e3054b1cb4a2f13af8661d6902d55869bb4c266ff17f32b263b8247dabd0798a71b0e6a08028f8ce02a15a9d7d8a456648e133d5146a26ae10dac252811419f6e6c7be499ddb6b487298d7346bb0cba962ca78a8115f231b672638e749dfcba49d6bf082d094ee0f138af56443c6686eb374f227cc567d0ce8e1d1e9b9a71e24817b1395d93a7d940c970d0213f1db2788f18b3e2bd6dc0b3ec10b8ffa42a1368ec6f0dba83cb6b503b47a0563da725fe205e401b8971c63e0a0dff7e3324b996fe6f79b0f7827e55b9bad3da3d11ea7d1d1347b80e6a2693ab622deb610a7eb2499074c0bf2abbad18f7493860df2c450417226976ee055f898e271b6db164023cda84c80b62409b768bb536756d35872faf3937350e3f33d1860e018283f902accc0390c73f17e48c86b7ee4264da3315bc22b74904955ac1ff1a30dff6127d5e21913026160cca73306eff821d1777bdda8674ff5afdc487ea584246bef946e0647613e3a9a23f537deeb67c45bdc43c6f4b18bbbbda80ffbd556ca9d5416acb37ebc9e59690ebe1519b7326c8d7ac8f256a68c5473f3a38a01a3be944d261b47a88c232673c1d892c9333269fec9c5b97b9c7d497259bb2a2930e298ae7c333fbcba712ee85dbbf63965359507d2c46e85f4ea399acc9d884f3fe7126481ca1730046a6c9308b74120be0206b546bb2c03bfeaca9c630c1aab2dd9ad16d7a1c6ba6c04fd53044c25e21607cdcb07da00925e97e74ca7ce8c411d59bbdff2eca6821dbca09f2c1a2b5d1ca56393bbf238053889bad65e10c9eac0e1cdd137da296ea746a6d578294b5883fdf3365bc92dd0a0fedc1e52270d9ff6c04022c48cb6fa6d1a4120984255e7a8698cd59ad0946648e060ed0dec19b58acbd14ecd9d3a6774da7489b0496a9952e10003ad07d0989326b50779e970679acb4c636442873bf481f7acf68c8ace6d547a4dbfe093efb9db4631dae8117a1312fe1e9c25b64c5c216b5895e4b08e7d075b0751e125677910ee2bd14f9ddff31c43b9894dd8045f2f67dd97539a8a6331c239fd7355556bdb3667c1c9c2c12af0a33d341dac07abfc918f901776200ef85bfcf8dd85d86303215133a52c2dd55853573afed19b91d6bfcc98437bb9f4fe6853b1d4212202f45f09c9e24d0a032d4d4eb844f974113b2575b7ed856d70ded49221895c4ff606370cde010bbd0f6f04335a19616a516712d5d5cae260f74da39895bf704a6dcdfd62bcd1df35c64788a9b1098470295f55ec1523da25d04b0da7424237e99f20f39af49781aebcf0606fbcacc3df41eaee8bfa21c3e565221ef2c9441ebbb637f51de4756a3712c6fce1d76eda52532a67c807df035891ba07591a6b71a4156fe1f5c289fce9e65945126fa9ce727ba47e90b3a35b8121653e39078ee855351bd178824f0840649305f384ff7d02ed994884e57efb3aba40b7129796c830389a404991eb7f1d39ee81536a50261b9974c685db617c5a1092bba10752ea2dd904359c7f9757c11b130b0c19e29409e448b96eebc79881d288a3471de5bc33f833c854e3593b58f3f321b4dd2a1c0d6aabc00248a3caa4621bffbaa32d96854c419df71e5d1a6e890dcffb6364550f386cd9572d933ff00fa1187a6792416ea987f69c82fa9bf36128df0b9a88adf1076fc1e26712e9a8bc4ce720afef6140963c57f8dd2aba164b5cda787faeeeff401c70e58ed1734640d841b8c3262c678cbaaf424c919f5cc32b0cf8591e087974adf318bac9f3e66a5df4105ed30e0109b79900885099e80bffc292b3553ed8e924c5accec429e061eea618f1938ba2b929e579e03e04dfeb48cdbe6d9ef8b965900d5137bdccceab19d1ad9713d963f3adc3f5edb908dff49af5ed7341506d732e6000d2e7591183dc3dfbbf5716a1b5ebf4b6006b57a007f2979b931aee99c9d0a6cb76449ce07511c87a0834650adef64d96b2053c0e102c00ee2306ef6ab67e44925618270cab9300fd38b21c9a08bc7e047ca34b1d756d11e74f09c3cacaf98e0cd39fc89d0f1e283e1fcde2b76271b128f54cf8b48b1d4434d4488520c0d0aa15f711886ac9815cab118caf46901d8f3dc75e07399dd97202c2579655c6e2a6c46616b76fa7d0d25f4a80f797aa7848f7a04c78b0d6cacdb0cd12a25ffbe84beb10a6ac53b1ed729bd6d200f500ee42ba2228fb4cb75ec08d77cbf5decd20f1fd58f3969699f291d829ef430e195795d5eb34a7b317f02c414765965518723e7799493a3a3522d40d6c5b96858944a6f25fdb27bda489dfb2fb2c5a044afe60da24fba611f0bf052f325b4b17241a1a38b6f551c6cf067532da3e400e7fa57c29083e6f5c90dbcd18411d24b87eec1ac429add9321fb69f1adfdcbc00e2c21b59dc05252da618a43fdd0b4dbbfe834e71660ee8cc9030d305682bdb4d633273f9dcbfe15ac08ad7e7526addd1625ed7c87301701168898cb00f769bd7a37964acd0f74e06eab643e99513c64fddcd8f39bef21a288876dc6cd7e8820ef76c5aa01a99e5250dbdfb7d903e63388c43e110adec52715be493523ab5c1410181c3c18b957f4c15091793a3a43382997c733e8ee84069c196fafae63268c7bc0c60509fef1b02111c107b144566901ca172b6c823214629f7b597529b348fba5ef165c679cb899c5a92d15676df133e2068511829db915abe7d72ce2b04b0b7278b51f673b3fcd0a0a40c56b3a243ac339b69d2110e53f796b93059917a97e6eefcedab82cf6d1e4db25e71f68e61ecd7782bc533b52d103db4374abb95178ca55eb4b5f2ef5dee68badb39cd26ba33a0c9260f08ce0176c178fafe31d5844fb6f13dd09a0e2ba47986b5622c00a484217de1402c04c363fc9d92f358de81396bca52c9879f1946b0a4ec3abaaff470b8955ffd034e704241e2cfc6156f34193669d82226572c02a89fb4eed9fc615e80cf8b2f92df1d15970be9fb49f9fa654030e9554647e83a93f6358bedca033ff504109d18afe1dcdeccdd9dc6a562885034a5030e224b610c939c695380356dfd09138ec1c672e86cd81aad4c55ac44202db144bec06593fc96975201392e084cfd76869e26dbfcfce1eb61fd08bab5eabb34a31c5b4386cb94159bf02703ec8de14cb8d33073e6fe00ad7acbfac9605db19d276b45b5ec255cf69295d2b921a6de05ba07c9be54539b850989dba65fbfc9d1547e555edd43d9ba0812fa54605a7b1adbb9dc2dd2339456822e3ce", 0xff3, 0x62e) dup2(r4, r5) (async) dup2(r4, r5) 02:52:38 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1a00}) 02:52:38 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x205c}) 02:52:38 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:38 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x200b}) 02:52:38 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1b00}) 02:52:38 executing program 1: openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1}) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) r4 = dup2(r2, r3) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f00000000c0)={0x38, 0x7, r3, 0x0, 0x8000, 0x0, 0x0, 0x2c36cf, 0x2670e3}) ioctl$BTRFS_IOC_QGROUP_CREATE(r4, 0x4010942a, &(0x7f0000000080)={0x0, 0x5}) 02:52:38 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x207b}) 02:52:38 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x200c}) 02:52:39 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2002}) 02:52:39 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:39 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) r4 = dup2(r2, r3) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f00000000c0)={0x38, 0x7, r3, 0x0, 0x8000, 0x0, 0x0, 0x2c36cf, 0x2670e3}) (async) ioctl$BTRFS_IOC_QGROUP_CREATE(r4, 0x4010942a, &(0x7f0000000080)={0x0, 0x5}) 02:52:39 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x200d}) 02:52:39 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x20f0}) 02:52:39 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_IOVA_RANGES(r4, 0x3b84, &(0x7f0000000100)={0x20, r5, 0x9, 0x0, &(0x7f00000002c0)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r6, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) r7 = dup2(r4, r6) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r8, 0x0) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r10, r9, 0x0, 0x100000002) ioctl$IOMMU_IOAS_UNMAP$ALL(r9, 0x3b86, &(0x7f0000000440)={0x18, r3}) fsetxattr$security_capability(r4, &(0x7f0000000380), &(0x7f00000003c0)=@v2={0x2000000, [{0x1, 0x6}, {0x10000, 0x495d}]}, 0x14, 0x0) syz_io_uring_setup(0x56c, &(0x7f00000001c0), &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000040)=0x0, &(0x7f00000000c0)=0x0) r13 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_io_uring_submit(r11, r12, &(0x7f0000000080)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, r13, 0x0, 0x0, 0x0, 0x12020}, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r11, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r14 = mmap$IORING_OFF_SQES(&(0x7f000012b000/0x3000)=nil, 0x3000, 0x5, 0x10, r7, 0x10000000) syz_io_uring_submit(r11, r14, &(0x7f0000000400)=@IORING_OP_REMOVE_BUFFERS={0x1f, 0x60, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, {0x1}}, 0x8000000) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000180)={0x38, 0x7, r8, 0x0, 0x0, 0x0, 0x3, 0x255de4, 0x308806}) 02:52:39 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:39 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2003}) 02:52:39 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x200e}) 02:52:39 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1}) ioctl$SNDCTL_DSP_SETFMT(0xffffffffffffffff, 0xc0045005, &(0x7f0000000080)=0xfffffffa) socket$pppl2tp(0x18, 0x1, 0x1) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) dup2(r0, r2) 02:52:39 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x20f2}) [ 616.490450][ T27] audit: type=1804 audit(1683773559.155:136): pid=16746 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir2584099632/syzkaller.rk9O0G/745/cgroup.controllers" dev="sda1" ino=1951 res=1 errno=0 02:52:39 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, 0x0) 02:52:39 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2004}) 02:52:39 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_IOVA_RANGES(r4, 0x3b84, &(0x7f0000000100)={0x20, r5, 0x9, 0x0, &(0x7f00000002c0)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r6, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) r7 = dup2(r4, r6) (async) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r8, 0x0) (async) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r10, r9, 0x0, 0x100000002) (async) ioctl$IOMMU_IOAS_UNMAP$ALL(r9, 0x3b86, &(0x7f0000000440)={0x18, r3}) (async) fsetxattr$security_capability(r4, &(0x7f0000000380), &(0x7f00000003c0)=@v2={0x2000000, [{0x1, 0x6}, {0x10000, 0x495d}]}, 0x14, 0x0) syz_io_uring_setup(0x56c, &(0x7f00000001c0), &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000040)=0x0, &(0x7f00000000c0)=0x0) (async) r13 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_io_uring_submit(r11, r12, &(0x7f0000000080)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, r13, 0x0, 0x0, 0x0, 0x12020}, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_GENERIC(r11, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r14 = mmap$IORING_OFF_SQES(&(0x7f000012b000/0x3000)=nil, 0x3000, 0x5, 0x10, r7, 0x10000000) syz_io_uring_submit(r11, r14, &(0x7f0000000400)=@IORING_OP_REMOVE_BUFFERS={0x1f, 0x60, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, {0x1}}, 0x8000000) (async) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000180)={0x38, 0x7, r8, 0x0, 0x0, 0x0, 0x3, 0x255de4, 0x308806}) 02:52:39 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2500}) 02:52:39 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2010}) 02:52:39 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1}) (async) ioctl$SNDCTL_DSP_SETFMT(0xffffffffffffffff, 0xc0045005, &(0x7f0000000080)=0xfffffffa) (async) socket$pppl2tp(0x18, 0x1, 0x1) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) (async) dup2(r0, r2) 02:52:39 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, 0x0) 02:52:39 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2005}) 02:52:39 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2900}) 02:52:39 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2011}) 02:52:39 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, 0x0) [ 616.852634][ T27] audit: type=1804 audit(1683773559.515:137): pid=16772 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir2584099632/syzkaller.rk9O0G/746/cgroup.controllers" dev="sda1" ino=1945 res=1 errno=0 02:52:39 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2006}) 02:52:39 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2012}) 02:52:39 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:39 executing program 2: openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_IOVA_RANGES(r4, 0x3b84, &(0x7f0000000100)={0x20, r5, 0x9, 0x0, &(0x7f00000002c0)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r6, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r4, r6) (async) r7 = dup2(r4, r6) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r8, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r8, 0x0) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r10, r9, 0x0, 0x100000002) (async) sendfile(r10, r9, 0x0, 0x100000002) ioctl$IOMMU_IOAS_UNMAP$ALL(r9, 0x3b86, &(0x7f0000000440)={0x18, r3}) fsetxattr$security_capability(r4, &(0x7f0000000380), &(0x7f00000003c0)=@v2={0x2000000, [{0x1, 0x6}, {0x10000, 0x495d}]}, 0x14, 0x0) syz_io_uring_setup(0x56c, &(0x7f00000001c0), &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000040)=0x0, &(0x7f00000000c0)=0x0) r13 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_io_uring_submit(r11, r12, &(0x7f0000000080)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, r13, 0x0, 0x0, 0x0, 0x12020}, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r11, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_GENERIC(r11, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r14 = mmap$IORING_OFF_SQES(&(0x7f000012b000/0x3000)=nil, 0x3000, 0x5, 0x10, r7, 0x10000000) syz_io_uring_submit(r11, r14, &(0x7f0000000400)=@IORING_OP_REMOVE_BUFFERS={0x1f, 0x60, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, {0x1}}, 0x8000000) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000180)={0x38, 0x7, r8, 0x0, 0x0, 0x0, 0x3, 0x255de4, 0x308806}) 02:52:39 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x3fff}) 02:52:39 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1}) ioctl$SNDCTL_DSP_SETFMT(0xffffffffffffffff, 0xc0045005, &(0x7f0000000080)=0xfffffffa) socket$pppl2tp(0x18, 0x1, 0x1) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) dup2(r0, r2) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1}) (async) ioctl$SNDCTL_DSP_SETFMT(0xffffffffffffffff, 0xc0045005, &(0x7f0000000080)=0xfffffffa) (async) socket$pppl2tp(0x18, 0x1, 0x1) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) write$binfmt_script(r2, &(0x7f0000000140)=ANY=[], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) (async) dup2(r0, r2) (async) 02:52:39 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2007}) 02:52:39 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2018}) 02:52:39 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) 02:52:39 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x4000}) 02:52:39 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2025}) 02:52:39 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2008}) 02:52:39 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x10001, 0x0, 0x0, 0x2000, 0x2000}) [ 617.132703][ T27] audit: type=1804 audit(1683773559.795:138): pid=16796 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir2584099632/syzkaller.rk9O0G/747/cgroup.controllers" dev="sda1" ino=1945 res=1 errno=0 02:52:39 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:39 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r7, r6, 0x0, 0x100000002) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r4, r5) 02:52:39 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2009}) 02:52:40 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2041}) 02:52:40 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) ioctl$IOMMU_VFIO_IOAS$GET(r2, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) r5 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r6) r7 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r8) r9 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) getsockopt$inet_mreq(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000004580)={@broadcast, @local}, &(0x7f00000045c0)=0x8) setuid(r10) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r2, {0xee00}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r11, 0xc018937a, &(0x7f0000004540)={{0x1, 0x1, 0x18, r5, {0x4}}, './file0\x00'}) read$FUSE(r13, &(0x7f0000000280)={0x2020, 0x0, 0x0, 0x0}, 0x19c5) read$FUSE(0xffffffffffffffff, &(0x7f00000022c0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) r16 = getpid() sched_setscheduler(r16, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r17, &(0x7f00000bd000), 0x318, 0x0) fstat(0xffffffffffffffff, &(0x7f0000000900)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmmsg$unix(r17, &(0x7f00000009c0)=[{{&(0x7f00000006c0)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f00000007c0)=[{&(0x7f0000000740)="19e5d3cf0071d0e93da3eee7e28585c5c816550cb2d77c111646e2756b1c9215e2f89f89d8b5b86d34842cd196ba3df484c0d11e4e0b919d46d5fafd2817355c3eaa04cd5a4921aa98", 0x49}], 0x1, &(0x7f0000004380)=ANY=[@ANYBLOB="14000000000000000100000001000000", @ANYRES32, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r18, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=r19, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c00000000000000ff0300000200faff", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="006d00001c0000000000000001000000023e69cd65eb09f444a7d3f10c079ef6ff78604ecc53b0d22e9c06e8c38815cdec15cba991704d7f76edb3bf66b9a36672bf420250d7a4e6ed524555f54c81ac20f6f9a7cfe5a961300599662a5de5ae0912f0150600000010c328529cec0a6295aeb7e1d64efe88927c0fbce28ad1eb", @ANYRES32=r16, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00'], 0x118, 0x80}}], 0x1, 0x4000801) fsetxattr$system_posix_acl(r0, &(0x7f0000000180)='system.posix_acl_access\x00', &(0x7f0000004300)={{}, {0x1, 0x5}, [{0x2, 0x5, r6}, {0x2, 0x1, r8}, {}, {0x2, 0x0, r10}, {0x2, 0x4, r12}, {0x2, 0x2, r14}, {0x2, 0x2, 0xee01}], {0x4, 0x1}, [{0x8, 0x4, r15}, {0x8, 0x4, r19}], {0x10, 0x2}}, 0x6c, 0x2) ioctl$IOMMU_IOAS_COPY(r0, 0x3b83, &(0x7f0000000100)={0x28, 0x2, r3, r4, 0x8000, 0xffffffff, 0xe513}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r20) 02:52:40 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x0, 0x0, 0x0, 0x2000, 0x2000}) 02:52:40 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0xffff8000}) 02:52:40 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r7, r6, 0x0, 0x100000002) (async) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) dup2(r4, r5) 02:52:40 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x200a}) 02:52:40 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x205c}) 02:52:40 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000}) 02:52:40 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x2}) 02:52:40 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x200b}) 02:52:40 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x207b}) 02:52:40 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r7, r6, 0x0, 0x100000002) (async) sendfile(r7, r6, 0x0, 0x100000002) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r4, r5) (async) dup2(r4, r5) 02:52:40 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000}) 02:52:40 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) (async) ioctl$IOMMU_VFIO_IOAS$GET(r2, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) r5 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r6) (async, rerun: 32) r7 = socket$inet_udplite(0x2, 0x2, 0x88) (rerun: 32) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r8) (async, rerun: 64) r9 = socket$inet_udplite(0x2, 0x2, 0x88) (rerun: 64) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) getsockopt$inet_mreq(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000004580)={@broadcast, @local}, &(0x7f00000045c0)=0x8) (async) setuid(r10) (async, rerun: 64) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r2, {0xee00}}, './file0\x00'}) (rerun: 64) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r11, 0xc018937a, &(0x7f0000004540)={{0x1, 0x1, 0x18, r5, {0x4}}, './file0\x00'}) read$FUSE(r13, &(0x7f0000000280)={0x2020, 0x0, 0x0, 0x0}, 0x19c5) (async) read$FUSE(0xffffffffffffffff, &(0x7f00000022c0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) r16 = getpid() sched_setscheduler(r16, 0x2, &(0x7f0000000200)=0x4) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r17, &(0x7f00000bd000), 0x318, 0x0) (async) fstat(0xffffffffffffffff, &(0x7f0000000900)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmmsg$unix(r17, &(0x7f00000009c0)=[{{&(0x7f00000006c0)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f00000007c0)=[{&(0x7f0000000740)="19e5d3cf0071d0e93da3eee7e28585c5c816550cb2d77c111646e2756b1c9215e2f89f89d8b5b86d34842cd196ba3df484c0d11e4e0b919d46d5fafd2817355c3eaa04cd5a4921aa98", 0x49}], 0x1, &(0x7f0000004380)=ANY=[@ANYBLOB="14000000000000000100000001000000", @ANYRES32, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r18, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=r19, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c00000000000000ff0300000200faff", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="006d00001c0000000000000001000000023e69cd65eb09f444a7d3f10c079ef6ff78604ecc53b0d22e9c06e8c38815cdec15cba991704d7f76edb3bf66b9a36672bf420250d7a4e6ed524555f54c81ac20f6f9a7cfe5a961300599662a5de5ae0912f0150600000010c328529cec0a6295aeb7e1d64efe88927c0fbce28ad1eb", @ANYRES32=r16, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00'], 0x118, 0x80}}], 0x1, 0x4000801) (async) fsetxattr$system_posix_acl(r0, &(0x7f0000000180)='system.posix_acl_access\x00', &(0x7f0000004300)={{}, {0x1, 0x5}, [{0x2, 0x5, r6}, {0x2, 0x1, r8}, {}, {0x2, 0x0, r10}, {0x2, 0x4, r12}, {0x2, 0x2, r14}, {0x2, 0x2, 0xee01}], {0x4, 0x1}, [{0x8, 0x4, r15}, {0x8, 0x4, r19}], {0x10, 0x2}}, 0x6c, 0x2) ioctl$IOMMU_IOAS_COPY(r0, 0x3b83, &(0x7f0000000100)={0x28, 0x2, r3, r4, 0x8000, 0xffffffff, 0xe513}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r20) 02:52:40 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x3}) 02:52:40 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x200c}) 02:52:40 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x20f0}) 02:52:40 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_VFIO_IOMMU_GET_INFO(r0, 0x3b70, &(0x7f00000002c0)=ANY=[@ANYBLOB="800200000000000000000000000000000000000000000040606a2c4274b6612dac00000000000000000000000000000000000000000000080000001c0000000000000000000000000000000000000000000000000000000000000000000200"/138]) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r4, r5) 02:52:40 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000}) 02:52:40 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x200d}) 02:52:40 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x0, 0x0, 0x0, 0x2000}) 02:52:40 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x20f2}) 02:52:40 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x4}) 02:52:41 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_VFIO_IOMMU_GET_INFO(r0, 0x3b70, &(0x7f00000002c0)=ANY=[@ANYBLOB="800200000000000000000000000000000000000000000040606a2c4274b6612dac00000000000000000000000000000000000000000000080000001c0000000000000000000000000000000000000000000000000000000000000000000200"/138]) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) dup2(r4, r5) 02:52:41 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x0, 0x0, 0x0, 0x2000}) 02:52:41 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) (async) ioctl$IOMMU_VFIO_IOAS$GET(r2, 0x3b88, &(0x7f00000000c0)={0xc, 0x0}) (async) r5 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r6) (async) r7 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r8) r9 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) getsockopt$inet_mreq(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000004580)={@broadcast, @local}, &(0x7f00000045c0)=0x8) (async) setuid(r10) (async) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r2, {0xee00}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r11, 0xc018937a, &(0x7f0000004540)={{0x1, 0x1, 0x18, r5, {0x4}}, './file0\x00'}) read$FUSE(r13, &(0x7f0000000280)={0x2020, 0x0, 0x0, 0x0}, 0x19c5) read$FUSE(0xffffffffffffffff, &(0x7f00000022c0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) (async) r16 = getpid() sched_setscheduler(r16, 0x2, &(0x7f0000000200)=0x4) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r17, &(0x7f00000bd000), 0x318, 0x0) fstat(0xffffffffffffffff, &(0x7f0000000900)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmmsg$unix(r17, &(0x7f00000009c0)=[{{&(0x7f00000006c0)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f00000007c0)=[{&(0x7f0000000740)="19e5d3cf0071d0e93da3eee7e28585c5c816550cb2d77c111646e2756b1c9215e2f89f89d8b5b86d34842cd196ba3df484c0d11e4e0b919d46d5fafd2817355c3eaa04cd5a4921aa98", 0x49}], 0x1, &(0x7f0000004380)=ANY=[@ANYBLOB="14000000000000000100000001000000", @ANYRES32, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r16, @ANYRES32=r18, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=r19, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c00000000000000ff0300000200faff", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="006d00001c0000000000000001000000023e69cd65eb09f444a7d3f10c079ef6ff78604ecc53b0d22e9c06e8c38815cdec15cba991704d7f76edb3bf66b9a36672bf420250d7a4e6ed524555f54c81ac20f6f9a7cfe5a961300599662a5de5ae0912f0150600000010c328529cec0a6295aeb7e1d64efe88927c0fbce28ad1eb", @ANYRES32=r16, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00'], 0x118, 0x80}}], 0x1, 0x4000801) fsetxattr$system_posix_acl(r0, &(0x7f0000000180)='system.posix_acl_access\x00', &(0x7f0000004300)={{}, {0x1, 0x5}, [{0x2, 0x5, r6}, {0x2, 0x1, r8}, {}, {0x2, 0x0, r10}, {0x2, 0x4, r12}, {0x2, 0x2, r14}, {0x2, 0x2, 0xee01}], {0x4, 0x1}, [{0x8, 0x4, r15}, {0x8, 0x4, r19}], {0x10, 0x2}}, 0x6c, 0x2) ioctl$IOMMU_IOAS_COPY(r0, 0x3b83, &(0x7f0000000100)={0x28, 0x2, r3, r4, 0x8000, 0xffffffff, 0xe513}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r20) 02:52:41 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x5}) 02:52:41 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x200e}) 02:52:41 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2500}) 02:52:41 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_VFIO_IOMMU_GET_INFO(r0, 0x3b70, &(0x7f00000002c0)=ANY=[@ANYBLOB="800200000000000000000000000000000000000000000040606a2c4274b6612dac00000000000000000000000000000000000000000000080000001c0000000000000000000000000000000000000000000000000000000000000000000200"/138]) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r4, r5) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) (async) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_VFIO_IOMMU_GET_INFO(r0, 0x3b70, &(0x7f00000002c0)=ANY=[@ANYBLOB="800200000000000000000000000000000000000000000040606a2c4274b6612dac00000000000000000000000000000000000000000000080000001c0000000000000000000000000000000000000000000000000000000000000000000200"/138]) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) (async) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) dup2(r4, r5) (async) 02:52:41 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x0, 0x0, 0x0, 0x2000}) 02:52:41 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x6}) 02:52:41 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2900}) 02:52:41 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2010}) 02:52:41 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x205c}) 02:52:41 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000080)={0xc}) dup2(r4, r5) 02:52:41 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x7}) 02:52:41 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2011}) 02:52:41 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x3fff}) 02:52:41 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x205c}) 02:52:41 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000080)={0xc}) (async) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000080)={0xc}) dup2(r4, r5) 02:52:41 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x8}) 02:52:41 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2012}) 02:52:41 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:41 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000080)={0xc}) dup2(r4, r5) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) (async) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) (async) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000080)={0xc}) (async) dup2(r4, r5) (async) 02:52:41 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x541400, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r1, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r2}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000400)={0x28, 0x6, r2, 0x0, &(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x8000}) r3 = syz_clone(0x1000000, &(0x7f0000000280)="836d3cbfcbc2f49afa9c310774389f47f3a5abe5f5a40edb7187ad209f068c6a1021cf8ddb5c45e60e1f9334f34798966622a2f28d1196c5d97025fac9b107c45711b8ddadf0adf83608a78b656356bd513163a65d83f983ff730308fe10dd4c4b5ab8f0fe0224a99c9e0dd2357a6cc1aa8f69a395e8d6a7724fbc0c5a97c37b1e6b3fa5b5105c220c72332399dfd1ba4814a1e165eb124824a4772536272502d641ba38a0ce68aa40295f0b134f2d6ac70bfaac207c8fa4d913c148163904008f6cef97e854ba817865821a419c518f07", 0xd1, &(0x7f0000000100), &(0x7f0000000180), &(0x7f00000001c0)="87e1584a2530660ea1b76bc7d916a8eff856a37b8872bd96446f9ea2b60f09e46d9869a50738156350b9f98d0c2363a37d284b4a84fdd32d36a78299ad7f8c7f2cd587e16d140b5f5a5a1140a9aa895463") sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000500)={&(0x7f00000008c0)={0x200, 0x34, 0x800, 0x70bd25, 0x25dfdbfd, {0x16}, [@typed={0x8, 0x4d, 0x0, 0x0, @pid=r3}, @nested={0x144, 0x7a, 0x0, 0x1, [@generic="88df90eab9c9a8a554527fb6e2e761c6102a63ce4cca952960d4c807d081acf6f11550670d7e849487dc8cdd0fd303b3f96950f3294a0af49b7211ec756eaefb3a388b2cdf39f1e81768de55b8371517c069c2be65dafef4fbc65dbd751c42bf88db39b23cc4833eb454d53bc9e5e4b089393723b79cd426a8c3f1935931b46df904b73b02a65b012004d65a026ad105af977ede00a9b4bfef440edc7b9b7aa64979a6876cc0bb5b136e6628263aa1e8874a6f78d7297e3d0d9d416fff6d84278cf8660344ed967a69b92791340febbed3751f8e82797c16abb77f460696924ca0ce6b5f4423be8098930b87a61e0b2449e518dfb0da079a1e5bfc", @typed={0x9, 0x1d, 0x0, 0x0, @str='-[^+\x00'}, @typed={0x8, 0x3f, 0x0, 0x0, @uid}, @generic="5735448f4d6feb8b10ec9915f3bd34cfcf3289f5c9a8c1d4dbd8a149e91081068233bc034a0a412147abc0132d3881aecf"]}, @typed={0x14, 0x37, 0x0, 0x0, @ipv6=@local}, @typed={0x8, 0x7f, 0x0, 0x0, @ipv4=@rand_addr=0x64010100}, @generic="a1e05df15444fed3e9d20c007468b8818a0164b2e95970d551115490fe79890484c3c8eef02349bc48bde91ebfde5cb2c32250b5daa2233bd1fb0062f530b4365816e184bafa466aef1dcf808f39bdf33e4c37679dd8bdbf239f156fa89a01ff11df29d8975fe0da653c1ec2", @typed={0x17, 0xb, 0x0, 0x0, @str='/dev/ocfs2_control\x00'}]}, 0x200}, 0x1, 0x0, 0x0, 0x20000084}, 0x8000) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r4, 0x0, 0xffffffffffffffff}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r5, 0x3ba0, &(0x7f0000000080)={0x38, 0x7, r6, 0x0, 0x10001, 0x0, 0x2, 0x29a9e9, 0x3023b4}) r7 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000380), 0x20000, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f00000003c0)={0x38, 0x7, r7, 0x0, 0x10000, 0x0, 0xa, 0x236990, 0x800}) dup2(r5, r6) r8 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000580), 0xa00, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_REFS(r8, 0x3ba0, &(0x7f0000000680)={0x38, 0x4, 0xffffffffffffffff, 0x0, &(0x7f00000005c0)="599b2dceb77bc9089f8cfbcf6e14f0fd5fa5620f748329370d538f37388f635000e5a8d381338ce12f674d784f3250cb8fb61aac47ec359d7ee6062246d1e25f645ad2289b7cd82eff636e6e167eed52917362f872a473d18d0aea8931f74d3925db47a6393268ee9ca3fa66131d0445d7c7773ceef8d1b68bae1126a9a2baa034a46b9fb1e3b57165d55058a01b4bf4", 0x90, 0x1}) 02:52:41 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x4000}) 02:52:41 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x9}) 02:52:41 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2018}) 02:52:41 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:41 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) r6 = socket$rxrpc(0x21, 0x2, 0xa) r7 = syz_genetlink_get_family_id$batadv(&(0x7f0000007580), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000007640)={&(0x7f0000000000)=ANY=[@ANYBLOB="46040000", @ANYRES16=r7, @ANYBLOB="ff830500000000000000", @ANYRES32=r6], 0x4}}, 0x0) ioctl$FS_IOC_GETFSLABEL(r6, 0x81009431, &(0x7f00000002c0)) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r4, r5) 02:52:41 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:41 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x541400, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r1, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r2}) (async) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000400)={0x28, 0x6, r2, 0x0, &(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x8000}) (async) r3 = syz_clone(0x1000000, &(0x7f0000000280)="836d3cbfcbc2f49afa9c310774389f47f3a5abe5f5a40edb7187ad209f068c6a1021cf8ddb5c45e60e1f9334f34798966622a2f28d1196c5d97025fac9b107c45711b8ddadf0adf83608a78b656356bd513163a65d83f983ff730308fe10dd4c4b5ab8f0fe0224a99c9e0dd2357a6cc1aa8f69a395e8d6a7724fbc0c5a97c37b1e6b3fa5b5105c220c72332399dfd1ba4814a1e165eb124824a4772536272502d641ba38a0ce68aa40295f0b134f2d6ac70bfaac207c8fa4d913c148163904008f6cef97e854ba817865821a419c518f07", 0xd1, &(0x7f0000000100), &(0x7f0000000180), &(0x7f00000001c0)="87e1584a2530660ea1b76bc7d916a8eff856a37b8872bd96446f9ea2b60f09e46d9869a50738156350b9f98d0c2363a37d284b4a84fdd32d36a78299ad7f8c7f2cd587e16d140b5f5a5a1140a9aa895463") sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000500)={&(0x7f00000008c0)={0x200, 0x34, 0x800, 0x70bd25, 0x25dfdbfd, {0x16}, [@typed={0x8, 0x4d, 0x0, 0x0, @pid=r3}, @nested={0x144, 0x7a, 0x0, 0x1, [@generic="88df90eab9c9a8a554527fb6e2e761c6102a63ce4cca952960d4c807d081acf6f11550670d7e849487dc8cdd0fd303b3f96950f3294a0af49b7211ec756eaefb3a388b2cdf39f1e81768de55b8371517c069c2be65dafef4fbc65dbd751c42bf88db39b23cc4833eb454d53bc9e5e4b089393723b79cd426a8c3f1935931b46df904b73b02a65b012004d65a026ad105af977ede00a9b4bfef440edc7b9b7aa64979a6876cc0bb5b136e6628263aa1e8874a6f78d7297e3d0d9d416fff6d84278cf8660344ed967a69b92791340febbed3751f8e82797c16abb77f460696924ca0ce6b5f4423be8098930b87a61e0b2449e518dfb0da079a1e5bfc", @typed={0x9, 0x1d, 0x0, 0x0, @str='-[^+\x00'}, @typed={0x8, 0x3f, 0x0, 0x0, @uid}, @generic="5735448f4d6feb8b10ec9915f3bd34cfcf3289f5c9a8c1d4dbd8a149e91081068233bc034a0a412147abc0132d3881aecf"]}, @typed={0x14, 0x37, 0x0, 0x0, @ipv6=@local}, @typed={0x8, 0x7f, 0x0, 0x0, @ipv4=@rand_addr=0x64010100}, @generic="a1e05df15444fed3e9d20c007468b8818a0164b2e95970d551115490fe79890484c3c8eef02349bc48bde91ebfde5cb2c32250b5daa2233bd1fb0062f530b4365816e184bafa466aef1dcf808f39bdf33e4c37679dd8bdbf239f156fa89a01ff11df29d8975fe0da653c1ec2", @typed={0x17, 0xb, 0x0, 0x0, @str='/dev/ocfs2_control\x00'}]}, 0x200}, 0x1, 0x0, 0x0, 0x20000084}, 0x8000) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r4, 0x0, 0xffffffffffffffff}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r5, 0x3ba0, &(0x7f0000000080)={0x38, 0x7, r6, 0x0, 0x10001, 0x0, 0x2, 0x29a9e9, 0x3023b4}) (async) r7 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000380), 0x20000, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f00000003c0)={0x38, 0x7, r7, 0x0, 0x10000, 0x0, 0xa, 0x236990, 0x800}) dup2(r5, r6) (async) r8 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000580), 0xa00, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_REFS(r8, 0x3ba0, &(0x7f0000000680)={0x38, 0x4, 0xffffffffffffffff, 0x0, &(0x7f00000005c0)="599b2dceb77bc9089f8cfbcf6e14f0fd5fa5620f748329370d538f37388f635000e5a8d381338ce12f674d784f3250cb8fb61aac47ec359d7ee6062246d1e25f645ad2289b7cd82eff636e6e167eed52917362f872a473d18d0aea8931f74d3925db47a6393268ee9ca3fa66131d0445d7c7773ceef8d1b68bae1126a9a2baa034a46b9fb1e3b57165d55058a01b4bf4", 0x90, 0x1}) 02:52:41 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xa}) 02:52:41 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2025}) 02:52:41 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:41 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xb}) 02:52:41 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0xffff8000}) 02:52:41 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2041}) 02:52:41 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) r6 = socket$rxrpc(0x21, 0x2, 0xa) r7 = syz_genetlink_get_family_id$batadv(&(0x7f0000007580), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000007640)={&(0x7f0000000000)=ANY=[@ANYBLOB="46040000", @ANYRES16=r7, @ANYBLOB="ff830500000000000000", @ANYRES32=r6], 0x4}}, 0x0) ioctl$FS_IOC_GETFSLABEL(r6, 0x81009431, &(0x7f00000002c0)) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r4, r5) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) (async) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) (async) socket$rxrpc(0x21, 0x2, 0xa) (async) syz_genetlink_get_family_id$batadv(&(0x7f0000007580), 0xffffffffffffffff) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000007640)={&(0x7f0000000000)=ANY=[@ANYBLOB="46040000", @ANYRES16=r7, @ANYBLOB="ff830500000000000000", @ANYRES32=r6], 0x4}}, 0x0) (async) ioctl$FS_IOC_GETFSLABEL(r6, 0x81009431, &(0x7f00000002c0)) (async) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) dup2(r4, r5) (async) 02:52:41 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:41 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x541400, 0x0) (async) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r1, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r2}) (async) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000400)={0x28, 0x6, r2, 0x0, &(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x8000}) r3 = syz_clone(0x1000000, &(0x7f0000000280)="836d3cbfcbc2f49afa9c310774389f47f3a5abe5f5a40edb7187ad209f068c6a1021cf8ddb5c45e60e1f9334f34798966622a2f28d1196c5d97025fac9b107c45711b8ddadf0adf83608a78b656356bd513163a65d83f983ff730308fe10dd4c4b5ab8f0fe0224a99c9e0dd2357a6cc1aa8f69a395e8d6a7724fbc0c5a97c37b1e6b3fa5b5105c220c72332399dfd1ba4814a1e165eb124824a4772536272502d641ba38a0ce68aa40295f0b134f2d6ac70bfaac207c8fa4d913c148163904008f6cef97e854ba817865821a419c518f07", 0xd1, &(0x7f0000000100), &(0x7f0000000180), &(0x7f00000001c0)="87e1584a2530660ea1b76bc7d916a8eff856a37b8872bd96446f9ea2b60f09e46d9869a50738156350b9f98d0c2363a37d284b4a84fdd32d36a78299ad7f8c7f2cd587e16d140b5f5a5a1140a9aa895463") sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000500)={&(0x7f00000008c0)={0x200, 0x34, 0x800, 0x70bd25, 0x25dfdbfd, {0x16}, [@typed={0x8, 0x4d, 0x0, 0x0, @pid=r3}, @nested={0x144, 0x7a, 0x0, 0x1, [@generic="88df90eab9c9a8a554527fb6e2e761c6102a63ce4cca952960d4c807d081acf6f11550670d7e849487dc8cdd0fd303b3f96950f3294a0af49b7211ec756eaefb3a388b2cdf39f1e81768de55b8371517c069c2be65dafef4fbc65dbd751c42bf88db39b23cc4833eb454d53bc9e5e4b089393723b79cd426a8c3f1935931b46df904b73b02a65b012004d65a026ad105af977ede00a9b4bfef440edc7b9b7aa64979a6876cc0bb5b136e6628263aa1e8874a6f78d7297e3d0d9d416fff6d84278cf8660344ed967a69b92791340febbed3751f8e82797c16abb77f460696924ca0ce6b5f4423be8098930b87a61e0b2449e518dfb0da079a1e5bfc", @typed={0x9, 0x1d, 0x0, 0x0, @str='-[^+\x00'}, @typed={0x8, 0x3f, 0x0, 0x0, @uid}, @generic="5735448f4d6feb8b10ec9915f3bd34cfcf3289f5c9a8c1d4dbd8a149e91081068233bc034a0a412147abc0132d3881aecf"]}, @typed={0x14, 0x37, 0x0, 0x0, @ipv6=@local}, @typed={0x8, 0x7f, 0x0, 0x0, @ipv4=@rand_addr=0x64010100}, @generic="a1e05df15444fed3e9d20c007468b8818a0164b2e95970d551115490fe79890484c3c8eef02349bc48bde91ebfde5cb2c32250b5daa2233bd1fb0062f530b4365816e184bafa466aef1dcf808f39bdf33e4c37679dd8bdbf239f156fa89a01ff11df29d8975fe0da653c1ec2", @typed={0x17, 0xb, 0x0, 0x0, @str='/dev/ocfs2_control\x00'}]}, 0x200}, 0x1, 0x0, 0x0, 0x20000084}, 0x8000) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r4, 0x0, 0xffffffffffffffff}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r5, 0x3ba0, &(0x7f0000000080)={0x38, 0x7, r6, 0x0, 0x10001, 0x0, 0x2, 0x29a9e9, 0x3023b4}) (async) r7 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000380), 0x20000, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f00000003c0)={0x38, 0x7, r7, 0x0, 0x10000, 0x0, 0xa, 0x236990, 0x800}) (async) dup2(r5, r6) (async) r8 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000580), 0xa00, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_REFS(r8, 0x3ba0, &(0x7f0000000680)={0x38, 0x4, 0xffffffffffffffff, 0x0, &(0x7f00000005c0)="599b2dceb77bc9089f8cfbcf6e14f0fd5fa5620f748329370d538f37388f635000e5a8d381338ce12f674d784f3250cb8fb61aac47ec359d7ee6062246d1e25f645ad2289b7cd82eff636e6e167eed52917362f872a473d18d0aea8931f74d3925db47a6393268ee9ca3fa66131d0445d7c7773ceef8d1b68bae1126a9a2baa034a46b9fb1e3b57165d55058a01b4bf4", 0x90, 0x1}) 02:52:41 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xc}) 02:52:41 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x2}) 02:52:41 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x205c}) 02:52:42 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:42 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x207b}) 02:52:42 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) (async) r6 = socket$rxrpc(0x21, 0x2, 0xa) (async) r7 = syz_genetlink_get_family_id$batadv(&(0x7f0000007580), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000007640)={&(0x7f0000000000)=ANY=[@ANYBLOB="46040000", @ANYRES16=r7, @ANYBLOB="ff830500000000000000", @ANYRES32=r6], 0x4}}, 0x0) (async) ioctl$FS_IOC_GETFSLABEL(r6, 0x81009431, &(0x7f00000002c0)) (async, rerun: 64) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async, rerun: 64) dup2(r4, r5) 02:52:42 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xd}) 02:52:42 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x3}) 02:52:42 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:42 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x4}) 02:52:42 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x20f0}) 02:52:42 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:42 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xe}) 02:52:42 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) r6 = syz_open_dev$vivid(&(0x7f0000000080), 0x2, 0x2) r7 = socket$rxrpc(0x21, 0x2, 0xa) r8 = syz_genetlink_get_family_id$batadv(&(0x7f0000007580), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000007640)={&(0x7f0000000000)=ANY=[@ANYBLOB="46040000", @ANYRES16=r8, @ANYBLOB="ff830500000000000000", @ANYRES32=r7], 0x4}}, 0x0) dup2(r6, r7) 02:52:42 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x5}) 02:52:42 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x20f2}) 02:52:42 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2500}) 02:52:42 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:42 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x6}) 02:52:42 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x10}) 02:52:42 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async, rerun: 32) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (rerun: 32) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) r6 = syz_open_dev$vivid(&(0x7f0000000080), 0x2, 0x2) (async) r7 = socket$rxrpc(0x21, 0x2, 0xa) r8 = syz_genetlink_get_family_id$batadv(&(0x7f0000007580), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000007640)={&(0x7f0000000000)=ANY=[@ANYBLOB="46040000", @ANYRES16=r8, @ANYBLOB="ff830500000000000000", @ANYRES32=r7], 0x4}}, 0x0) (async, rerun: 32) dup2(r6, r7) (rerun: 32) 02:52:42 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:42 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x440, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = pidfd_getfd(0xffffffffffffffff, r0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000080)={0xc}) r4 = dup3(r0, r2, 0x80000) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000240)={0xffffff42, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r6, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r7}) ioctl$IOMMU_IOAS_COPY$syz(r0, 0x3b83, &(0x7f00000000c0)={0x28, 0x4, r7, r1, 0x386327, 0x81, 0xa, 0x7c85c}) dup2(r2, r5) 02:52:42 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x11}) 02:52:42 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x7}) 02:52:42 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) r6 = syz_open_dev$vivid(&(0x7f0000000080), 0x2, 0x2) (async, rerun: 32) r7 = socket$rxrpc(0x21, 0x2, 0xa) (async, rerun: 32) r8 = syz_genetlink_get_family_id$batadv(&(0x7f0000007580), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000007640)={&(0x7f0000000000)=ANY=[@ANYBLOB="46040000", @ANYRES16=r8, @ANYBLOB="ff830500000000000000", @ANYRES32=r7], 0x4}}, 0x0) (async) dup2(r6, r7) 02:52:42 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2900}) 02:52:42 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:42 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x12}) 02:52:42 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x3fff}) 02:52:42 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x8}) 02:52:42 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r3, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:42 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) ioctl$F2FS_IOC_ABORT_ATOMIC_WRITE(r0, 0xf505, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r1, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r4, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x26280, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000080)={0x38, 0x5, r2, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r5, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r7, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r5, r7) 02:52:42 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x18}) 02:52:43 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x440, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r3 = pidfd_getfd(0xffffffffffffffff, r0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000080)={0xc}) (async) r4 = dup3(r0, r2, 0x80000) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000240)={0xffffff42, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) (async) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r6, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r7}) (async) ioctl$IOMMU_IOAS_COPY$syz(r0, 0x3b83, &(0x7f00000000c0)={0x28, 0x4, r7, r1, 0x386327, 0x81, 0xa, 0x7c85c}) (async) dup2(r2, r5) 02:52:43 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x4000}) 02:52:43 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r3, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:43 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x25}) 02:52:43 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x9}) 02:52:43 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) ioctl$F2FS_IOC_ABORT_ATOMIC_WRITE(r0, 0xf505, 0x0) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000000)={0xc}) (async) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r1, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r4, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x26280, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000080)={0x38, 0x5, r2, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r5, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r7, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r5, r7) 02:52:43 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xa}) 02:52:43 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:43 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x41}) 02:52:43 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r2, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:43 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xb}) 02:52:43 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0xffff8000}) 02:52:43 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x440, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = pidfd_getfd(0xffffffffffffffff, r0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000080)={0xc}) r4 = dup3(r0, r2, 0x80000) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000240)={0xffffff42, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r6, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r7}) ioctl$IOMMU_IOAS_COPY$syz(r0, 0x3b83, &(0x7f00000000c0)={0x28, 0x4, r7, r1, 0x386327, 0x81, 0xa, 0x7c85c}) dup2(r2, r5) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x440, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) pidfd_getfd(0xffffffffffffffff, r0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000080)={0xc}) (async) dup3(r0, r2, 0x80000) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000240)={0xffffff42, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000000)={0xc}) (async) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r6, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r7}) (async) ioctl$IOMMU_IOAS_COPY$syz(r0, 0x3b83, &(0x7f00000000c0)={0x28, 0x4, r7, r1, 0x386327, 0x81, 0xa, 0x7c85c}) (async) dup2(r2, r5) (async) 02:52:43 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000140)=ANY=[], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) (async) ioctl$F2FS_IOC_ABORT_ATOMIC_WRITE(r0, 0xf505, 0x0) (async) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r1, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r4, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async, rerun: 32) r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x26280, 0x0) (rerun: 32) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000080)={0x38, 0x5, r2, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r5, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r7, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r5, r7) 02:52:43 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r2, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:43 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x5c}) 02:52:43 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x2}) 02:52:43 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xc}) 02:52:43 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x3}) 02:52:43 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xd}) 02:52:43 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r2, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:43 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x7b}) 02:52:43 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xe}) 02:52:43 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x4}) 02:52:44 executing program 5: ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r2, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:44 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) 02:52:44 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xf0}) 02:52:44 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x10}) 02:52:44 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x5}) 02:52:44 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000140)=ANY=[], 0x208e24b) ioctl$IOMMU_IOAS_ALLOC(r5, 0x3b81, &(0x7f0000000100)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_UNMAP$ALL(r4, 0x3b86, &(0x7f0000000180)={0x18, r6}) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r7, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x1, 0x0, r8}) ioctl$IOMMU_IOAS_MAP$PAGES(0xffffffffffffffff, 0x3b85, &(0x7f00000003c0)={0x28, 0x5, r8, 0x0, &(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x783e}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r0, 0x3ba0, &(0x7f0000000300)={0x38, 0x1, r8, 0x0, 0x7, 0x8}) r9 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r10 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r10, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r10, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r11}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r7, 0x3ba0, &(0x7f00000001c0)={0x38, 0x2, r11}) ioctl$IOMMU_VFIO_IOAS$GET(r7, 0x3b88, &(0x7f0000000340)={0xc}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(0xffffffffffffffff, 0x3ba0, &(0x7f0000000380)={0x38, 0x2, r8, 0x0, 0x0}) ioctl$IOMMU_DESTROY$device(r2, 0x3b80, &(0x7f00000002c0)={0x8, r12}) ioctl$F2FS_IOC_MOVE_RANGE(r2, 0xc020f509, &(0x7f0000000400)={r0, 0x3, 0x4, 0x5}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) r14 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r15 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r15, r14, 0x0, 0x100000002) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r5, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r14, 0x0, 0x3, 0x0, 0x800000, 0x0, 0x137b0c}) dup2(r9, r13) 02:52:44 executing program 5: ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r2, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:44 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x11}) 02:52:44 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xf2}) 02:52:44 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x6}) 02:52:44 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x300}) [ 621.687362][T17139] iommufd_mock iommufd_mock0: Adding to iommu group 0 02:52:44 executing program 5: ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r2, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:44 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x12}) 02:52:44 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) 02:52:44 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x7}) 02:52:44 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x500}) 02:52:44 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r3, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) [ 622.402599][T17133] iommufd_mock iommufd_mock0: Removing from iommu group 0 02:52:45 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) r4 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000140)=ANY=[], 0x208e24b) ioctl$IOMMU_IOAS_ALLOC(r5, 0x3b81, &(0x7f0000000100)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_UNMAP$ALL(r4, 0x3b86, &(0x7f0000000180)={0x18, r6}) (async) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r7, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x1, 0x0, r8}) (async) ioctl$IOMMU_IOAS_MAP$PAGES(0xffffffffffffffff, 0x3b85, &(0x7f00000003c0)={0x28, 0x5, r8, 0x0, &(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x783e}) (async) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r0, 0x3ba0, &(0x7f0000000300)={0x38, 0x1, r8, 0x0, 0x7, 0x8}) (async) r9 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r10 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r10, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r10, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r11}) (async) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r7, 0x3ba0, &(0x7f00000001c0)={0x38, 0x2, r11}) (async) ioctl$IOMMU_VFIO_IOAS$GET(r7, 0x3b88, &(0x7f0000000340)={0xc}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(0xffffffffffffffff, 0x3ba0, &(0x7f0000000380)={0x38, 0x2, r8, 0x0, 0x0}) ioctl$IOMMU_DESTROY$device(r2, 0x3b80, &(0x7f00000002c0)={0x8, r12}) (async) ioctl$F2FS_IOC_MOVE_RANGE(r2, 0xc020f509, &(0x7f0000000400)={r0, 0x3, 0x4, 0x5}) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) r14 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r15 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r15, r14, 0x0, 0x100000002) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r5, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r14, 0x0, 0x3, 0x0, 0x800000, 0x0, 0x137b0c}) (async) dup2(r9, r13) 02:52:45 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x18}) 02:52:45 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r3, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:45 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x8}) 02:52:45 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x600}) 02:52:45 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) [ 622.431823][ T27] audit: type=1804 audit(1683773565.095:139): pid=17139 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir2584099632/syzkaller.rk9O0G/766/cgroup.controllers" dev="sda1" ino=1960 res=1 errno=0 02:52:45 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x9}) 02:52:45 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x25}) 02:52:45 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x700}) 02:52:45 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r3, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:45 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xa}) 02:52:45 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x41}) 02:52:45 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async, rerun: 32) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (rerun: 32) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async, rerun: 64) r4 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (rerun: 64) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000140)=ANY=[], 0x208e24b) (async) ioctl$IOMMU_IOAS_ALLOC(r5, 0x3b81, &(0x7f0000000100)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_UNMAP$ALL(r4, 0x3b86, &(0x7f0000000180)={0x18, r6}) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r7, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x1, 0x0, r8}) (async) ioctl$IOMMU_IOAS_MAP$PAGES(0xffffffffffffffff, 0x3b85, &(0x7f00000003c0)={0x28, 0x5, r8, 0x0, &(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x783e}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r0, 0x3ba0, &(0x7f0000000300)={0x38, 0x1, r8, 0x0, 0x7, 0x8}) (async, rerun: 64) r9 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async, rerun: 64) r10 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r10, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r10, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r11}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r7, 0x3ba0, &(0x7f00000001c0)={0x38, 0x2, r11}) (async, rerun: 64) ioctl$IOMMU_VFIO_IOAS$GET(r7, 0x3b88, &(0x7f0000000340)={0xc}) (rerun: 64) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(0xffffffffffffffff, 0x3ba0, &(0x7f0000000380)={0x38, 0x2, r8, 0x0, 0x0}) ioctl$IOMMU_DESTROY$device(r2, 0x3b80, &(0x7f00000002c0)={0x8, r12}) (async) ioctl$F2FS_IOC_MOVE_RANGE(r2, 0xc020f509, &(0x7f0000000400)={r0, 0x3, 0x4, 0x5}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) r14 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async, rerun: 32) r15 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) sendfile(r15, r14, 0x0, 0x100000002) (async, rerun: 32) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r5, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r14, 0x0, 0x3, 0x0, 0x800000, 0x0, 0x137b0c}) (rerun: 32) dup2(r9, r13) 02:52:45 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x900}) 02:52:45 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = creat(&(0x7f0000000080)='./file0\x00', 0x6) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r2, 0x3b85, &(0x7f0000000100)={0x28, 0x0, r3, 0x0, &(0x7f0000001000/0x2000)=nil, 0x2000, 0x8}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r4, r5) 02:52:45 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r3, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:45 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xb}) 02:52:45 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x5c}) 02:52:45 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xc}) 02:52:45 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r3, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:45 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x7b}) 02:52:45 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xa00}) 02:52:45 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xd}) 02:52:45 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xf0}) 02:52:45 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000080)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r4, r5) 02:52:45 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r3, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:45 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = creat(&(0x7f0000000080)='./file0\x00', 0x6) (async, rerun: 32) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) (rerun: 32) ioctl$IOMMU_IOAS_MAP$PAGES(r2, 0x3b85, &(0x7f0000000100)={0x28, 0x0, r3, 0x0, &(0x7f0000001000/0x2000)=nil, 0x2000, 0x8}) (async) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r4, r5) 02:52:45 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xe}) 02:52:45 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xf2}) 02:52:45 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xb00}) 02:52:46 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r2, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:46 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x10}) 02:52:46 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x300}) 02:52:46 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xc00}) 02:52:46 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) (async) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000080)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r4, r5) 02:52:46 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x11}) 02:52:46 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x500}) 02:52:46 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r2, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:46 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async) r2 = creat(&(0x7f0000000080)='./file0\x00', 0x6) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r2, 0x3b85, &(0x7f0000000100)={0x28, 0x0, r3, 0x0, &(0x7f0000001000/0x2000)=nil, 0x2000, 0x8}) (async) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r4, r5) 02:52:46 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xd00}) 02:52:46 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x600}) 02:52:46 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000080)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r4, r5) 02:52:46 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x12}) 02:52:46 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xe00}) 02:52:46 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r2, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:46 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = dup3(0xffffffffffffffff, r0, 0x80000) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000080)={0xc}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r5, 0x0) fcntl$setlease(r5, 0x400, 0x2) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r4, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r7, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r6, r7) 02:52:46 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x700}) 02:52:46 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x1100}) 02:52:46 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x18}) 02:52:46 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x40e00, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) 02:52:46 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r3, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:46 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x1200}) 02:52:46 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x900}) 02:52:46 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r3, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:46 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x25}) 02:52:46 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = dup3(0xffffffffffffffff, r0, 0x80000) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000080)={0xc}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r5, 0x0) (async) fcntl$setlease(r5, 0x400, 0x2) (async) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r4, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r7, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) dup2(r6, r7) 02:52:46 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x1800}) 02:52:46 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x40e00, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) 02:52:46 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xa00}) 02:52:46 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r3, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:46 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x41}) 02:52:46 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x2000}) 02:52:46 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r3, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:46 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x40e00, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) 02:52:46 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = dup3(0xffffffffffffffff, r0, 0x80000) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000080)={0xc}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r5, 0x0) fcntl$setlease(r5, 0x400, 0x2) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r4, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r7, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r6, r7) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) dup3(0xffffffffffffffff, r0, 0x80000) (async) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000080)={0xc}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000000)={0xc}) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) write$binfmt_script(r5, &(0x7f0000000140)=ANY=[], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r5, 0x0) (async) fcntl$setlease(r5, 0x400, 0x2) (async) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r4, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) (async) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r7, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) dup2(r6, r7) (async) 02:52:46 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xb00}) 02:52:46 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x5c}) 02:52:47 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r3, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:47 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) ioctl$IOMMU_IOAS_UNMAP(r2, 0x3b86, &(0x7f0000000080)={0x18, r1, 0x3f85, 0x4}) dup2(r2, r3) 02:52:47 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x2500}) 02:52:47 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xc00}) 02:52:47 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x7b}) 02:52:47 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r3, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:47 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) ioctl$IOMMU_IOAS_UNMAP(r2, 0x3b86, &(0x7f0000000080)={0x18, r1, 0x3f85, 0x4}) dup2(r2, r3) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1}) (async) ioctl$IOMMU_IOAS_UNMAP(r2, 0x3b86, &(0x7f0000000080)={0x18, r1, 0x3f85, 0x4}) (async) dup2(r2, r3) (async) 02:52:47 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x3fff}) [ 624.424948][ T1216] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.431296][ T1216] ieee802154 phy1 wpan1: encryption failed: -22 02:52:47 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xf0}) 02:52:47 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r4, r5) ioctl$IOMMU_IOAS_COPY(r4, 0x3b83, &(0x7f0000000080)={0x28, 0x7, r1, r1, 0x7ff, 0xfffffffffffffffa, 0x9}) 02:52:47 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xd00}) 02:52:47 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x4000}) 02:52:47 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:47 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xf2}) 02:52:47 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) ioctl$IOMMU_IOAS_UNMAP(r2, 0x3b86, &(0x7f0000000080)={0x18, r1, 0x3f85, 0x4}) (async) ioctl$IOMMU_IOAS_UNMAP(r2, 0x3b86, &(0x7f0000000080)={0x18, r1, 0x3f85, 0x4}) dup2(r2, r3) (async) dup2(r2, r3) 02:52:47 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xe00}) 02:52:47 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) dup2(r4, r5) ioctl$IOMMU_IOAS_COPY(r4, 0x3b83, &(0x7f0000000080)={0x28, 0x7, r1, r1, 0x7ff, 0xfffffffffffffffa, 0x9}) 02:52:47 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:47 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x4100}) 02:52:47 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x400000, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) ioctl$IOMMU_VFIO_SET_IOMMU(0xffffffffffffffff, 0x3b66, 0x3) dup2(r2, r3) ioctl$F2FS_IOC_MOVE_RANGE(r3, 0xc020f509, &(0x7f0000000080)={r0, 0x9, 0x6, 0x7}) ioctl$IOMMU_IOAS_MAP$PAGES(r4, 0x3b85, &(0x7f00000000c0)={0x28, 0x2, r1, 0x0, &(0x7f0000ffe000/0x1000)=nil, 0x1000, 0xc7}) 02:52:47 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x300}) 02:52:47 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r4, r5) ioctl$IOMMU_IOAS_COPY(r4, 0x3b83, &(0x7f0000000080)={0x28, 0x7, r1, r1, 0x7ff, 0xfffffffffffffffa, 0x9}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) (async) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) (async) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) dup2(r4, r5) (async) ioctl$IOMMU_IOAS_COPY(r4, 0x3b83, &(0x7f0000000080)={0x28, 0x7, r1, r1, 0x7ff, 0xfffffffffffffffa, 0x9}) (async) 02:52:47 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x1100}) 02:52:47 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:47 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x5c00}) 02:52:47 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x500}) 02:52:47 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x400000, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) ioctl$IOMMU_VFIO_SET_IOMMU(0xffffffffffffffff, 0x3b66, 0x3) dup2(r2, r3) ioctl$F2FS_IOC_MOVE_RANGE(r3, 0xc020f509, &(0x7f0000000080)={r0, 0x9, 0x6, 0x7}) ioctl$IOMMU_IOAS_MAP$PAGES(r4, 0x3b85, &(0x7f00000000c0)={0x28, 0x2, r1, 0x0, &(0x7f0000ffe000/0x1000)=nil, 0x1000, 0xc7}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x400000, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1}) (async) ioctl$IOMMU_VFIO_SET_IOMMU(0xffffffffffffffff, 0x3b66, 0x3) (async) dup2(r2, r3) (async) ioctl$F2FS_IOC_MOVE_RANGE(r3, 0xc020f509, &(0x7f0000000080)={r0, 0x9, 0x6, 0x7}) (async) ioctl$IOMMU_IOAS_MAP$PAGES(r4, 0x3b85, &(0x7f00000000c0)={0x28, 0x2, r1, 0x0, &(0x7f0000ffe000/0x1000)=nil, 0x1000, 0xc7}) (async) 02:52:47 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x1200}) 02:52:47 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r2, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:47 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x20080, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000080)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r4, r5) 02:52:47 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x7bff}) 02:52:47 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x600}) 02:52:47 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r2, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:47 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x400000, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) (async) ioctl$IOMMU_VFIO_SET_IOMMU(0xffffffffffffffff, 0x3b66, 0x3) dup2(r2, r3) ioctl$F2FS_IOC_MOVE_RANGE(r3, 0xc020f509, &(0x7f0000000080)={r0, 0x9, 0x6, 0x7}) ioctl$IOMMU_IOAS_MAP$PAGES(r4, 0x3b85, &(0x7f00000000c0)={0x28, 0x2, r1, 0x0, &(0x7f0000ffe000/0x1000)=nil, 0x1000, 0xc7}) 02:52:47 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x700}) 02:52:47 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x20080, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000080)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r4, r5) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x20080, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) (async) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000080)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) (async) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) dup2(r4, r5) (async) 02:52:47 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x1800}) 02:52:47 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xf0ff}) 02:52:47 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r2, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:47 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xf2ff}) 02:52:47 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x900}) 02:52:47 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x2000}) 02:52:47 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x20080, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000080)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) dup2(r4, r5) 02:52:48 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r3, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:48 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xff3f}) 02:52:48 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xa00}) 02:52:48 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x2500}) 02:52:48 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r4, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r5}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000080)={0x38, 0x5, r5}) 02:52:48 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xff7b}) 02:52:48 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r3, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:48 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xb00}) 02:52:48 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x3fff}) 02:52:48 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r4, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r5}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000080)={0x38, 0x5, r5}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1}) (async) dup2(r2, r3) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000000)={0xc}) (async) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r4, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r5}) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000080)={0x38, 0x5, r5}) (async) 02:52:48 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xfff0}) 02:52:48 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x4000}) 02:52:48 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r3, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:48 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xc00}) 02:52:48 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) (async) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r4, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r5}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000080)={0x38, 0x5, r5}) 02:52:48 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r2, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:48 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xd00}) 02:52:48 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xfff2}) 02:52:48 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x4100}) 02:52:48 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) r4 = dup2(r2, r3) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$IOMMU_TEST_OP_ACCESS_RW(r5, 0x3ba0, &(0x7f00000000c0)={0x38, 0x8, r4, 0x0, 0x3, 0xbcaad51bed91d0bc, &(0x7f0000000100)="05abf9150041d335df74a19fb0ba3af161161628833bbfda8472c4f8701098ce45eb530d"}) r6 = openat$cgroup_ro(r4, &(0x7f0000000180)='memory.events\x00', 0x0, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r5, 0x3b88, &(0x7f00000001c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_COPY(r6, 0x3b83, &(0x7f0000000200)={0x28, 0x5, r1, r7, 0x3, 0x48, 0x1}) 02:52:48 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r2, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:48 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xe00}) 02:52:48 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x5c00}) 02:52:48 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x200000}) 02:52:48 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) r4 = dup2(r2, r3) (async) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$IOMMU_TEST_OP_ACCESS_RW(r5, 0x3ba0, &(0x7f00000000c0)={0x38, 0x8, r4, 0x0, 0x3, 0xbcaad51bed91d0bc, &(0x7f0000000100)="05abf9150041d335df74a19fb0ba3af161161628833bbfda8472c4f8701098ce45eb530d"}) (async) r6 = openat$cgroup_ro(r4, &(0x7f0000000180)='memory.events\x00', 0x0, 0x0) (async, rerun: 32) ioctl$IOMMU_VFIO_IOAS$GET(r5, 0x3b88, &(0x7f00000001c0)={0xc, 0x0}) (rerun: 32) ioctl$IOMMU_IOAS_COPY(r6, 0x3b83, &(0x7f0000000200)={0x28, 0x5, r1, r7, 0x3, 0x48, 0x1}) 02:52:48 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x301002, 0x0) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00'/12, @ANYRES32=r0, @ANYBLOB="7f000000000000002e2f66696c653000"]) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000100)={0xc}) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000440)={0x34, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r4, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f00000002c0)={{0x1, 0x1, 0x18, r3}, './file0\x00'}) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r9, r8, 0x0, 0x100000002) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r8, 0x3ba0, &(0x7f00000003c0)={0x38, 0x7, r6, 0x0, 0x10000, 0x0, 0x5, 0x4e145, 0x155fd}) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r7, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r10}) ioctl$IOMMU_IOAS_UNMAP$ALL(0xffffffffffffffff, 0x3b86, &(0x7f0000000380)={0x18, r10}) r11 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r11, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r11, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r12}) ioctl$IOMMU_IOAS_MAP$PAGES(r6, 0x3b85, &(0x7f0000000300)={0x28, 0x2, r12, 0x0, &(0x7f00000f4000/0x4000)=nil, 0x4000, 0x5054}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r2, 0x0, 0xffffffffffffffff, 0x1}) r14 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r14, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r14, 0x0) ioctl$IOMMU_IOAS_ALLOC(r14, 0x3b81, &(0x7f0000000340)={0xc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r14, 0x3ba0, &(0x7f0000000180)={0x38, 0x7, r13, 0x0, 0x0, 0x0, 0x0, 0x22a1a1, 0xccea7}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r5, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r13, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r5, r13) 02:52:48 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r2, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:48 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x7bff}) 02:52:48 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x1100}) 02:52:48 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x1000000}) 02:52:48 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) r4 = dup2(r2, r3) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$IOMMU_TEST_OP_ACCESS_RW(r5, 0x3ba0, &(0x7f00000000c0)={0x38, 0x8, r4, 0x0, 0x3, 0xbcaad51bed91d0bc, &(0x7f0000000100)="05abf9150041d335df74a19fb0ba3af161161628833bbfda8472c4f8701098ce45eb530d"}) r6 = openat$cgroup_ro(r4, &(0x7f0000000180)='memory.events\x00', 0x0, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r5, 0x3b88, &(0x7f00000001c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_COPY(r6, 0x3b83, &(0x7f0000000200)={0x28, 0x5, r1, r7, 0x3, 0x48, 0x1}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1}) (async) dup2(r2, r3) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$IOMMU_TEST_OP_ACCESS_RW(r5, 0x3ba0, &(0x7f00000000c0)={0x38, 0x8, r4, 0x0, 0x3, 0xbcaad51bed91d0bc, &(0x7f0000000100)="05abf9150041d335df74a19fb0ba3af161161628833bbfda8472c4f8701098ce45eb530d"}) (async) openat$cgroup_ro(r4, &(0x7f0000000180)='memory.events\x00', 0x0, 0x0) (async) ioctl$IOMMU_VFIO_IOAS$GET(r5, 0x3b88, &(0x7f00000001c0)={0xc}) (async) ioctl$IOMMU_IOAS_COPY(r6, 0x3b83, &(0x7f0000000200)={0x28, 0x5, r1, r7, 0x3, 0x48, 0x1}) (async) 02:52:48 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x301002, 0x0) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00'/12, @ANYRES32=r0, @ANYBLOB="7f000000000000002e2f66696c653000"]) (async) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00'/12, @ANYRES32=r0, @ANYBLOB="7f000000000000002e2f66696c653000"]) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000100)={0xc}) (async) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000100)={0xc}) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000440)={0x34, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r4, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f00000002c0)={{0x1, 0x1, 0x18, r3}, './file0\x00'}) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r9, r8, 0x0, 0x100000002) (async) sendfile(r9, r8, 0x0, 0x100000002) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r8, 0x3ba0, &(0x7f00000003c0)={0x38, 0x7, r6, 0x0, 0x10000, 0x0, 0x5, 0x4e145, 0x155fd}) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r7, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r10}) ioctl$IOMMU_IOAS_UNMAP$ALL(0xffffffffffffffff, 0x3b86, &(0x7f0000000380)={0x18, r10}) (async) ioctl$IOMMU_IOAS_UNMAP$ALL(0xffffffffffffffff, 0x3b86, &(0x7f0000000380)={0x18, r10}) r11 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r11, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r11, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r12}) ioctl$IOMMU_IOAS_MAP$PAGES(r6, 0x3b85, &(0x7f0000000300)={0x28, 0x2, r12, 0x0, &(0x7f00000f4000/0x4000)=nil, 0x4000, 0x5054}) (async) ioctl$IOMMU_IOAS_MAP$PAGES(r6, 0x3b85, &(0x7f0000000300)={0x28, 0x2, r12, 0x0, &(0x7f00000f4000/0x4000)=nil, 0x4000, 0x5054}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r2, 0x0, 0xffffffffffffffff, 0x1}) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r2, 0x0, 0xffffffffffffffff, 0x1}) r14 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r14, &(0x7f0000000140)=ANY=[], 0x208e24b) (async) write$binfmt_script(r14, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r14, 0x0) ioctl$IOMMU_IOAS_ALLOC(r14, 0x3b81, &(0x7f0000000340)={0xc}) (async) ioctl$IOMMU_IOAS_ALLOC(r14, 0x3b81, &(0x7f0000000340)={0xc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r14, 0x3ba0, &(0x7f0000000180)={0x38, 0x7, r13, 0x0, 0x0, 0x0, 0x0, 0x22a1a1, 0xccea7}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r5, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r13, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r5, r13) 02:52:48 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) 02:52:48 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xf0ff}) 02:52:48 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x1200}) 02:52:48 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) 02:52:49 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x2000000}) 02:52:49 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = openat$damon_kdamond_pid(0xffffffffffffff9c, &(0x7f0000000080), 0x204100, 0x110) r2 = openat$cgroup_ro(r1, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) r4 = openat$cgroup_ro(r2, &(0x7f0000000100)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r4, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r5, 0x0, 0xffffffffffffffff}) dup2(r6, r7) 02:52:49 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x1800}) 02:52:49 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xf2ff}) 02:52:49 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x3000000}) 02:52:49 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, 0x0) 02:52:49 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x301002, 0x0) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00'/12, @ANYRES32=r0, @ANYBLOB="7f000000000000002e2f66696c653000"]) (async, rerun: 32) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000100)={0xc}) (async, rerun: 32) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000440)={0x34, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r4, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async, rerun: 32) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async, rerun: 32) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f00000002c0)={{0x1, 0x1, 0x18, r3}, './file0\x00'}) (async) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r9, r8, 0x0, 0x100000002) (async, rerun: 64) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r8, 0x3ba0, &(0x7f00000003c0)={0x38, 0x7, r6, 0x0, 0x10000, 0x0, 0x5, 0x4e145, 0x155fd}) (async, rerun: 64) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r7, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r10}) ioctl$IOMMU_IOAS_UNMAP$ALL(0xffffffffffffffff, 0x3b86, &(0x7f0000000380)={0x18, r10}) (async) r11 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r11, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r11, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r12}) (async, rerun: 64) ioctl$IOMMU_IOAS_MAP$PAGES(r6, 0x3b85, &(0x7f0000000300)={0x28, 0x2, r12, 0x0, &(0x7f00000f4000/0x4000)=nil, 0x4000, 0x5054}) (async, rerun: 64) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r2, 0x0, 0xffffffffffffffff, 0x1}) r14 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r14, &(0x7f0000000140)=ANY=[], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r14, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r14, 0x3b81, &(0x7f0000000340)={0xc}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r14, 0x3ba0, &(0x7f0000000180)={0x38, 0x7, r13, 0x0, 0x0, 0x0, 0x0, 0x22a1a1, 0xccea7}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r5, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r13, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) dup2(r5, r13) 02:52:49 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xff3f}) 02:52:49 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x2000}) 02:52:49 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x4000000}) 02:52:49 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:49 executing program 1: openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = openat$damon_kdamond_pid(0xffffffffffffff9c, &(0x7f0000000080), 0x204100, 0x110) r2 = openat$cgroup_ro(r1, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) r4 = openat$cgroup_ro(r2, &(0x7f0000000100)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r4, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f00000000c0)={0xc}) (async) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r5}) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r5, 0x0, 0xffffffffffffffff}) dup2(r6, r7) (async) dup2(r6, r7) 02:52:49 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x2500}) 02:52:49 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xff7b}) 02:52:49 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x5000000}) 02:52:49 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000180)={0xc}) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r7, r6, 0x0, 0x100000002) ioctl$IOMMU_IOAS_ALLOW_IOVAS(r6, 0x3b82, &(0x7f0000000100)={0x18, r1, 0x1, 0x0, &(0x7f0000000080)=[{0x45e, 0xbf}]}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r4, r5) 02:52:49 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:49 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x3fff}) 02:52:49 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xfff0}) 02:52:49 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x6000000}) 02:52:49 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = openat$damon_kdamond_pid(0xffffffffffffff9c, &(0x7f0000000080), 0x204100, 0x110) r2 = openat$cgroup_ro(r1, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000140)=ANY=[], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000140)=ANY=[], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) (async) r4 = openat$cgroup_ro(r2, &(0x7f0000000100)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000140)=ANY=[], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r4, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async, rerun: 64) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r5, 0x0, 0xffffffffffffffff}) (rerun: 64) dup2(r6, r7) 02:52:49 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000180)={0xc}) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r7, r6, 0x0, 0x100000002) ioctl$IOMMU_IOAS_ALLOW_IOVAS(r6, 0x3b82, &(0x7f0000000100)={0x18, r1, 0x1, 0x0, &(0x7f0000000080)=[{0x45e, 0xbf}]}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r4, r5) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) (async) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) (async) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000180)={0xc}) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendfile(r7, r6, 0x0, 0x100000002) (async) ioctl$IOMMU_IOAS_ALLOW_IOVAS(r6, 0x3b82, &(0x7f0000000100)={0x18, r1, 0x1, 0x0, &(0x7f0000000080)=[{0x45e, 0xbf}]}) (async) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) dup2(r4, r5) (async) 02:52:49 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x1000000}) 02:52:49 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x7000000}) 02:52:49 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x4000}) 02:52:49 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}) 02:52:49 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000180)={0xc}) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r7, r6, 0x0, 0x100000002) ioctl$IOMMU_IOAS_ALLOW_IOVAS(r6, 0x3b82, &(0x7f0000000100)={0x18, r1, 0x1, 0x0, &(0x7f0000000080)=[{0x45e, 0xbf}]}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r4, r5) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) (async) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) (async) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000180)={0xc}) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendfile(r7, r6, 0x0, 0x100000002) (async) ioctl$IOMMU_IOAS_ALLOW_IOVAS(r6, 0x3b82, &(0x7f0000000100)={0x18, r1, 0x1, 0x0, &(0x7f0000000080)=[{0x45e, 0xbf}]}) (async) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) dup2(r4, r5) (async) 02:52:49 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xfff2}) 02:52:49 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x4100}) 02:52:49 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x40, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) 02:52:49 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x8000000}) 02:52:49 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r3}) 02:52:49 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x200000}) 02:52:49 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x9000000}) 02:52:49 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x5c00}) 02:52:49 executing program 1: openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x40, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) 02:52:49 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r3}) 02:52:49 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x1000000}) 02:52:49 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xa000000}) 02:52:49 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x7bff}) 02:52:50 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x40, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) 02:52:50 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x2000000}) 02:52:50 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r3}) 02:52:50 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r4, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r5}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r5, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r6, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r3, r6) 02:52:50 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xf0ff}) 02:52:50 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xb000000}) 02:52:50 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x5c00}) 02:52:50 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r4, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r5}) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r5, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r6, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) dup2(r3, r6) 02:52:50 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x3000000}) 02:52:50 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xc000000}) 02:52:50 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xf2ff}) 02:52:50 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x200000}) 02:52:50 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x4000000}) 02:52:50 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r4, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r5}) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r5, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r6, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r3, r6) 02:52:50 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xd000000}) 02:52:50 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xff3f}) 02:52:50 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xfff0}) 02:52:50 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x5000000}) 02:52:50 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xe000000}) 02:52:50 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000080)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x1, 0x0, 0x0, 0xc76f9, 0x3ad746}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r4, r5) 02:52:50 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xff7b}) 02:52:50 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xb00}) 02:52:50 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x10000000}) 02:52:50 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x6000000}) 02:52:50 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = open(&(0x7f0000000080)='./file0\x00', 0x200843, 0xa4) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r3, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r4}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r2, 0x3b87, &(0x7f00000000c0)={0x18, 0x1, 0x1, 0x0, r4}) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r5, r6) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r7, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r7, 0x0) r8 = socket$tipc(0x1e, 0x2, 0x0) sendmsg$BATADV_CMD_GET_HARDIF(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010090c90000000000000500000008000300", @ANYRES8=r8], 0x24}}, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r7, 0xc0184800, &(0x7f0000000100)={0x3, r8, 0x2}) 02:52:50 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000080)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x1, 0x0, 0x0, 0xc76f9, 0x3ad746}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) dup2(r4, r5) 02:52:50 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xfff0}) 02:52:50 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x700}) 02:52:50 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x11000000}) 02:52:50 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x7000000}) 02:52:50 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async, rerun: 32) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000080)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x1, 0x0, 0x0, 0xc76f9, 0x3ad746}) (rerun: 32) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) dup2(r4, r5) 02:52:50 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xfff2}) 02:52:50 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = open(&(0x7f0000000080)='./file0\x00', 0x200843, 0xa4) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r3, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r4}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r2, 0x3b87, &(0x7f00000000c0)={0x18, 0x1, 0x1, 0x0, r4}) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r5, r6) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r7, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r7, 0x0) r8 = socket$tipc(0x1e, 0x2, 0x0) sendmsg$BATADV_CMD_GET_HARDIF(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010090c90000000000000500000008000300", @ANYRES8=r8], 0x24}}, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r7, 0xc0184800, &(0x7f0000000100)={0x3, r8, 0x2}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) open(&(0x7f0000000080)='./file0\x00', 0x200843, 0xa4) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000000)={0xc}) (async) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r3, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r4}) (async) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r2, 0x3b87, &(0x7f00000000c0)={0x18, 0x1, 0x1, 0x0, r4}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1}) (async) dup2(r5, r6) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) write$binfmt_script(r7, &(0x7f0000000140)=ANY=[], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r7, 0x0) (async) socket$tipc(0x1e, 0x2, 0x0) (async) sendmsg$BATADV_CMD_GET_HARDIF(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010090c90000000000000500000008000300", @ANYRES8=r8], 0x24}}, 0x0) (async) ioctl$DMA_HEAP_IOCTL_ALLOC(r7, 0xc0184800, &(0x7f0000000100)={0x3, r8, 0x2}) (async) 02:52:50 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xe00}) 02:52:50 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x12000000}) 02:52:50 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x8000000}) 02:52:51 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x200000}) 02:52:51 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x600}) 02:52:51 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000100), 0x84022, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f0000000180)={0xc, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r2, 0x3ba0, &(0x7f00000001c0)={0x38, 0x2, r3}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r5, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000080)={0xc}) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r7, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r6, r7) 02:52:51 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x18000000}) 02:52:51 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x9000000}) 02:52:51 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x1000000}) 02:52:51 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = open(&(0x7f0000000080)='./file0\x00', 0x200843, 0xa4) (async) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r3, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r4}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r2, 0x3b87, &(0x7f00000000c0)={0x18, 0x1, 0x1, 0x0, r4}) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r5, r6) (async) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r7, &(0x7f0000000140)=ANY=[], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r7, 0x0) (async) r8 = socket$tipc(0x1e, 0x2, 0x0) sendmsg$BATADV_CMD_GET_HARDIF(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010090c90000000000000500000008000300", @ANYRES8=r8], 0x24}}, 0x0) (async) ioctl$DMA_HEAP_IOCTL_ALLOC(r7, 0xc0184800, &(0x7f0000000100)={0x3, r8, 0x2}) 02:52:51 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:51 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x900}) 02:52:51 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000100), 0x84022, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f0000000180)={0xc, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r2, 0x3ba0, &(0x7f00000001c0)={0x38, 0x2, r3}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r5, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000080)={0xc}) (async) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r7, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r6, r7) 02:52:51 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x2000000}) 02:52:51 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xa000000}) 02:52:51 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x25000000}) 02:52:51 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000100), 0x84022, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f0000000180)={0xc, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r2, 0x3ba0, &(0x7f00000001c0)={0x38, 0x2, r3}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r5, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000080)={0xc}) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r7, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r6, r7) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) openat$vcsu(0xffffffffffffff9c, &(0x7f0000000100), 0x84022, 0x0) (async) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f0000000180)={0xc}) (async) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r2, 0x3ba0, &(0x7f00000001c0)={0x38, 0x2, r3}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000000)={0xc}) (async) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r5, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000080)={0xc}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) (async) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r7, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) dup2(r6, r7) (async) 02:52:51 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:51 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) r4 = syz_open_dev$vcsu(&(0x7f0000000080), 0x401, 0x84100) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f00000000c0)={0xc}) dup2(r2, r3) 02:52:51 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xb000000}) 02:52:51 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x3000000}) 02:52:51 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x40000000}) 02:52:51 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:51 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) (async, rerun: 64) r4 = syz_open_dev$vcsu(&(0x7f0000000080), 0x401, 0x84100) (rerun: 64) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f00000000c0)={0xc}) dup2(r2, r3) 02:52:51 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xc000000}) 02:52:51 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_DESTROY$device(r0, 0x3b80, &(0x7f0000000080)={0x8}) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r4, r5) 02:52:51 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x4000000}) 02:52:51 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x41000000}) 02:52:51 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:51 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xd000000}) 02:52:51 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_DESTROY$device(r0, 0x3b80, &(0x7f0000000080)={0x8}) (async) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) dup2(r4, r5) 02:52:51 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x5c000000}) 02:52:51 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x5000000}) 02:52:51 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:51 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xe000000}) 02:52:51 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) r4 = syz_open_dev$vcsu(&(0x7f0000000080), 0x401, 0x84100) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f00000000c0)={0xc}) (async) dup2(r2, r3) 02:52:51 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_DESTROY$device(r0, 0x3b80, &(0x7f0000000080)={0x8}) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async, rerun: 64) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) (rerun: 64) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async, rerun: 64) dup2(r4, r5) (rerun: 64) 02:52:51 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x7bffffff}) 02:52:51 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x6000000}) 02:52:51 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:52 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x10000000}) 02:52:52 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r5, r4, 0x0, 0x100000002) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r4, 0x80089419, &(0x7f0000000080)) 02:52:52 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xf0ffffff}) 02:52:52 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, 0xffffffffffffffff, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:52 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x7000000}) 02:52:52 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r5, r4, 0x0, 0x100000002) (async) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r4, 0x80089419, &(0x7f0000000080)) 02:52:52 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x11000000}) 02:52:52 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xf2ffffff}) 02:52:52 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:52 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x8000000}) 02:52:52 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x12000000}) 02:52:52 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) (async) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r5, r4, 0x0, 0x100000002) (async) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r4, 0x80089419, &(0x7f0000000080)) 02:52:52 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:52 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x9000000}) 02:52:52 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xfdfdffff}) 02:52:52 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x18000000}) 02:52:52 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xff3f0000}) 02:52:52 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:52 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x305000, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/module/tcp_cdg', 0x0, 0x120) ioctl$IOMMU_VFIO_IOMMU_GET_INFO(r4, 0x3b70, &(0x7f0000000180)={0x60, 0x0, 0x0, 0x0, {}, {{}, 0x0, 0x0, [{}, {}, {}]}}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38, 0x2, r1}) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f00000000c0)={0xc}) 02:52:52 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xa000000}) 02:52:52 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:52 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xfffffdfd}) 02:52:52 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:52 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x305000, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/module/tcp_cdg', 0x0, 0x120) ioctl$IOMMU_VFIO_IOMMU_GET_INFO(r4, 0x3b70, &(0x7f0000000180)={0x60, 0x0, 0x0, 0x0, {}, {{}, 0x0, 0x0, [{}, {}, {}]}}) (async) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38, 0x2, r1}) (async) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f00000000c0)={0xc}) 02:52:52 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xb000000}) 02:52:52 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:52 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x25000000}) 02:52:52 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xffffff7b}) 02:52:52 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r2, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r3}) ioctl$IOMMU_IOAS_IOVA_RANGES(r0, 0x3b84, &(0x7f00000001c0)={0x20, r3, 0x1, 0x0, &(0x7f0000000180)=[{}]}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f0000000100)={&(0x7f0000000080)=[0x0], 0x1, 0x80000, 0x0, 0xffffffffffffffff}) ioctl$IOMMU_IOAS_MAP$PAGES(r6, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r5, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r8, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r7, r8) 02:52:52 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x305000, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) (async) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/module/tcp_cdg', 0x0, 0x120) ioctl$IOMMU_VFIO_IOMMU_GET_INFO(r4, 0x3b70, &(0x7f0000000180)={0x60, 0x0, 0x0, 0x0, {}, {{}, 0x0, 0x0, [{}, {}, {}]}}) (async) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(0xffffffffffffffff, 0x3ba0, &(0x7f0000000040)={0x38, 0x2, r1}) (async) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f00000000c0)={0xc}) 02:52:52 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xc000000}) 02:52:52 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x40000000}) 02:52:52 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r2, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r3}) ioctl$IOMMU_IOAS_IOVA_RANGES(r0, 0x3b84, &(0x7f00000001c0)={0x20, r3, 0x1, 0x0, &(0x7f0000000180)=[{}]}) (async) ioctl$IOMMU_IOAS_IOVA_RANGES(r0, 0x3b84, &(0x7f00000001c0)={0x20, r3, 0x1, 0x0, &(0x7f0000000180)=[{}]}) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f0000000100)={&(0x7f0000000080)=[0x0], 0x1, 0x80000, 0x0, 0xffffffffffffffff}) ioctl$IOMMU_IOAS_MAP$PAGES(r6, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r5, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) ioctl$IOMMU_IOAS_MAP$PAGES(r6, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r5, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r8, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r7, r8) 02:52:52 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xffffff7f}) 02:52:52 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:52 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r4, 0x0) ioctl$KVM_CAP_HYPERV_ENFORCE_CPUID(r4, 0x4068aea3, &(0x7f0000000080)) r5 = openat$damon_schemes(0xffffffffffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, r5) 02:52:52 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xd000000}) 02:52:52 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x41000000}) 02:52:52 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) (async) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r2, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r3}) ioctl$IOMMU_IOAS_IOVA_RANGES(r0, 0x3b84, &(0x7f00000001c0)={0x20, r3, 0x1, 0x0, &(0x7f0000000180)=[{}]}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f0000000100)={&(0x7f0000000080)=[0x0], 0x1, 0x80000, 0x0, 0xffffffffffffffff}) ioctl$IOMMU_IOAS_MAP$PAGES(r6, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r5, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) ioctl$IOMMU_IOAS_MAP$PAGES(r6, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r5, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r8, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r7, r8) (async) dup2(r7, r8) 02:52:52 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xfffffff0}) 02:52:52 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, 0x0, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r3, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:53 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xe000000}) 02:52:53 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x5c000000}) 02:52:53 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xfffffff2}) 02:52:53 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, 0x0, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r3, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:53 executing program 1: openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r4, 0x0) ioctl$KVM_CAP_HYPERV_ENFORCE_CPUID(r4, 0x4068aea3, &(0x7f0000000080)) (async) ioctl$KVM_CAP_HYPERV_ENFORCE_CPUID(r4, 0x4068aea3, &(0x7f0000000080)) r5 = openat$damon_schemes(0xffffffffffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, r5) 02:52:53 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x10000000}) 02:52:53 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, 0x0, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r3, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:53 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x7bffffff}) 02:52:53 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x1000000000000}) 02:52:53 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xf0ffffff}) 02:52:53 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:53 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x11000000}) 02:52:53 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000000000}) 02:52:53 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) (async) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000140)=ANY=[], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r4, 0x0) (async) ioctl$KVM_CAP_HYPERV_ENFORCE_CPUID(r4, 0x4068aea3, &(0x7f0000000080)) (async) r5 = openat$damon_schemes(0xffffffffffffff9c, &(0x7f0000000100), 0x200000, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, r5) 02:52:53 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:53 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x100000000000000}) 02:52:53 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xf2ffffff}) 02:52:53 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x12000000}) 02:52:53 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x40204, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) 02:52:53 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:53 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x200000000000000}) 02:52:53 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x18000000}) 02:52:53 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xfdfdffff}) 02:52:53 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) ioctl$IOMMU_IOAS_MAP(r2, 0x3b85, &(0x7f00000003c0)={0x28, 0x5, r3, 0x0, &(0x7f00000002c0)="e095fc20a2c7023f878139598bba8f1b8db1d5fe64f01b0b429ea41e04d308274501d7b97d960223147ceb888b1f77782f39f7def76dc6632e33d58e9b4bbfadece602923ac5dd734b93d89d837d3ed6611edaf9c6f04fd220cc4817a56667245d1534a5f279c975ddbd24439de29c7ea2f86a6e70f638db0ff5a57f4e0135e8f394b8cde0c7369dcc124f5df47efb8c89e3236d08f753e0cfba8e8951b891573603190a8490cd0ed016f362a8abf6397bd8b7e68579afd79a2da94b87e5356b6f0dd419da920fb42ae7f0271c35cc7b7b92870ec69fa7d6d8374acfcc69a7fd9ad75238c8ea8eb21de6", 0xea, 0x8001}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r5 = openat$mice(0xffffffffffffff9c, &(0x7f0000000400), 0x0) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x430503, 0x0) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r6, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r7}) ioctl$IOMMU_IOAS_MAP(r5, 0x3b85, &(0x7f0000000480)={0x28, 0x1, r7, 0x0, &(0x7f0000000440)="a0af50d33bc798f3885ab76260aad38a83e4419752d9a558fa5340b1d9ec81bbd55b896b56118173040ed09ea6766ca2f8d25c6e6a0d4c9aaf", 0x39, 0xffffffffffffffff}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r9, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r9, 0xffffc000) ioctl$IOMMU_VFIO_IOAS$GET(r4, 0x3b88, &(0x7f0000000080)={0xc}) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r11, r10, 0x0, 0x100000002) r12 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r12, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r12, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r13}) r14 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r14, &(0x7f0000000100)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r14, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r9, 0x3ba0, &(0x7f00000004c0)={0x38, 0x2, r1}) r15 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs2/binder1\x00', 0x800, 0x0) dup3(r2, r15, 0x80000) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r8, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) 02:52:53 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:53 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x40204, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x40204, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1}) (async) dup2(r2, r3) (async) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) (async) 02:52:53 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x300000000000000}) 02:52:53 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:53 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xff3f0000}) 02:52:53 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:53 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x40204, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) (async) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) 02:52:53 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) ioctl$IOMMU_IOAS_MAP(r2, 0x3b85, &(0x7f00000003c0)={0x28, 0x5, r3, 0x0, &(0x7f00000002c0)="e095fc20a2c7023f878139598bba8f1b8db1d5fe64f01b0b429ea41e04d308274501d7b97d960223147ceb888b1f77782f39f7def76dc6632e33d58e9b4bbfadece602923ac5dd734b93d89d837d3ed6611edaf9c6f04fd220cc4817a56667245d1534a5f279c975ddbd24439de29c7ea2f86a6e70f638db0ff5a57f4e0135e8f394b8cde0c7369dcc124f5df47efb8c89e3236d08f753e0cfba8e8951b891573603190a8490cd0ed016f362a8abf6397bd8b7e68579afd79a2da94b87e5356b6f0dd419da920fb42ae7f0271c35cc7b7b92870ec69fa7d6d8374acfcc69a7fd9ad75238c8ea8eb21de6", 0xea, 0x8001}) (async) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) r5 = openat$mice(0xffffffffffffff9c, &(0x7f0000000400), 0x0) (async) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x430503, 0x0) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r6, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r7}) (async) ioctl$IOMMU_IOAS_MAP(r5, 0x3b85, &(0x7f0000000480)={0x28, 0x1, r7, 0x0, &(0x7f0000000440)="a0af50d33bc798f3885ab76260aad38a83e4419752d9a558fa5340b1d9ec81bbd55b896b56118173040ed09ea6766ca2f8d25c6e6a0d4c9aaf", 0x39, 0xffffffffffffffff}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) (async) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r9, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r9, 0xffffc000) (async) ioctl$IOMMU_VFIO_IOAS$GET(r4, 0x3b88, &(0x7f0000000080)={0xc}) (async) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r11, r10, 0x0, 0x100000002) (async) r12 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r12, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r12, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r13}) r14 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r14, &(0x7f0000000100)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r14, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r9, 0x3ba0, &(0x7f00000004c0)={0x38, 0x2, r1}) (async) r15 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs2/binder1\x00', 0x800, 0x0) dup3(r2, r15, 0x80000) (async) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r8, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) 02:52:53 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x400000000000000}) 02:52:53 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x25000000}) 02:52:53 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xfffffdfd}) 02:52:53 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:53 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000080)={0xc}) dup2(0xffffffffffffffff, r2) 02:52:53 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x500000000000000}) 02:52:53 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x40000000}) 02:52:53 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xffffff7b}) 02:52:54 executing program 5: ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(0xffffffffffffffff, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:54 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) ioctl$IOMMU_IOAS_MAP(r2, 0x3b85, &(0x7f00000003c0)={0x28, 0x5, r3, 0x0, &(0x7f00000002c0)="e095fc20a2c7023f878139598bba8f1b8db1d5fe64f01b0b429ea41e04d308274501d7b97d960223147ceb888b1f77782f39f7def76dc6632e33d58e9b4bbfadece602923ac5dd734b93d89d837d3ed6611edaf9c6f04fd220cc4817a56667245d1534a5f279c975ddbd24439de29c7ea2f86a6e70f638db0ff5a57f4e0135e8f394b8cde0c7369dcc124f5df47efb8c89e3236d08f753e0cfba8e8951b891573603190a8490cd0ed016f362a8abf6397bd8b7e68579afd79a2da94b87e5356b6f0dd419da920fb42ae7f0271c35cc7b7b92870ec69fa7d6d8374acfcc69a7fd9ad75238c8ea8eb21de6", 0xea, 0x8001}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r5 = openat$mice(0xffffffffffffff9c, &(0x7f0000000400), 0x0) (async) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x430503, 0x0) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r6, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r7}) (async) ioctl$IOMMU_IOAS_MAP(r5, 0x3b85, &(0x7f0000000480)={0x28, 0x1, r7, 0x0, &(0x7f0000000440)="a0af50d33bc798f3885ab76260aad38a83e4419752d9a558fa5340b1d9ec81bbd55b896b56118173040ed09ea6766ca2f8d25c6e6a0d4c9aaf", 0x39, 0xffffffffffffffff}) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) (async) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r9, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r9, 0xffffc000) (async) ioctl$IOMMU_VFIO_IOAS$GET(r4, 0x3b88, &(0x7f0000000080)={0xc}) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r11, r10, 0x0, 0x100000002) (async) r12 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r12, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r12, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r13}) r14 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r14, &(0x7f0000000100)=ANY=[], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r14, 0x0) (async) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r9, 0x3ba0, &(0x7f00000004c0)={0x38, 0x2, r1}) (async) r15 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs2/binder1\x00', 0x800, 0x0) dup3(r2, r15, 0x80000) (async) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r8, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) 02:52:54 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x600000000000000}) 02:52:54 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x41000000}) 02:52:54 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000080)={0xc}) dup2(0xffffffffffffffff, r2) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1}) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) write$binfmt_script(r3, &(0x7f0000000140)=ANY=[], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000080)={0xc}) (async) dup2(0xffffffffffffffff, r2) (async) 02:52:54 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xffffff7f}) 02:52:54 executing program 5: ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(0xffffffffffffffff, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:54 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x5c000000}) 02:52:54 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x700000000000000}) 02:52:54 executing program 5: ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(0xffffffffffffffff, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:54 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xfffffff0}) 02:52:54 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) signalfd(r0, &(0x7f0000000080)={[0x5]}, 0x8) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r4, r5) 02:52:54 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x7bffffff}) 02:52:54 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xfffffff2}) 02:52:54 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x800000000000000}) 02:52:54 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) signalfd(r0, &(0x7f0000000080)={[0x5]}, 0x8) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r4, r5) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) signalfd(r0, &(0x7f0000000080)={[0x5]}, 0x8) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) (async) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) (async) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) dup2(r4, r5) (async) 02:52:54 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000140)=ANY=[], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000080)={0xc}) (async, rerun: 64) dup2(0xffffffffffffffff, r2) (rerun: 64) 02:52:54 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:54 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x1000000000000}) 02:52:54 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xf0ffffff}) 02:52:54 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x900000000000000}) 02:52:54 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:54 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) signalfd(r0, &(0x7f0000000080)={[0x5]}, 0x8) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) dup2(r4, r5) 02:52:54 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x20380, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) 02:52:54 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000000000}) 02:52:54 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xf2ffffff}) 02:52:54 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:54 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xa00000000000000}) 02:52:54 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x100000000000000}) 02:52:54 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x20380, 0x0) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x20380, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) 02:52:54 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xfdfdffff}) 02:52:54 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:54 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x20380, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r3) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x20380, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1}) (async) dup2(r2, r3) (async) 02:52:54 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xb00000000000000}) 02:52:54 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x200000000000000}) 02:52:54 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xff3f0000}) 02:52:54 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r3, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r4}) ioctl$IOMMU_IOAS_MAP$PAGES(r2, 0x3b85, &(0x7f0000000080)={0x28, 0x1, r4, 0x0, &(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x3}) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r5, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r7, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r6, r7) 02:52:54 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:54 executing program 1: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) dup3(r0, r1, 0x0) r2 = epoll_create(0x200) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000080)) poll(&(0x7f0000000140)=[{r2, 0x40}], 0x1, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r3, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r4, 0x0, 0xffffffffffffffff}) dup2(r5, r6) 02:52:54 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xc00000000000000}) 02:52:54 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r3, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r4}) ioctl$IOMMU_IOAS_MAP$PAGES(r2, 0x3b85, &(0x7f0000000080)={0x28, 0x1, r4, 0x0, &(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x3}) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r5, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r7, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r6, r7) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000000)={0xc}) (async) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r3, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r4}) (async) ioctl$IOMMU_IOAS_MAP$PAGES(r2, 0x3b85, &(0x7f0000000080)={0x28, 0x1, r4, 0x0, &(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x3}) (async) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) (async) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r5, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) (async) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r7, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) dup2(r6, r7) (async) 02:52:54 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xfffffdfd}) 02:52:54 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x300000000000000}) 02:52:55 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:55 executing program 1: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) dup3(r0, r1, 0x0) (async) r2 = epoll_create(0x200) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000080)) poll(&(0x7f0000000140)=[{r2, 0x40}], 0x1, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r3, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r4, 0x0, 0xffffffffffffffff}) dup2(r5, r6) 02:52:55 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xd00000000000000}) 02:52:55 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xffffff7b}) 02:52:55 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async, rerun: 32) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (rerun: 32) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r3, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r4}) (async) ioctl$IOMMU_IOAS_MAP$PAGES(r2, 0x3b85, &(0x7f0000000080)={0x28, 0x1, r4, 0x0, &(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x3}) (async) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r5, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async, rerun: 64) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) (rerun: 64) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r7, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) dup2(r6, r7) 02:52:55 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x400000000000000}) 02:52:55 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:55 executing program 1: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) dup3(r0, r1, 0x0) r2 = epoll_create(0x200) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000080)) (async) poll(&(0x7f0000000140)=[{r2, 0x40}], 0x1, 0x0) (async) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r3, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r4, 0x0, 0xffffffffffffffff}) dup2(r5, r6) 02:52:55 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xe00000000000000}) 02:52:55 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xffffff7f}) 02:52:55 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000140), 0xa002, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r2, r1, 0x0, 0x100000002) openat$vsock(0xffffffffffffff9c, &(0x7f0000000180), 0x20a80, 0x0) ioctl$IOMMU_VFIO_IOMMU_GET_INFO(r0, 0x3b70, &(0x7f0000000100)=ANY=[@ANYBLOB="4000000000000000000000000000f4ad4145b621822f00000000000000000000000000001f00000000000600000000000000007d592b11000000000000000000"]) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f00000000c0)={0xc}) sendfile(r4, r3, 0x0, 0x100000002) r5 = socket$rxrpc(0x21, 0x2, 0xa) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000007580), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000007640)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\b', @ANYRES16=r6, @ANYBLOB="ff830500000000000000", @ANYRES32=r5], 0x4}}, 0x0) dup2(0xffffffffffffffff, r5) 02:52:55 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x500000000000000}) 02:52:55 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:55 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x1000000000000000}) 02:52:55 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xfffffff0}) 02:52:55 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x600000000000000}) 02:52:55 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:55 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000140), 0xa002, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r2, r1, 0x0, 0x100000002) openat$vsock(0xffffffffffffff9c, &(0x7f0000000180), 0x20a80, 0x0) ioctl$IOMMU_VFIO_IOMMU_GET_INFO(r0, 0x3b70, &(0x7f0000000100)=ANY=[@ANYBLOB="4000000000000000000000000000f4ad4145b621822f00000000000000000000000000001f00000000000600000000000000007d592b11000000000000000000"]) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f00000000c0)={0xc}) sendfile(r4, r3, 0x0, 0x100000002) r5 = socket$rxrpc(0x21, 0x2, 0xa) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000007580), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000007640)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\b', @ANYRES16=r6, @ANYBLOB="ff830500000000000000", @ANYRES32=r5], 0x4}}, 0x0) dup2(0xffffffffffffffff, r5) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000140), 0xa002, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendfile(r2, r1, 0x0, 0x100000002) (async) openat$vsock(0xffffffffffffff9c, &(0x7f0000000180), 0x20a80, 0x0) (async) ioctl$IOMMU_VFIO_IOMMU_GET_INFO(r0, 0x3b70, &(0x7f0000000100)=ANY=[@ANYBLOB="4000000000000000000000000000f4ad4145b621822f00000000000000000000000000001f00000000000600000000000000007d592b11000000000000000000"]) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38}) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f00000000c0)={0xc}) (async) sendfile(r4, r3, 0x0, 0x100000002) (async) socket$rxrpc(0x21, 0x2, 0xa) (async) syz_genetlink_get_family_id$batadv(&(0x7f0000007580), 0xffffffffffffffff) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000007640)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\b', @ANYRES16=r6, @ANYBLOB="ff830500000000000000", @ANYRES32=r5], 0x4}}, 0x0) (async) dup2(0xffffffffffffffff, r5) (async) 02:52:55 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x1100000000000000}) 02:52:55 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xfffffff2}) 02:52:55 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000100), 0x70d8c1, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) ioctl$IOMMU_VFIO_IOAS$GET(r2, 0x3b88, &(0x7f0000000080)={0xc}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r3, 0x3b87, &(0x7f0000000040)={0x18}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x1, 0x0, 0x0, &(0x7f0000ffd000/0x1000)=nil, 0x1000, 0xfffffffffffffffd}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000002004}) dup2(r4, r5) 02:52:55 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:55 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x1200000000000000}) 02:52:55 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x700000000000000}) 02:52:55 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000100), 0x70d8c1, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) ioctl$IOMMU_VFIO_IOAS$GET(r2, 0x3b88, &(0x7f0000000080)={0xc}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r3, 0x3b87, &(0x7f0000000040)={0x18}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x1, 0x0, 0x0, &(0x7f0000ffd000/0x1000)=nil, 0x1000, 0xfffffffffffffffd}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000002004}) dup2(r4, r5) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000100), 0x70d8c1, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) (async) ioctl$IOMMU_VFIO_IOAS$GET(r2, 0x3b88, &(0x7f0000000080)={0xc}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r3, 0x3b87, &(0x7f0000000040)={0x18}) (async) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x1, 0x0, 0x0, &(0x7f0000ffd000/0x1000)=nil, 0x1000, 0xfffffffffffffffd}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) (async) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000002004}) (async) dup2(r4, r5) (async) 02:52:55 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000140), 0xa002, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r2, r1, 0x0, 0x100000002) openat$vsock(0xffffffffffffff9c, &(0x7f0000000180), 0x20a80, 0x0) ioctl$IOMMU_VFIO_IOMMU_GET_INFO(r0, 0x3b70, &(0x7f0000000100)=ANY=[@ANYBLOB="4000000000000000000000000000f4ad4145b621822f00000000000000000000000000001f00000000000600000000000000007d592b11000000000000000000"]) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f00000000c0)={0xc}) sendfile(r4, r3, 0x0, 0x100000002) (async) sendfile(r4, r3, 0x0, 0x100000002) socket$rxrpc(0x21, 0x2, 0xa) (async) r5 = socket$rxrpc(0x21, 0x2, 0xa) syz_genetlink_get_family_id$batadv(&(0x7f0000007580), 0xffffffffffffffff) (async) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000007580), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000007640)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\b', @ANYRES16=r6, @ANYBLOB="ff830500000000000000", @ANYRES32=r5], 0x4}}, 0x0) dup2(0xffffffffffffffff, r5) (async) dup2(0xffffffffffffffff, r5) 02:52:55 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x1000000000000}) 02:52:55 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:55 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x1800000000000000}) 02:52:55 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x800000000000000}) 02:52:55 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000000000}) 02:52:55 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000100), 0x70d8c1, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) (async) ioctl$IOMMU_VFIO_IOAS$GET(r2, 0x3b88, &(0x7f0000000080)={0xc}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r3, 0x3b87, &(0x7f0000000040)={0x18}) (async, rerun: 64) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x1, 0x0, 0x0, &(0x7f0000ffd000/0x1000)=nil, 0x1000, 0xfffffffffffffffd}) (async, rerun: 64) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000002004}) (async) dup2(r4, r5) 02:52:55 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:55 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x2000000000000000}) 02:52:55 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x900000000000000}) 02:52:55 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x100000000000000}) 02:52:55 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:55 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xa00000000000000}) 02:52:55 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x2500000000000000}) 02:52:55 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000474000/0x3000)=nil, 0x3000, 0x0, 0x12, r2, 0xe7c75000) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r6, 0x3ba0, &(0x7f0000000100)={0x38, 0x2, r1}) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000080)={0xc}) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r8, r7, 0x0, 0x100000002) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r7, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2002}) dup2(r4, r5) 02:52:55 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x200000000000000}) 02:52:55 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x4000000000000000}) 02:52:55 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:56 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xb00000000000000}) 02:52:56 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x300000000000000}) 02:52:56 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:56 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x4100000000000000}) 02:52:56 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xc00000000000000}) 02:52:56 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x40000, 0x0) r5 = openat$damon_kdamond_pid(0xffffffffffffff9c, &(0x7f00000000c0), 0x82002, 0x1) ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, &(0x7f0000000100)={0xc, 0x0}) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r7, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r8}) r9 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r9, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r9, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r10}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r0, 0x3ba0, &(0x7f0000000200)={0x38, 0x1, r10, 0x0, 0x8, 0xdd3}) ioctl$IOMMU_IOAS_UNMAP(r2, 0x3b86, &(0x7f00000001c0)={0x18, r8, 0xfffffffffffffffd, 0xffffffffffffffff}) ioctl$IOMMU_IOAS_COPY(r5, 0x3b83, &(0x7f0000000180)={0x28, 0x1, r6, r1, 0xc3, 0x0, 0x7}) ioctl$LOOP_SET_FD(r4, 0x4c00, r3) 02:52:56 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x400000000000000}) 02:52:56 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, 0x0, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) [ 634.138743][ T27] audit: type=1800 audit(1683773576.805:140): pid=18202 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz-executor.2" name="cgroup.controllers" dev="sda1" ino=1953 res=0 errno=0 02:52:56 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000474000/0x3000)=nil, 0x3000, 0x0, 0x12, r2, 0xe7c75000) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r6, 0x3ba0, &(0x7f0000000100)={0x38, 0x2, r1}) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000080)={0xc}) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r8, r7, 0x0, 0x100000002) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r7, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2002}) dup2(r4, r5) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) (async) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) write$binfmt_script(r6, &(0x7f0000000140)=ANY=[], 0x208e24b) (async) mmap(&(0x7f0000474000/0x3000)=nil, 0x3000, 0x0, 0x12, r2, 0xe7c75000) (async) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r6, 0x3ba0, &(0x7f0000000100)={0x38, 0x2, r1}) (async) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000080)={0xc}) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendfile(r8, r7, 0x0, 0x100000002) (async) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r7, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2002}) (async) dup2(r4, r5) (async) 02:52:56 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x40000, 0x0) r5 = openat$damon_kdamond_pid(0xffffffffffffff9c, &(0x7f00000000c0), 0x82002, 0x1) ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, &(0x7f0000000100)={0xc, 0x0}) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r7, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r8}) r9 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r9, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r9, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r10}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r0, 0x3ba0, &(0x7f0000000200)={0x38, 0x1, r10, 0x0, 0x8, 0xdd3}) ioctl$IOMMU_IOAS_UNMAP(r2, 0x3b86, &(0x7f00000001c0)={0x18, r8, 0xfffffffffffffffd, 0xffffffffffffffff}) ioctl$IOMMU_IOAS_COPY(r5, 0x3b83, &(0x7f0000000180)={0x28, 0x1, r6, r1, 0xc3, 0x0, 0x7}) ioctl$LOOP_SET_FD(r4, 0x4c00, r3) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1}) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x40000, 0x0) (async) openat$damon_kdamond_pid(0xffffffffffffff9c, &(0x7f00000000c0), 0x82002, 0x1) (async) ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, &(0x7f0000000100)={0xc}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000000)={0xc}) (async) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r7, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r8}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r9, 0x3b81, &(0x7f0000000000)={0xc}) (async) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r9, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r10}) (async) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r0, 0x3ba0, &(0x7f0000000200)={0x38, 0x1, r10, 0x0, 0x8, 0xdd3}) (async) ioctl$IOMMU_IOAS_UNMAP(r2, 0x3b86, &(0x7f00000001c0)={0x18, r8, 0xfffffffffffffffd, 0xffffffffffffffff}) (async) ioctl$IOMMU_IOAS_COPY(r5, 0x3b83, &(0x7f0000000180)={0x28, 0x1, r6, r1, 0xc3, 0x0, 0x7}) (async) ioctl$LOOP_SET_FD(r4, 0x4c00, r3) (async) 02:52:56 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xd00000000000000}) 02:52:56 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x5c00000000000000}) 02:52:56 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x500000000000000}) 02:52:56 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, 0x0, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:56 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xe00000000000000}) 02:52:56 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x7bffffffffffffff}) 02:52:56 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, 0x0, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:57 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x600000000000000}) 02:52:57 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1}) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x40000, 0x0) openat$damon_kdamond_pid(0xffffffffffffff9c, &(0x7f00000000c0), 0x82002, 0x1) (async) r5 = openat$damon_kdamond_pid(0xffffffffffffff9c, &(0x7f00000000c0), 0x82002, 0x1) ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, &(0x7f0000000100)={0xc, 0x0}) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000000)={0xc}) (async) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r7, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r8}) r9 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r9, 0x3b81, &(0x7f0000000000)={0xc}) (async) ioctl$IOMMU_IOAS_ALLOC(r9, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r9, 0x3b87, &(0x7f0000000040)={0x18, 0x1, 0x0, 0x0, r10}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r0, 0x3ba0, &(0x7f0000000200)={0x38, 0x1, r10, 0x0, 0x8, 0xdd3}) ioctl$IOMMU_IOAS_UNMAP(r2, 0x3b86, &(0x7f00000001c0)={0x18, r8, 0xfffffffffffffffd, 0xffffffffffffffff}) ioctl$IOMMU_IOAS_COPY(r5, 0x3b83, &(0x7f0000000180)={0x28, 0x1, r6, r1, 0xc3, 0x0, 0x7}) ioctl$LOOP_SET_FD(r4, 0x4c00, r3) 02:52:57 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(0xffffffffffffffff, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:57 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) (async) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000474000/0x3000)=nil, 0x3000, 0x0, 0x12, r2, 0xe7c75000) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r6, 0x3ba0, &(0x7f0000000100)={0x38, 0x2, r1}) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000080)={0xc}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r8, r7, 0x0, 0x100000002) (async) sendfile(r8, r7, 0x0, 0x100000002) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r7, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2002}) dup2(r4, r5) 02:52:57 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x1000000000000000}) 02:52:57 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x700000000000000}) 02:52:57 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xf0ffffffffffffff}) 02:52:57 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000180), 0x88a40, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/sync_sock_size\x00', 0x2, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r3, 0x3ba0, &(0x7f0000000100)={0x38, 0x5, r4}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r5) 02:52:57 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(0xffffffffffffffff, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) [ 634.836964][ T27] audit: type=1804 audit(1683773577.505:141): pid=18250 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir2584099632/syzkaller.rk9O0G/815/cgroup.controllers" dev="sda1" ino=1954 res=1 errno=0 02:52:57 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(0xffffffffffffffff, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:57 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xf2ffffffffffffff}) 02:52:57 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x1100000000000000}) 02:52:57 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000180), 0x88a40, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/sync_sock_size\x00', 0x2, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r3, 0x3ba0, &(0x7f0000000100)={0x38, 0x5, r4}) (async) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) dup2(r2, r5) 02:52:57 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x800000000000000}) 02:52:57 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) [ 635.203140][ T27] audit: type=1804 audit(1683773577.865:142): pid=18271 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir2584099632/syzkaller.rk9O0G/816/cgroup.controllers" dev="sda1" ino=1959 res=1 errno=0 02:52:57 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r6, 0x0) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r6, 0x3ba0, &(0x7f0000000080)={0x38, 0x1, r1, 0x0, 0x9a3, 0x9}) dup2(r4, r5) 02:52:57 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x900000000000000}) 02:52:57 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xfdfdffff00000000}) 02:52:57 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x1200000000000000}) 02:52:57 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000180), 0x88a40, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/sync_sock_size\x00', 0x2, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r3, 0x3ba0, &(0x7f0000000100)={0x38, 0x5, r4}) (async, rerun: 32) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff}) (rerun: 32) dup2(r2, r5) 02:52:57 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) [ 635.246387][ T27] audit: type=1804 audit(1683773577.915:143): pid=18272 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir2584099632/syzkaller.rk9O0G/816/cgroup.controllers" dev="sda1" ino=1959 res=1 errno=0 02:52:58 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x1800000000000000}) 02:52:58 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xa00000000000000}) 02:52:58 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xff3f000000000000}) 02:52:58 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:58 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x101180, 0x0) r4 = accept4$tipc(0xffffffffffffffff, &(0x7f0000000100)=@id, &(0x7f0000000180)=0x10, 0x800) ioctl$AUTOFS_IOC_SETTIMEOUT(r4, 0x80049367, &(0x7f00000001c0)=0xb38) ioctl$IOMMU_IOAS_COPY(r0, 0x3b83, &(0x7f0000000080)={0x28, 0x2, r1, r1, 0xfffffffffffffffb, 0x7, 0x8}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000200)={{0x1, 0x1, 0x18, r3, {0xffffffffffffffff, 0xee01}}, './file0\x00'}) sendmsg$nl_route(r5, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)=@ipv6_deladdrlabel={0x68, 0x49, 0x1, 0x70bd25, 0x25dfdbfd, {0xa, 0x0, 0x18, 0x0, 0x0, 0xe22a}, [@IFAL_LABEL={0x8, 0x2, 0x1}, @IFAL_ADDRESS={0x14, 0x1, @mcast1}, @IFAL_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @IFAL_ADDRESS={0x14, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}, @IFAL_LABEL={0x8, 0x2, 0x2}]}, 0x68}, 0x1, 0x0, 0x0, 0x401a0}, 0x48000) dup2(r2, 0xffffffffffffffff) 02:52:58 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x2000000000000000}) 02:52:58 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async, rerun: 32) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (rerun: 32) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r6, 0x0) (async) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r6, 0x3ba0, &(0x7f0000000080)={0x38, 0x1, r1, 0x0, 0x9a3, 0x9}) dup2(r4, r5) 02:52:58 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xffffff7f00000000}) 02:52:58 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:58 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xb00000000000000}) 02:52:58 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x101180, 0x0) r4 = accept4$tipc(0xffffffffffffffff, &(0x7f0000000100)=@id, &(0x7f0000000180)=0x10, 0x800) ioctl$AUTOFS_IOC_SETTIMEOUT(r4, 0x80049367, &(0x7f00000001c0)=0xb38) ioctl$IOMMU_IOAS_COPY(r0, 0x3b83, &(0x7f0000000080)={0x28, 0x2, r1, r1, 0xfffffffffffffffb, 0x7, 0x8}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000200)={{0x1, 0x1, 0x18, r3, {0xffffffffffffffff, 0xee01}}, './file0\x00'}) sendmsg$nl_route(r5, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)=@ipv6_deladdrlabel={0x68, 0x49, 0x1, 0x70bd25, 0x25dfdbfd, {0xa, 0x0, 0x18, 0x0, 0x0, 0xe22a}, [@IFAL_LABEL={0x8, 0x2, 0x1}, @IFAL_ADDRESS={0x14, 0x1, @mcast1}, @IFAL_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @IFAL_ADDRESS={0x14, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}, @IFAL_LABEL={0x8, 0x2, 0x2}]}, 0x68}, 0x1, 0x0, 0x0, 0x401a0}, 0x48000) dup2(r2, 0xffffffffffffffff) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc}) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x101180, 0x0) (async) accept4$tipc(0xffffffffffffffff, &(0x7f0000000100)=@id, &(0x7f0000000180)=0x10, 0x800) (async) ioctl$AUTOFS_IOC_SETTIMEOUT(r4, 0x80049367, &(0x7f00000001c0)=0xb38) (async) ioctl$IOMMU_IOAS_COPY(r0, 0x3b83, &(0x7f0000000080)={0x28, 0x2, r1, r1, 0xfffffffffffffffb, 0x7, 0x8}) (async) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000200)={{0x1, 0x1, 0x18, r3, {0xffffffffffffffff, 0xee01}}, './file0\x00'}) (async) sendmsg$nl_route(r5, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)=@ipv6_deladdrlabel={0x68, 0x49, 0x1, 0x70bd25, 0x25dfdbfd, {0xa, 0x0, 0x18, 0x0, 0x0, 0xe22a}, [@IFAL_LABEL={0x8, 0x2, 0x1}, @IFAL_ADDRESS={0x14, 0x1, @mcast1}, @IFAL_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @IFAL_ADDRESS={0x14, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}, @IFAL_LABEL={0x8, 0x2, 0x2}]}, 0x68}, 0x1, 0x0, 0x0, 0x401a0}, 0x48000) (async) dup2(r2, 0xffffffffffffffff) (async) 02:52:58 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xc00000000000000}) 02:52:58 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xffffffff00000000}) 02:52:58 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x2500000000000000}) 02:52:58 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:58 executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) (async) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x101180, 0x0) (async, rerun: 64) r4 = accept4$tipc(0xffffffffffffffff, &(0x7f0000000100)=@id, &(0x7f0000000180)=0x10, 0x800) (rerun: 64) ioctl$AUTOFS_IOC_SETTIMEOUT(r4, 0x80049367, &(0x7f00000001c0)=0xb38) (async, rerun: 32) ioctl$IOMMU_IOAS_COPY(r0, 0x3b83, &(0x7f0000000080)={0x28, 0x2, r1, r1, 0xfffffffffffffffb, 0x7, 0x8}) (async, rerun: 32) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000200)={{0x1, 0x1, 0x18, r3, {0xffffffffffffffff, 0xee01}}, './file0\x00'}) sendmsg$nl_route(r5, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)=@ipv6_deladdrlabel={0x68, 0x49, 0x1, 0x70bd25, 0x25dfdbfd, {0xa, 0x0, 0x18, 0x0, 0x0, 0xe22a}, [@IFAL_LABEL={0x8, 0x2, 0x1}, @IFAL_ADDRESS={0x14, 0x1, @mcast1}, @IFAL_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @IFAL_ADDRESS={0x14, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}, @IFAL_LABEL={0x8, 0x2, 0x2}]}, 0x68}, 0x1, 0x0, 0x0, 0x401a0}, 0x48000) (async, rerun: 32) dup2(r2, 0xffffffffffffffff) (rerun: 32) 02:52:58 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xd00000000000000}) 02:52:58 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x4000000000000000}) 02:52:58 executing program 2: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) (async) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async, rerun: 64) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) (rerun: 64) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000}) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000140)=ANY=[], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r6, 0x0) (async, rerun: 32) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r6, 0x3ba0, &(0x7f0000000080)={0x38, 0x1, r1, 0x0, 0x9a3, 0x9}) (async, rerun: 32) dup2(r4, r5) 02:52:58 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x0, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) 02:52:58 executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xffffffffffffff7b}) 02:52:58 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0xe00000000000000}) 02:52:58 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x4100000000000000}) 02:52:58 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, 0x0, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) [ 635.863808][T18350] ------------[ cut here ]------------ [ 635.870408][T18350] WARNING: CPU: 0 PID: 18350 at drivers/iommu/iommufd/selftest.c:762 iommufd_test_check_pages+0x240/0x250 [ 635.882126][T18350] Modules linked in: [ 635.886103][T18350] CPU: 0 PID: 18350 Comm: syz-executor.4 Not tainted 6.4.0-rc1-syzkaller-00021-gad2fd53a7870 #0 [ 635.897464][T18350] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023 [ 635.907622][T18350] RIP: 0010:iommufd_test_check_pages+0x240/0x250 [ 635.914058][T18350] Code: 65 48 8b 04 25 28 00 00 00 48 3b 84 24 80 00 00 00 75 21 44 89 f0 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 10 c9 c0 fc <0f> 0b 41 be f2 ff ff ff eb ac e8 e1 10 e4 05 90 f3 0f 1e fa 55 41 [ 635.933741][T18350] RSP: 0018:ffffc90005557b80 EFLAGS: 00010283 [ 635.939862][T18350] RAX: ffffffff84ca9e30 RBX: 1ffff92000aaaf78 RCX: 0000000000040000 [ 635.947953][T18350] RDX: ffffc9000c2f4000 RSI: 0000000000000685 RDI: 0000000000000686 [ 635.956011][T18350] RBP: ffffc90005557c50 R08: ffffffff84ca9d16 R09: fffffbfff1cab806 02:52:58 executing program 3: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x5c00000000000000}) 02:52:58 executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, r3, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r5, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x1000000000000000}) 02:52:58 executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x2, 0x0, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000240)={0x38, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000280)={0x38, 0x7, r4, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x2000, 0x20000000}) [ 635.964062][T18350] R10: 0000000000000000 R11: dffffc0000000001 R12: ffffffffffffff7b [ 635.972512][T18350] R13: dffffc0000000000 R14: 0000000000000000 R15: ffffc90005557be0 [ 635.980559][T18350] FS: 00007fdb7c9b0700(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 [ 635.989578][T18350] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 635.996239][T18350] CR2: 00007fdb7bcdf360 CR3: 0000000021d07000 CR4: 00000000003506f0 [ 636.004284][T18350] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 636.012290][T18350] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 636.020345][T18350] Call Trace: [ 636.023687][T18350] [ 636.026645][T18350] ? iommufd_test_access_unmap+0x2e0/0x2e0 [ 636.032484][T18350] ? __kmalloc_node+0xe8/0x230 [ 636.037333][T18350] iommufd_test+0x20ae/0x28b0 [ 636.042046][T18350] ? __might_fault+0xbe/0x120 [ 636.046794][T18350] ? iommufd_selftest_destroy+0x140/0x140 [ 636.052550][T18350] ? __might_fault+0xba/0x120 [ 636.057311][T18350] iommufd_fops_ioctl+0x4c2/0x580 [ 636.062374][T18350] ? iommufd_ctx_put+0x40/0x40 [ 636.067237][T18350] ? __fget_files+0x3cf/0x440 [ 636.071950][T18350] ? bpf_lsm_file_ioctl+0x9/0x10 [ 636.076980][T18350] ? security_file_ioctl+0x81/0xa0 [ 636.082127][T18350] ? iommufd_ctx_put+0x40/0x40 [ 636.086981][T18350] __se_sys_ioctl+0xf1/0x160 [ 636.091609][T18350] do_syscall_64+0x41/0xc0 [ 636.096107][T18350] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 636.102214][T18350] RIP: 0033:0x7fdb7bc8c169 [ 636.106705][T18350] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 636.126388][T18350] RSP: 002b:00007fdb7c9b0168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 636.134892][T18350] RAX: ffffffffffffffda RBX: 00007fdb7bdabf80 RCX: 00007fdb7bc8c169 [ 636.142892][T18350] RDX: 0000000020000280 RSI: 0000000000003ba0 RDI: 0000000000000005 [ 636.150935][T18350] RBP: 00007fdb7bce7ca1 R08: 0000000000000000 R09: 0000000000000000 [ 636.158975][T18350] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 636.167010][T18350] R13: 00007ffe1d675c5f R14: 00007fdb7c9b0300 R15: 0000000000022000 [ 636.175203][T18350] [ 636.178243][T18350] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 636.185533][T18350] CPU: 0 PID: 18350 Comm: syz-executor.4 Not tainted 6.4.0-rc1-syzkaller-00021-gad2fd53a7870 #0 [ 636.195958][T18350] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023 [ 636.206037][T18350] Call Trace: [ 636.209335][T18350] [ 636.212282][T18350] dump_stack_lvl+0x1e7/0x2d0 [ 636.216994][T18350] ? nf_tcp_handle_invalid+0x650/0x650 [ 636.222485][T18350] ? panic+0x770/0x770 [ 636.226587][T18350] ? vscnprintf+0x5d/0x80 [ 636.230946][T18350] panic+0x30f/0x770 [ 636.234873][T18350] ? __warn+0x171/0x4a0 [ 636.239058][T18350] ? __memcpy_flushcache+0x2b0/0x2b0 [ 636.244384][T18350] __warn+0x314/0x4a0 [ 636.248393][T18350] ? iommufd_test_check_pages+0x240/0x250 [ 636.254147][T18350] report_bug+0x2b3/0x500 [ 636.258571][T18350] ? iommufd_test_check_pages+0x240/0x250 [ 636.264321][T18350] handle_bug+0x3d/0x70 [ 636.268505][T18350] exc_invalid_op+0x1a/0x50 [ 636.273041][T18350] asm_exc_invalid_op+0x1a/0x20 [ 636.277915][T18350] RIP: 0010:iommufd_test_check_pages+0x240/0x250 [ 636.284269][T18350] Code: 65 48 8b 04 25 28 00 00 00 48 3b 84 24 80 00 00 00 75 21 44 89 f0 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 10 c9 c0 fc <0f> 0b 41 be f2 ff ff ff eb ac e8 e1 10 e4 05 90 f3 0f 1e fa 55 41 [ 636.303992][T18350] RSP: 0018:ffffc90005557b80 EFLAGS: 00010283 [ 636.310087][T18350] RAX: ffffffff84ca9e30 RBX: 1ffff92000aaaf78 RCX: 0000000000040000 [ 636.318085][T18350] RDX: ffffc9000c2f4000 RSI: 0000000000000685 RDI: 0000000000000686 [ 636.326092][T18350] RBP: ffffc90005557c50 R08: ffffffff84ca9d16 R09: fffffbfff1cab806 [ 636.334095][T18350] R10: 0000000000000000 R11: dffffc0000000001 R12: ffffffffffffff7b [ 636.342101][T18350] R13: dffffc0000000000 R14: 0000000000000000 R15: ffffc90005557be0 [ 636.350203][T18350] ? iommufd_test_check_pages+0x126/0x250 [ 636.355954][T18350] ? iommufd_test_check_pages+0x240/0x250 [ 636.361719][T18350] ? iommufd_test_access_unmap+0x2e0/0x2e0 [ 636.367553][T18350] ? __kmalloc_node+0xe8/0x230 [ 636.372353][T18350] iommufd_test+0x20ae/0x28b0 [ 636.377064][T18350] ? __might_fault+0xbe/0x120 [ 636.381775][T18350] ? iommufd_selftest_destroy+0x140/0x140 [ 636.387524][T18350] ? __might_fault+0xba/0x120 [ 636.392234][T18350] iommufd_fops_ioctl+0x4c2/0x580 [ 636.397294][T18350] ? iommufd_ctx_put+0x40/0x40 [ 636.402093][T18350] ? __fget_files+0x3cf/0x440 [ 636.406811][T18350] ? bpf_lsm_file_ioctl+0x9/0x10 [ 636.411773][T18350] ? security_file_ioctl+0x81/0xa0 [ 636.416913][T18350] ? iommufd_ctx_put+0x40/0x40 [ 636.421711][T18350] __se_sys_ioctl+0xf1/0x160 [ 636.426333][T18350] do_syscall_64+0x41/0xc0 [ 636.430778][T18350] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 636.436695][T18350] RIP: 0033:0x7fdb7bc8c169 [ 636.441141][T18350] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 636.460772][T18350] RSP: 002b:00007fdb7c9b0168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 636.469218][T18350] RAX: ffffffffffffffda RBX: 00007fdb7bdabf80 RCX: 00007fdb7bc8c169 [ 636.477213][T18350] RDX: 0000000020000280 RSI: 0000000000003ba0 RDI: 0000000000000005 [ 636.485221][T18350] RBP: 00007fdb7bce7ca1 R08: 0000000000000000 R09: 0000000000000000 [ 636.493217][T18350] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 636.501215][T18350] R13: 00007ffe1d675c5f R14: 00007fdb7c9b0300 R15: 0000000000022000 [ 636.509226][T18350] [ 636.512600][T18350] Kernel Offset: disabled [ 636.517112][T18350] Rebooting in 86400 seconds..